diff --git a/.github/actions/publish/action.yml b/.github/actions/publish/action.yml deleted file mode 100644 index 4773f3f3..00000000 --- a/.github/actions/publish/action.yml +++ /dev/null @@ -1,55 +0,0 @@ -inputs: - version: - required: true - type: string - description: 'Three digits version like 5.6.0' - MARKETPLACE_TOKEN: - required: true - type: string - NUGET_TOKEN: - required: true - type: string - -runs: - using: "composite" - steps: - - name: Zip security-scan 4.x - shell: bash - run: 7z a security-scan4x.zip "./SecurityCodeScan.Tool/.NET 4.x/bin/Release/net48/*" - - - name: Create draft release - uses: softprops/action-gh-release@8a65c813553f4d05769635eb1b70180d25b9b61b - with: - draft: true - name: ${{inputs.version}} - tag_name: ${{inputs.version}} - fail_on_unmatched_files: true - files: | - ./SecurityCodeScan/bin/Release/**/*.nupkg - ./SecurityCodeScan.Vsix/bin/Release/*.vsix - ./SecurityCodeScan.Tool/.NET Core/bin/Release/*.nupkg - security-scan4x.zip - - - name: Publish vsix - shell: powershell - env: - marketplace_token: ${{ inputs.MARKETPLACE_TOKEN }} - run: | - Write-Host "Pushing to visual studio market place" - $visualStudioInstallation = & "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe" -latest -products * -requires Microsoft.VisualStudio.Component.VSSDK -property installationPath - $vsixPublisher = Join-Path $visualStudioInstallation 'VSSDK\VisualStudioIntegration\Tools\Bin\VsixPublisher.exe' - & $vsixPublisher login -publisherName JaroslavLobacevski -personalAccessToken $env:marketplace_token - $vsix = Get-ChildItem -File .\SecurityCodeScan.Vsix\bin -recurse | Where-Object { $_.Extension -eq ".vsix" } | Select-Object -First 1 -ExpandProperty FullName - $ManifestPath = ".\SecurityCodeScan.Vsix\marketplace.json" - & $vsixPublisher publish -payload $vsix -publishManifest $ManifestPath -personalAccessToken $env:marketplace_token - # currently vsixpublisher.exe throws non critical telemetry exception but does the job done - # force successful exit code - [Environment]::Exit(0) - - - name: Publish nugets - shell: bash - env: - nuget_token: ${{ inputs.NUGET_TOKEN }} - run: | - dotnet nuget push "./SecurityCodeScan/bin/Release/netstandard2.0/SecurityCodeScan.VS2019.${{inputs.version}}.nupkg" -k $nuget_token -s https://api.nuget.org/v3/index.json - dotnet nuget push "./SecurityCodeScan.Tool/.NET Core/bin/Release/security-scan.${{inputs.version}}.nupkg" -k $nuget_token -s https://api.nuget.org/v3/index.json diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index c1c5d01f..dd741616 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -1,3 +1,4 @@ +name: "Reusable build" on: workflow_call: inputs: @@ -7,15 +8,12 @@ on: configuration: required: true type: string - publish: + makeartifacts: required: false type: boolean default: false - secrets: - MARKETPLACE_TOKEN: - required: false - NUGET_TOKEN: - required: false + +permissions: {} jobs: build: @@ -27,16 +25,17 @@ jobs: DOTNET_CLI_TELEMETRY_OPTOUT: 1 steps: + - name: Checkout uses: actions/checkout@v2 with: - fetch-depth: 0 persist-credentials: false - name: Setup .NET SDK uses: actions/setup-dotnet@v1 