Skip to content

Commit f73828d

Browse files
V-RicoV-Rico
committed
Initial commit
0 parents  commit f73828d

File tree

147 files changed

+12698
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

147 files changed

+12698
-0
lines changed

‎.coveragerc

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
[run]
2+
omit = tests/*, app/alembic/*, **/exceptions.py
3+
4+
[report]
5+
fail_under = 60
6+
# Regexes for lines to exclude from consideration
7+
exclude_lines =
8+
# Have to re-enable the standard pragma
9+
pragma: no cover
10+
11+
# Don't complain about missing debug-only code:
12+
def __repr__
13+
if self\.debug
14+
15+
# Don't complain if tests don't hit defensive assertion code:
16+
raise AssertionError
17+
raise NotImplementedError
18+
19+
# Don't complain if non-runnable code isn't run:
20+
if 0:
21+
if __name__ == .__main__.:
22+
23+
# Don't complain about abstract methods, they aren't run:
24+
@(abc\.)?abstractmethod
25+
26+
ignore_errors = True

‎.dockerignore

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
.idea
2+
.cache
3+
.coverage
4+
.dockerignore
5+
.git
6+
.gitattributes
7+
.gitignore
8+
.gitkeep
9+
.flake8
10+
.isort.cfg
11+
.mypy_cache
12+
.pytest_cache
13+
.tox
14+
tox.ini
15+
mypy.ini
16+
tests
17+
distribution
18+
venv
19+
**/__pycache__
20+
*.yml
21+
*.svg
22+
*.egg-info/
23+
*.egg
24+
env/
25+
pytest.ini
26+
README.rst
27+
README.md
28+
Dockerfile
29+
Zenvfile
30+
infrastructure
31+
data/
32+
.env.override.example

‎.env.dev

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
UVICORN_RELOAD=1
2+
3+
CELERY_BROKER_URL=redis://redis:6379/0
4+
CELERY_RESULT_BACKEND=redis://redis:6379/0
5+
6+
SECBOT_POSTGRES_DSN=postgresql+asyncpg://secbot:foobar@db:5432/secbot
7+
8+
GITLAB_CONFIGS=[{"host":"https://git.env.local/","webhook_secret_token":"SecretStr","auth_token":"SecretStr","prefix":"GIT_LOCAL"}]
9+
10+
DEFECTDOJO__URL=https://defectdojo.env.local
11+
DEFECTDOJO__TOKEN=defectdojo_token
12+
DEFECTDOJO__USER=defectdojo_username
13+
DEFECTDOJO__USER_ID=10
14+
15+
SLACK_TOKEN=token_here
16+
17+
# Metrics settings
18+
SRE_METRIC_LABEL_TEAM=SECURITY
19+
SRE_METRIC_LABEL_SERVICE=security-bot
20+
TRACING_TAGS_HOST=security-bot.env.local
21+
TRACING_TAGS_CLUSTER=security-local

‎.env.override.example

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# The .env.override.example file streamlines environment-specific settings management during development.
2+
#
3+
# To use it:
4+
# 1. Rename the file to '.env.override' for recognition by the dev environment.
5+
# 2. Update environment variables with development-specific values in the file.
6+
# 3. Rebuild the Docker image and restart it, ensuring it reads from the updated .env.override.
7+
#
8+
# e.g.
9+
# DEBUG=true

‎.flake8

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
[flake8]
2+
max-line-length = 87
3+
ignore = E203,W503,E501,W293
4+
statistics = True
5+
exclude =
6+
.git,
7+
__pycache__,
8+
.cache/,
9+
.pytest_cache/,
10+
.mypy_cache/,
11+
.venv/,
12+
.run/,
13+
app/secbot/db/alembic
14+

