diff --git a/.github/depdendabot.yml b/.github/depdendabot.yml new file mode 100644 index 0000000..7da72c7 --- /dev/null +++ b/.github/depdendabot.yml @@ -0,0 +1,12 @@ +version: 2 +updates: + - package-ecosystem: github-actions + directory: / + schedule: + interval: monthly + + - package-ecosystem: npm + directory: / + versioning-strategy: widen + schedule: + interval: weekly diff --git a/.github/workflows/agent.yml b/.github/workflows/agent.yml new file mode 100644 index 0000000..ba719c1 --- /dev/null +++ b/.github/workflows/agent.yml @@ -0,0 +1,35 @@ +name: Sigyn Agent + +on: + push: + branches: [main] + paths: + - src/agent/** + pull_request: + paths: + - src/agent/** + +permissions: + contents: read + +jobs: + test: + runs-on: ubuntu-latest + strategy: + matrix: + node-version: [18.x, 20.x] + fail-fast: false + steps: + - name: Harden Runner + uses: step-security/harden-runner@cba0d00b1fc9a034e1e642ea0f1103c282990604 # v2.5.0 + with: + egress-policy: audit + - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 + - name: Use Node.js ${{ matrix.node-version }} + uses: actions/setup-node@e33196f7422957bea03ed53f6fbb155025ffc7b8 # v3.7.0 + with: + node-version: ${{ matrix.node-version }} + - name: Install dependencies + run: npm ci + - name: Run tests + run: npm run test --workspace=src/agent diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml new file mode 100644 index 0000000..03a73a0 --- /dev/null +++ b/.github/workflows/codeql.yml @@ -0,0 +1,86 @@ +# For most projects, this workflow file will not need changing; you simply need +# to commit it to your repository. +# +# You may wish to alter this file to override the set of languages analyzed, +# or to provide custom queries or build logic. +# +# ******** NOTE ******** +# We have attempted to detect the languages in your repository. Please check +# the `language` matrix defined below to confirm you have the correct set of +# supported CodeQL languages. +# +name: "CodeQL" + +on: + push: + branches: + - main + pull_request: + # The branches below must be a subset of the branches above + branches: + - main + schedule: + - cron: '20 18 * * 6' + +permissions: + contents: read + +jobs: + analyze: + name: Analyze + runs-on: ubuntu-latest + permissions: + actions: read + contents: read + security-events: write + + strategy: + fail-fast: false + matrix: + language: [ 'javascript' ] + # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ] + # Use only 'java' to analyze code written in Java, Kotlin or both + # Use only 'javascript' to analyze code written in JavaScript, TypeScript or both + # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support + + steps: + - name: Harden Runner + uses: step-security/harden-runner@cba0d00b1fc9a034e1e642ea0f1103c282990604 # v2.5.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - name: Checkout repository + uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 + + # Initializes the CodeQL tools for scanning. + - name: Initialize CodeQL + uses: github/codeql-action/init@0ba4244466797eb048eb91a6cd43d5c03ca8bd05 # v2.21.2 + with: + languages: ${{ matrix.language }} + # If you wish to specify custom queries, you can do so here or in a config file. + # By default, queries listed here will override any specified in a config file. + # Prefix the list here with "+" to use these queries and those in the config file. + + # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs + # queries: security-extended,security-and-quality + + + # Autobuild attempts to build any compiled languages (C/C++, C#, Go, or Java). + # If this step fails, then you should remove it and run the build manually (see below) + - name: Autobuild + uses: github/codeql-action/autobuild@0ba4244466797eb048eb91a6cd43d5c03ca8bd05 # v2.21.2 + + # โ„น๏ธ Command-line programs to run using the OS shell. + # ๐Ÿ“š See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun + + # If the Autobuild fails above, remove it and uncomment the following three lines. + # modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance. + + # - run: | + # echo "Run, Build Application using script" + # ./location_of_script_within_repo/buildscript.sh + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@0ba4244466797eb048eb91a6cd43d5c03ca8bd05 # v2.21.2 + with: + category: "/language:${{matrix.language}}" diff --git a/.github/workflows/config.yml b/.github/workflows/config.yml new file mode 100644 index 0000000..a6b8fb1 --- /dev/null +++ b/.github/workflows/config.yml @@ -0,0 +1,35 @@ +name: Sigyn Config + +on: + push: + branches: [main] + paths: + - src/config/** + pull_request: + paths: + - src/config/** + +permissions: + contents: read + +jobs: + test: + runs-on: ubuntu-latest + strategy: + matrix: + node-version: [18.x, 20.x] + fail-fast: false + steps: + - name: Harden Runner + uses: step-security/harden-runner@cba0d00b1fc9a034e1e642ea0f1103c282990604 # v2.5.0 + with: + egress-policy: audit + - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 + - name: Use Node.js ${{ matrix.node-version }} + uses: actions/setup-node@e33196f7422957bea03ed53f6fbb155025ffc7b8 # v3.7.0 + with: + node-version: ${{ matrix.node-version }} + - name: Install dependencies + run: npm ci + - name: Run tests + run: npm run test --workspace=src/config diff --git a/.github/workflows/discord.yml b/.github/workflows/discord.yml new file mode 100644 index 0000000..4af37ad --- /dev/null +++ b/.github/workflows/discord.yml @@ -0,0 +1,35 @@ +name: Sigyn Discord + +on: + push: + branches: [main] + paths: + - src/discord/** + pull_request: + paths: + - src/discord/** + +permissions: + contents: read + +jobs: + test: + runs-on: ubuntu-latest + strategy: + matrix: + node-version: [18.x, 20.x] + fail-fast: false + steps: + - name: Harden Runner + uses: step-security/harden-runner@cba0d00b1fc9a034e1e642ea0f1103c282990604 # v2.5.0 + with: + egress-policy: audit + - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 + - name: Use Node.js ${{ matrix.node-version }} + uses: actions/setup-node@e33196f7422957bea03ed53f6fbb155025ffc7b8 # v3.7.0 + with: + node-version: ${{ matrix.node-version }} + - name: Install dependencies + run: npm ci + - name: Run tests + run: npm run test --workspace=src/discord diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml new file mode 100644 index 0000000..3a5eaca --- /dev/null +++ b/.github/workflows/scorecard.yml @@ -0,0 +1,78 @@ +# This workflow uses actions that are not certified by GitHub. They are provided +# by a third-party and are governed by separate terms of service, privacy +# policy, and support documentation. + +name: Scorecard supply-chain security +on: + # For Branch-Protection check. Only the default branch is supported. See + # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection + branch_protection_rule: + # To guarantee Maintained check is occasionally updated. See + # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained + schedule: + - cron: '37 7 * * 0' + push: + branches: + - main + +# Declare default permissions as read only. +permissions: read-all + +jobs: + analysis: + name: Scorecard analysis + runs-on: ubuntu-latest + permissions: + # Needed to upload the results to code-scanning dashboard. + security-events: write + # Needed to publish results and get a badge (see publish_results below). + id-token: write + # Uncomment the permissions below if installing in a private repository. + # contents: read + # actions: read + + steps: + - name: Harden Runner + uses: step-security/harden-runner@cba0d00b1fc9a034e1e642ea0f1103c282990604 # v2.5.0 + with: + egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs + + - name: "Checkout code" + uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 + with: + persist-credentials: false + + - name: "Run analysis" + uses: ossf/scorecard-action@08b4669551908b1024bb425080c797723083c031 # v2.2.0 + with: + results_file: results.sarif + results_format: sarif + # (Optional) "write" PAT token. Uncomment the `repo_token` line below if: + # - you want to enable the Branch-Protection check on a *public* repository, or + # - you are installing Scorecard on a *private* repository + # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat. + # repo_token: ${{ secrets.SCORECARD_TOKEN }} + + # Public repositories: + # - Publish results to OpenSSF REST API for easy access by consumers + # - Allows the repository to include the Scorecard badge. + # - See https://github.com/ossf/scorecard-action#publishing-results. + # For private repositories: + # - `publish_results` will always be set to `false`, regardless + # of the value entered here. + publish_results: true + + # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF + # format to the repository Actions tab. + - name: "Upload artifact" + uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2 + with: + name: SARIF file + path: results.sarif + retention-days: 5 + + # Upload the results to GitHub's code scanning dashboard. + - name: "Upload to code-scanning" + uses: github/codeql-action/upload-sarif@0ba4244466797eb048eb91a6cd43d5c03ca8bd05 # v2.21.2 + with: + sarif_file: results.sarif diff --git a/.github/workflows/slack.yml b/.github/workflows/slack.yml new file mode 100644 index 0000000..fa60078 --- /dev/null +++ b/.github/workflows/slack.yml @@ -0,0 +1,35 @@ +name: Sigyn Slack + +on: + push: + branches: [main] + paths: + - src/slack/** + pull_request: + paths: + - src/slack/** + +permissions: + contents: read + +jobs: + test: + runs-on: ubuntu-latest + strategy: + matrix: + node-version: [18.x, 20.x] + fail-fast: false + steps: + - name: Harden Runner + uses: step-security/harden-runner@cba0d00b1fc9a034e1e642ea0f1103c282990604 # v2.5.0 + with: + egress-policy: audit + - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 + - name: Use Node.js ${{ matrix.node-version }} + uses: actions/setup-node@e33196f7422957bea03ed53f6fbb155025ffc7b8 # v3.7.0 + with: + node-version: ${{ matrix.node-version }} + - name: Install dependencies + run: npm ci + - name: Run tests + run: npm run test --workspace=src/slack diff --git a/.github/workflows/teams.yml b/.github/workflows/teams.yml new file mode 100644 index 0000000..916c2cb --- /dev/null +++ b/.github/workflows/teams.yml @@ -0,0 +1,35 @@ +name: Sigyn Teams + +on: + push: + branches: [main] + paths: + - src/teams/** + pull_request: + paths: + - src/teams/** + +permissions: + contents: read + +jobs: + test: + runs-on: ubuntu-latest + strategy: + matrix: + node-version: [18.x, 20.x] + fail-fast: false + steps: + - name: Harden Runner + uses: step-security/harden-runner@cba0d00b1fc9a034e1e642ea0f1103c282990604 # v2.5.0 + with: + egress-policy: audit + - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 + - name: Use Node.js ${{ matrix.node-version }} + uses: actions/setup-node@e33196f7422957bea03ed53f6fbb155025ffc7b8 # v3.7.0 + with: + node-version: ${{ matrix.node-version }} + - name: Install dependencies + run: npm ci + - name: Run tests + run: npm run test --workspace=src/teams diff --git a/README.md b/README.md index 89593b2..46bc7aa 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,87 @@ # Sigyn +