with: dotnet-version: | + 3.1.x 5.0.x 6.0.x include-prerelease: false @@ -56,14 +55,23 @@ jobs: run: msbuild -m $env:Solution_Name /p:Configuration=$env:Configuration env: Configuration: ${{ inputs.configuration }} - + - name: Run Tests run: vstest.console.exe ./SecurityCodeScan.Test/bin/${{ inputs.configuration }}/SecurityCodeScan.Test.dll - - name: Publish - if: ${{ inputs.publish }} - uses: ./.github/actions/publish - with: - version: ${{ inputs.version }} - MARKETPLACE_TOKEN: ${{ secrets.MARKETPLACE_TOKEN }} - NUGET_TOKEN: ${{ secrets.NUGET_TOKEN }} + - name: Zip security-scan 4.x + if: ${{ inputs.makeartifacts }} + shell: bash + run: 7z a security-scan4x.zip "./SecurityCodeScan.Tool/.NET 4.x/bin/Release/net48/*" + + - name: Upload artifacts + if: ${{ inputs.makeartifacts }} + uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 + with: + retention-days: 1 + name: packages + path: | + security-scan4x.zip + ./SecurityCodeScan/bin/Release/**/*.nupkg + ./SecurityCodeScan.Vsix/bin/Release/*.vsix + ./SecurityCodeScan.Tool/.NET Core/bin/Release/*.nupkg diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3b9df08c..33f75642 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -4,6 +4,10 @@ name: Build on: push: +concurrency: + group: onpush + cancel-in-progress: true + jobs: debug: uses: security-code-scan/security-code-scan/.github/workflows/build.yml@vs2019 diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index fa15ff65..2be5f40a 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -1,3 +1,4 @@ +name: "Pull request" on: pull_request: diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml new file mode 100644 index 00000000..9047c176 --- /dev/null +++ b/.github/workflows/publish.yml @@ -0,0 +1,82 @@ +name: "2. Publish" +on: + release: + types: [published] + +permissions: {} + +jobs: + release-notes: + permissions: + contents: write + runs-on: ubuntu-latest + steps: + + - uses: actions/checkout@v2 + with: + ref: vs2019 + persist-credentials: true + + - name: Append release body to release notes + env: + release_notes: ${{github.event.release.body}} + run: | + git config --global user.email "octokit@github.com" + git config --global user.name "Octokit" + head --lines=2 website/releasenotes.md > website/new_releasenotes.md + echo "$release_notes" >> website/new_releasenotes.md + tail --lines=+2 website/releasenotes.md >> website/new_releasenotes.md + mv website/new_releasenotes.md website/releasenotes.md + sed -i 's/[0-9]\.[0-9]\.[0-9]\.[0-9]<\/AssemblyVersionNumber>/${{github.event.release.tag_name}}.9<\/AssemblyVersionNumber>/g' Directory.Build.props + git add . + git commit -a -m "Update release notes & bump dev version" + git push + shell: bash + + publish: + needs: [release-notes] + runs-on: windows-2022 + steps: + + - uses: actions/checkout@v2 + with: + persist-credentials: false + + - name: Download artifacts + uses: dsaltares/fetch-gh-release-asset@c3deec3cfc2231c6f842eef6d624b55223743c43 + with: + file: 'security-scan.${{github.event.release.tag_name}}.nupkg' + + - name: Download artifacts + uses: dsaltares/fetch-gh-release-asset@c3deec3cfc2231c6f842eef6d624b55223743c43 + with: + file: 'SecurityCodeScan.VS2019.