‎.github/workflows/docker-publish.yml

+45
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
name: Publish Docker image
2+
3+
on:
4+
release:
5+
types: [published]
6+
7+
jobs:
8+
push_to_registries:
9+
name: Push Docker image
10+
runs-on: ubuntu-latest
11+
permissions:
12+
packages: write
13+
contents: read
14+
steps:
15+
- name: Check out the repo
16+
uses: actions/checkout@v3
17+
18+
- name: Log in to Docker Hub
19+
uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a
20+
with:
21+
username: ${{ secrets.DOCKER_USERNAME }}
22+
password: ${{ secrets.DOCKER_PASSWORD }}
23+
24+
- name: Log in to the Container registry
25+
uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
26+
with:
27+
registry: ghcr.io
28+
username: ${{ github.actor }}
29+
password: ${{ secrets.GITHUB_TOKEN }}
30+
31+
- name: Extract metadata (tags, labels) for Docker
32+
id: meta
33+
uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
34+
with:
35+
images: |
36+
exness/security-bot
37+
ghcr.io/${{ github.repository }}
38+
39+
- name: Build and push Docker images
40+
uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671
41+
with:
42+
context: .
43+
push: true
44+
tags: ${{ steps.meta.outputs.tags }}
45+
labels: ${{ steps.meta.outputs.labels }}

‎.gitignore

+152
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
# Byte-compiled / optimized / DLL files
2+
__pycache__/
3+
*.py[cod]
4+
*$py.class
5+
6+
# C extensions
7+
*.so
8+
9+
# Distribution / packaging
10+
.Python
11+
build/
12+
develop-eggs/
13+
dist/
14+
downloads/
15+
eggs/
16+
.eggs/
17+
lib/
18+
lib64/
19+
parts/
20+
sdist/
21+
var/
22+
wheels/
23+
share/python-wheels/
24+
*.egg-info/
25+
.installed.cfg
26+
*.egg
27+
MANIFEST
28+
29+
# PyInstaller
30+
# Usually these files are written by a python script from a template
31+
# before PyInstaller builds the exe, so as to inject date/other infos into it.
32+
*.manifest
33+
*.spec
34+
35+
# Installer logs
36+
pip-log.txt
37+
pip-delete-this-directory.txt
38+
39+
# Unit test / coverage reports
40+
htmlcov/
41+
.tox/
42+
.nox/
43+
.coverage
44+
.coverage.*
45+
.cache
46+
nosetests.xml
47+
coverage.xml
48+
*.cover
49+
*.py,cover
50+
.hypothesis/
51+
.pytest_cache/
52+
cover/
53+
54+
# Translations
55+
*.mo
56+
*.pot
57+
58+
# Django stuff:
59+
*.log
60+
local_settings.py
61+
db.sqlite3
62+
db.sqlite3-journal
63+
64+
# Flask stuff:
65+
instance/
66+
.webassets-cache
67+
68+
# Scrapy stuff:
69+
.scrapy
70+
71+
# Sphinx documentation
72+
docs/_build/
73+
74+
# PyBuilder
75+
.pybuilder/
76+
target/
77+
78+
# Jupyter Notebook
79+
.ipynb_checkpoints
80+
81+
# IPython
82+
profile_default/
83+
ipython_config.py
84+
85+
# pyenv
86+
# For a library or package, you might want to ignore these files since the code is
87+
# intended to run in multiple environments; otherwise, check them in:
88+
# .python-version
89+
90+
# pipenv
91+
# According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
92+
# However, in case of collaboration, if having platform-specific dependencies or dependencies
93+
# having no cross-platform support, pipenv may install dependencies that don't work, or not
94+
# install all needed dependencies.
95+
#Pipfile.lock
96+
97+
# poetry
98+
# Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
99+
# This is especially recommended for binary packages to ensure reproducibility, and is more
100+
# commonly ignored for libraries.
101+
# https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
102+
#poetry.lock
103+
104+
# PEP 582; used by e.g. github.com/David-OConnor/pyflow
105+
__pypackages__/
106+
107+
# Celery stuff
108+
celerybeat-schedule
109+
celerybeat.pid
110+
111+
# SageMath parsed files
112+
*.sage.py
113+
114+
# Environments
115+
.env
116+
.venv
117+
env/
118+
venv/
119+
ENV/
120+
env.bak/
121+
venv.bak/
122+
123+
# Personal override env
124+
.env.override
125+
126+
# Spyder project settings
127+
.spyderproject
128+
.spyproject
129+
130+
# Rope project settings
131+
.ropeproject
132+
133+
# mkdocs documentation
134+
/site
135+
136+
# mypy
137+
.mypy_cache/
138+
.dmypy.json
139+
dmypy.json
140+
141+
# Pyre type checker
142+
.pyre/
143+
144+
# pytype static type analyzer
145+
.pytype/
146+
147+
# Cython debug symbols
148+
cython_debug/
149+
150+
# PyCharm
151+
.idea/
152+
.DS_Store