+

Sigyn

+

+ +

+ Loki alerting agent monorepo +

+ +

+ + license + + + maintained + + + ossf scorecard + + + typescript + + + esm-cjs + +

+ +## ๐Ÿšง Requirements +- npm v7+ for [workspaces](https://docs.npmjs.com/cli/v7/using-npm/workspaces) + +## ๐Ÿ“ฆ Available packages + +Click on one of the links to access the documentation of the package: + +### Core + +| name | package and link | +| --- | --- | +| agent | [@sigyn/agent](./src/agent) | +| config | [@sigyn/config](./src/config) | + +### Notifiers +| name | package and link | +| --- | --- | +| discord | [@sigyn/discord](./src/discord/) | +| slack | [@sigyn/slack](./src/slack) | +| teams | [@sigyn/teams](./src/teams) | + +These packages are available in the Node Package Repository and can be easily installed with [npm](https://docs.npmjs.com/getting-started/what-is-npm) or [yarn](https://yarnpkg.com). + +```bash +$ npm i @sigyn/agent +# or +$ yarn add @sigyn/agent +``` + +## ๐Ÿ”จ Build +To install and compile all workspaces, just run the following commands at the root + +```bash +$ npm ci +$ npm run build +``` + +## ๐Ÿงช Test +Run test for all workspaces +```bash +npm run test +``` + +Or running test of a single workspace + +```bash +$ npm run test -w +``` + +## ๐Ÿ“ค Publishing package +Each package has its own `prepublishOnly` to build TypeScript source before publishing. + +```bash +$ npm publish -w +``` + ## Contributors โœจ diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..d23e973 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,5 @@ +# Reporting Security Issues + +To report a security issue, please [publish a private security advisory](https://github.com/MyUnisoft/sigyn/security/advisories) with a description of the issue, the steps you took to create the issue, affected versions, and, if known, mitigations for the issue. + +Our vulnerability management team will respond within one week. If the issue is confirmed as a vulnerability, we will open a Security Advisory and acknowledge your contributions as part of it. This project follows a 30 day disclosure timeline.