${{github.event.release.tag_name}}.nupkg' + + - name: Download artifacts + uses: dsaltares/fetch-gh-release-asset@c3deec3cfc2231c6f842eef6d624b55223743c43 + with: + file: 'SecurityCodeScan.VS2019.Vsix.vsix' + + - name: Publish vsix + shell: powershell + env: + marketplace_token: ${{ secrets.MARKETPLACE_TOKEN }} + run: | + Write-Host "Pushing to visual studio market place" + $visualStudioInstallation = & "${env:ProgramFiles(x86)}\Microsoft Visual Studio\Installer\vswhere.exe" -latest -products * -requires Microsoft.VisualStudio.Component.VSSDK -property installationPath + $vsixPublisher = Join-Path $visualStudioInstallation 'VSSDK\VisualStudioIntegration\Tools\Bin\VsixPublisher.exe' + & $vsixPublisher login -publisherName JaroslavLobacevski -personalAccessToken $env:marketplace_token + $vsix = Get-ChildItem -File SecurityCodeScan.VS2019.Vsix.vsix -recurse | Select-Object -First 1 -ExpandProperty FullName + $ManifestPath = ".\SecurityCodeScan.Vsix\marketplace.json" + & $vsixPublisher publish -payload $vsix -publishManifest $ManifestPath -personalAccessToken $env:marketplace_token + # currently vsixpublisher.exe throws non critical telemetry exception but does the job done + # force successful exit code + [Environment]::Exit(0) + + - name: Publish nugets + shell: bash + env: + nuget_token: ${{ secrets.NUGET_TOKEN }} + run: | + dotnet nuget push "SecurityCodeScan.VS2019.${{github.event.release.tag_name}}.nupkg" -k $nuget_token -s https://api.nuget.org/v3/index.json + dotnet nuget push "security-scan.${{github.event.release.tag_name}}.nupkg" -k $nuget_token -s https://api.nuget.org/v3/index.json diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 56c25364..ecf1dd6b 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,3 +1,4 @@ +name: "1. Make release draft" on: workflow_dispatch: inputs: @@ -6,13 +7,39 @@ on: required: true type: string +permissions: {} + jobs: - release: + build: uses: security-code-scan/security-code-scan/.github/workflows/build.yml@vs2019 with: - version: ${{ github.event.inputs.version }} configuration: Release - publish: true - secrets: - MARKETPLACE_TOKEN: ${{ secrets.MARKETPLACE_TOKEN }} - NUGET_TOKEN: ${{ secrets.NUGET_TOKEN }} + version: ${{inputs.version}} + makeartifacts: true + + release: + permissions: + contents: write + needs: build + runs-on: ubuntu-latest + steps: + + - name: Download artifacts + uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741 + with: + name: packages + path: artifacts + + - name: Create draft release + uses: softprops/action-gh-release@8a65c813553f4d05769635eb1b70180d25b9b61b + with: + draft: true + name: ${{inputs.version}} + tag_name: ${{inputs.version}} + fail_on_unmatched_files: true + generate_release_notes: false + files: | + ./artifacts/security-scan4x.zip + ./artifacts/SecurityCodeScan/bin/Release/**/*.nupkg + ./artifacts/SecurityCodeScan.Vsix/bin/Release/*.vsix + ./artifacts/SecurityCodeScan.Tool/.NET Core/bin/Release/*.nupkg diff --git a/Directory.Build.props b/Directory.Build.props index 5f11f4e2..83eba849 100644 --- a/Directory.Build.props +++ b/Directory.Build.props @@ -1,6 +1,6 @@ - 3.8.0 + 3.11.0 @@ -10,7 +10,7 @@ - 5.6.2.0 + 5.6.7.9 diff --git a/NuGet.exe b/NuGet.exe deleted file mode 100644 index 7d4cdaef..00000000 Binary files a/NuGet.exe and /dev/null differ diff --git a/README.md b/README.md index a43c243e..e0aafe09 100644 --- a/README.md +++ b/README.md @@ -32,7 +32,7 @@ Tests are ideal for developing features and fixing bugs as it is easy to debug. ### Debugging In case you are not sure what is wrong or you see AD0001 error with an exception, it is possible to debug the analysis of problematic Visual Studio solution. -> Visual Studio offloads some static analysis work to a separate process. It is a good idea to uncomment [the lines](https://github.com/security-code-scan/security-code-scan/blob/b246418f5d17ba8634ffd70295da636ee3596fc5/SecurityCodeScan/Analyzers/Analyzers.cs#L134-L135) to have a chance to debug the child process. +> Visual Studio offloads some static analysis work to a separate process. It is a good idea to uncomment [the lines](https://github.com/security-code-scan/security-code-scan/blob/39912cfa53168e954b78d6eabc597e97311a54d3/SecurityCodeScan/Analyzers/Taint/TaintAnalyzer.cs#L140-L142) to have a chance to debug the child process. First, make sure there are no Security Code Scan Visual Studio extensions installed to avoid interference. Right click `SecurityCodeScan.Vsix` project in the solution and choose `Set as StartUp project`. diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..0d5cbdc4 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,11 @@ +# Security Policy + +## Supported Versions + +| Version | Supported | +| ------- | ------------------ | +| 5.x.x | :white_check_mark: | + +## Reporting a Vulnerability + +Please report potential vulnerabilities [here](https://github.com/security-code-scan/security-code-scan/security/advisories/new). diff --git a/SecurityCodeScan.Test/SecurityCodeScan.Test.csproj b/SecurityCodeScan.Test/SecurityCodeScan.Test.csproj index 4457255f..1b930127 100644 --- a/SecurityCodeScan.Test/SecurityCodeScan.Test.csproj +++ b/SecurityCodeScan.Test/SecurityCodeScan.Test.csproj @@ -1,9 +1,9 @@  + - @@ -57,8 +57,8 @@ ..\packages\Castle.Core.3.3.3\lib\net45\Castle.Core.dll True - - ..\packages\DiffPlex.1.4.4\lib\net40\DiffPlex.dll + + ..\packages\DiffPlex.1.5.0\lib\net40\DiffPlex.dll ..\packages\EntityFramework.6.2.0\lib\net45\EntityFramework.dll @@ -217,29 +217,29 @@ ..\packages\Microsoft.Bcl.HashCode.1.1.0\lib\net461\Microsoft.Bcl.HashCode.dll - - ..\packages\Microsoft.CodeAnalysis.Analyzer.Testing.1.1.0\lib\net46\Microsoft.CodeAnalysis.Analyzer.Testing.dll + + ..\packages\Microsoft.CodeAnalysis.Common.3.11.0\lib\netstandard2.0\Microsoft.CodeAnalysis.dll - - ..\packages\Microsoft.CodeAnalysis.Razor.2.1.0\lib\net46\Microsoft.CodeAnalysis.Razor.dll + + ..\packages\Microsoft.CodeAnalysis.Analyzer.Testing.1.1.1\lib\net472\Microsoft.CodeAnalysis.Analyzer.Testing.dll - - ..\packages\Microsoft.CodeAnalysis.Common.3.8.0\lib\netstandard2.0\Microsoft.CodeAnalysis.dll + + ..\packages\Microsoft.CodeAnalysis.CSharp.3.11.0\lib\netstandard2.0\Microsoft.CodeAnalysis.CSharp.dll - - ..