‎.readthedocs.yaml

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
version: 2
2+
3+
build:
4+
os: "ubuntu-20.04"
5+
tools:
6+
python: "3.9"
7+
jobs:
8+
post_create_environment:
9+
- pip install --upgrade pip
10+
- pip install poetry
11+
- poetry config virtualenvs.create false
12+
post_install:
13+
- poetry install --no-root
14+
15+
formats:
16+
- pdf
17+
- epub
18+
19+
sphinx:
20+
configuration: docs/conf.py
21+
fail_on_warning: true

‎CONTRIBUTORS.md

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# Special thanks
2+
3+
- [Exness](https://github.com/exness)
4+
- [Vulners](https://github.com/vulnerscom)
5+
6+
# Contributors
7+
8+
- [Valerio Rico](https://github.com/V-Rico) - MVP and maintenance
9+
- [Ivan Zhirov](https://github.com/izhirov) - further development and maintenance
10+
- [Maxim Sokolov](https://github.com/mcson-the-writer) - documentation

‎Dockerfile

+43
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
FROM python:3.9-slim
2+
3+
ARG USER_NAME="exness"
4+
ARG USER_HOME="/${USER_NAME}"
5+
ARG APP_HOME="/opt"
6+
7+
COPY poetry.lock pyproject.toml /
8+
9+
### Add required binaries ###
10+
RUN apt-get update && \
11+
apt-get install -y git curl && \
12+
apt-get clean && \
13+
rm -rf /var/cache/*
14+
15+
RUN apt-get update && \
16+
apt-get install -qy --no-install-recommends build-essential make && \
17+
pip install --no-cache-dir --upgrade pip poetry>=1.0.0 && \
18+
poetry config virtualenvs.create false && \
19+
poetry install --no-interaction --no-dev && \
20+
apt-get remove -qy --purge build-essential && \
21+
apt-get autoremove --purge -qy && \
22+
apt-get clean && \
23+
rm -rf /var/cache/* /poetry.lock /pyproject.toml
24+
25+
### Add worker tools ###
26+
27+
# Install gitleaks
28+
COPY --from=zricethezav/gitleaks:v8.17.0 /usr/bin/gitleaks /usr/local/bin/gitleaks
29+
30+
### Create service user ###
31+
RUN groupadd -g 10001 ${USER_NAME} && useradd -g 10001 -u 10001 -s "/usr/sbin/nologin" -md ${USER_HOME} ${USER_NAME}
32+
33+
### Add application source code ###
34+
COPY docker-entrypoint.sh /usr/local/bin
35+
COPY --chown=10001:10001 app/ ${APP_HOME}/app
36+
37+
ENV PYTHONPATH="${APP_HOME}"
38+
39+
USER ${USER_NAME}
40+
EXPOSE 5000 5001
41+
WORKDIR ${APP_HOME}
42+
ENTRYPOINT ["docker-entrypoint.sh"]
43+
CMD ["help"]

0 commit comments

Comments
 (0)