\packages\Microsoft.CodeAnalysis.CSharp.3.8.0\lib\netstandard2.0\Microsoft.CodeAnalysis.CSharp.dll + + ..\packages\Microsoft.CodeAnalysis.CSharp.Workspaces.3.11.0\lib\netstandard2.0\Microsoft.CodeAnalysis.CSharp.Workspaces.dll - - ..\packages\Microsoft.CodeAnalysis.CSharp.Workspaces.3.8.0\lib\netstandard2.0\Microsoft.CodeAnalysis.CSharp.Workspaces.dll + + ..\packages\Microsoft.CodeAnalysis.Razor.2.1.0\lib\net46\Microsoft.CodeAnalysis.Razor.dll - - ..\packages\Microsoft.CodeAnalysis.VisualBasic.3.8.0\lib\netstandard2.0\Microsoft.CodeAnalysis.VisualBasic.dll + + ..\packages\Microsoft.CodeAnalysis.VisualBasic.3.11.0\lib\netstandard2.0\Microsoft.CodeAnalysis.VisualBasic.dll - - ..\packages\Microsoft.CodeAnalysis.VisualBasic.Workspaces.3.8.0\lib\netstandard2.0\Microsoft.CodeAnalysis.VisualBasic.Workspaces.dll + + ..\packages\Microsoft.CodeAnalysis.VisualBasic.Workspaces.3.11.0\lib\netstandard2.0\Microsoft.CodeAnalysis.VisualBasic.Workspaces.dll - - ..\packages\Microsoft.CodeAnalysis.Workspaces.Common.3.8.0\lib\netstandard2.0\Microsoft.CodeAnalysis.Workspaces.dll + + ..\packages\Microsoft.CodeAnalysis.Workspaces.Common.3.11.0\lib\netstandard2.0\Microsoft.CodeAnalysis.Workspaces.dll ..\packages\Microsoft.Data.Sqlite.1.1.1\lib\net451\Microsoft.Data.Sqlite.dll @@ -366,8 +366,8 @@ ..\packages\Moq.4.5.16\lib\net45\Moq.dll True - - ..\packages\Newtonsoft.Json.11.0.2\lib\net45\Newtonsoft.Json.dll + + ..\packages\Newtonsoft.Json.13.0.1\lib\net45\Newtonsoft.Json.dll ..\packages\Newtonsoft.Json.Bson.1.0.1\lib\net45\Newtonsoft.Json.Bson.dll @@ -378,29 +378,29 @@ ..\packages\Npgsql.3.0.8\lib\net45\Npgsql.dll - - ..\packages\NuGet.Common.4.9.4\lib\net46\NuGet.Common.dll + + ..\packages\NuGet.Common.5.6.0\lib\net472\NuGet.Common.dll - - ..\packages\NuGet.Configuration.4.9.4\lib\net46\NuGet.Configuration.dll + + ..\packages\NuGet.Configuration.5.6.0\lib\net472\NuGet.Configuration.dll - - ..\packages\NuGet.Frameworks.4.9.4\lib\net46\NuGet.Frameworks.dll + + ..\packages\NuGet.Frameworks.5.6.0\lib\net472\NuGet.Frameworks.dll - - ..\packages\NuGet.Packaging.4.9.4\lib\net46\NuGet.Packaging.dll + + ..\packages\NuGet.Packaging.5.6.0\lib\net472\NuGet.Packaging.dll ..\packages\NuGet.Packaging.Core.4.9.4\lib\net46\NuGet.Packaging.Core.dll - - ..\packages\NuGet.Protocol.4.9.4\lib\net46\NuGet.Protocol.dll + + ..\packages\NuGet.Protocol.5.6.0\lib\net472\NuGet.Protocol.dll - - ..\packages\NuGet.Resolver.4.9.4\lib\net46\NuGet.Resolver.dll + + ..\packages\NuGet.Resolver.5.6.0\lib\net472\NuGet.Resolver.dll - - ..\packages\NuGet.Versioning.4.9.4\lib\net46\NuGet.Versioning.dll + + ..\packages\NuGet.Versioning.5.6.0\lib\net472\NuGet.Versioning.dll ..\packages\Remotion.Linq.2.1.1\lib\net45\Remotion.Linq.dll @@ -494,8 +494,8 @@ ..\packages\System.IO.FileSystem.Primitives.4.3.0\lib\net46\System.IO.FileSystem.Primitives.dll - - ..\packages\System.IO.Pipelines.5.0.0\lib\net461\System.IO.Pipelines.dll + + ..\packages\System.IO.Pipelines.5.0.1\lib\net461\System.IO.Pipelines.dll ..\packages\System.Memory.4.5.4\lib\net461\System.Memory.dll @@ -689,8 +689,8 @@ - - + + @@ -704,20 +704,20 @@ - - + + - +