fix: remove api routes from scan #83
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: DashLord scans | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| url: | |
| description: "Single url to scan or scan all urls" | |
| required: false | |
| default: "" | |
| tool: | |
| description: "Single tool to run or use all tools" | |
| type: choice | |
| default: all | |
| options: | |
| - all | |
| - codescan | |
| - dependabot | |
| - ecoindex | |
| - lighthouse | |
| - sonarcloud | |
| - trivy | |
| - zap | |
| - dsfr | |
| - ecoindex | |
| push: | |
| branches: | |
| - main | |
| paths: | |
| - "dashlord.yaml" | |
| - "dashlord.yml" | |
| - "urls.txt" | |
| schedule: | |
| - cron: "0 0 * * 0" # see https://crontab.guru | |
| # allow only one concurrent scan action | |
| concurrency: | |
| cancel-in-progress: true | |
| group: scans | |
| jobs: | |
| init: | |
| runs-on: ubuntu-latest | |
| name: Prepare | |
| outputs: | |
| sites: ${{ steps.init.outputs.sites }} | |
| config: ${{ steps.init.outputs.config }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - id: init | |
| uses: "SocialGouv/dashlord-actions/init@v1" | |
| with: | |
| url: ${{ github.event.inputs.url }} | |
| tool: ${{ github.event.inputs.tool }} | |
| - id: updown-init | |
| uses: "SocialGouv/dashlord-actions/updown-init@v1" | |
| env: | |
| UPDOWNIO_API_KEY: ${{ secrets.UPDOWNIO_API_KEY }} | |
| scans: | |
| runs-on: ubuntu-latest | |
| name: Scan | |
| needs: init | |
| continue-on-error: true | |
| strategy: | |
| fail-fast: false | |
| max-parallel: 3 | |
| matrix: | |
| sites: ${{ fromJson(needs.init.outputs.sites) }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - run: | | |
| mkdir scans | |
| - uses: actions/cache@v4 | |
| with: | |
| path: "**/node_modules" | |
| key: ${{ runner.os }}-modules-${{ hashFiles('**/yarn.lock') }} | |
| - name: dsfr | |
| continue-on-error: true | |
| timeout-minutes: 10 | |
| uses: "socialgouv/dashlord-actions/dsfr@v1" | |
| if: ${{ matrix.sites.tools.dsfr }} | |
| with: | |
| url: ${{ matrix.sites.url }} | |
| output: scans/dsfr.json | |
| - name: Trivy | |
| continue-on-error: true | |
| timeout-minutes: 20 | |
| if: ${{ matrix.sites.tools.trivy && matrix.sites.docker }} | |
| uses: "SocialGouv/dashlord-actions/trivy@v1" | |
| with: | |
| images: ${{ join(matrix.sites.docker) }} | |
| output: scans/trivy.json | |
| - name: Nuclei scan | |
| if: ${{ matrix.sites.tools.nuclei }} | |
| timeout-minutes: 10 | |
| continue-on-error: true | |
| uses: "SocialGouv/dashlord-nuclei-action@master" | |
| with: | |
| url: ${{ matrix.sites.url }} | |
| output: "scans/nuclei.log" | |
| - name: Betagouv API scan | |
| if: ${{ matrix.sites.tools.betagouv }} | |
| continue-on-error: true | |
| timeout-minutes: 10 | |
| id: betagouv | |
| uses: betagouv/dashlord-startup-action@main | |
| with: | |
| id: "${{ matrix.sites.betaId }}" | |
| output: "scans/betagouv.json" | |
| - name: ZAP Scan | |
| if: ${{ matrix.sites.tools.zap }} | |
| uses: zaproxy/[email protected] | |
| timeout-minutes: 30 | |
| with: | |
| token: "" # disable issue creation | |
| rules_file_name: "zap-rules.tsv" | |
| target: "${{ matrix.sites.url }}" | |
| cmd_options: "-a" | |
| allow_issue_writing: false | |
| - name: sonarcloud scan | |
| if: ${{ matrix.sites.tools.sonarcloud }} | |
| id: sonarcloud | |
| continue-on-error: true | |
| timeout-minutes: 10 | |
| uses: SocialGouv/dashlord-actions/sonarcloud@v1 | |
| with: | |
| repos: ${{ join(matrix.sites.repositories) }} | |
| output: "scans/sonarcloud.json" | |
| - name: Third-party scripts scan | |
| if: ${{ matrix.sites.tools.thirdparties }} | |
| id: thirdparties | |
| continue-on-error: true | |
| timeout-minutes: 10 | |
| uses: SocialGouv/thirdparties-action@master | |
| with: | |
| url: "${{ matrix.sites.url }}" | |
| output: "scans/thirdparties.json" | |
| - name: Déclaration a11y | |
| timeout-minutes: 10 | |
| uses: "socialgouv/dashlord-actions/declaration-a11y@v1" | |
| if: ${{ matrix.sites.tools['declaration-a11y'] }} | |
| with: | |
| url: ${{ matrix.sites.url }} | |
| output: scans/declaration-a11y.json | |
| - name: eco-index | |
| continue-on-error: true | |
| timeout-minutes: 10 | |
| uses: "socialgouv/dashlord-actions/ecoindex@v1" | |
| if: ${{ matrix.sites.tools.ecoindex }} | |
| with: | |
| url: ${{ matrix.sites.url }} | |
| output: scans/ecoindex.json | |
| - name: Déclaration RGPD | |
| timeout-minutes: 10 | |
| uses: SocialGouv/dashlord-actions/declaration-rgpd@v1 | |
| if: ${{ matrix.sites.tools['declaration-rgpd'] }} | |
| with: | |
| thirdparties: ${{ steps.thirdparties.outputs.json }} | |
| url: ${{ matrix.sites.url }} | |
| output: scans/declaration-rgpd.json | |
| - name: Detect 404s | |
| continue-on-error: true | |
| timeout-minutes: 10 | |
| uses: "socialgouv/detect-404-action@master" | |
| if: ${{ matrix.sites.tools['404'] }} | |
| with: | |
| url: ${{ matrix.sites.url }} | |
| output: scans/404.json | |
| - name: Stats page from beta | |
| continue-on-error: true | |
| timeout-minutes: 10 | |
| uses: "betagouv/check-url-action@main" | |
| if: ${{ matrix.sites.tools.stats }} | |
| id: stats | |
| with: | |
| url: ${{ steps.betagouv.outputs.stats_url }} | |
| output: scans/stats.json | |
| minExpectedRegex: ^stat | |
| exactExpectedRegex: ^stats$ | |
| - name: Stats page retry on url | |
| continue-on-error: true | |
| timeout-minutes: 10 | |
| uses: "betagouv/check-url-action@main" | |
| if: ${{ steps.stats.outcome=='failure' }} | |
| with: | |
| url: ${{ format('{0}/stats', matrix.sites.url) }} | |
| output: scans/stats.json | |
| minExpectedRegex: ^stat | |
| exactExpectedRegex: ^stats$ | |
| - name: Budget page from beta | |
| continue-on-error: true | |
| timeout-minutes: 10 | |
| uses: "betagouv/check-url-action@main" | |
| if: ${{ matrix.sites.tools.budget_page }} | |
| id: budget_page | |
| with: | |
| url: ${{ steps.betagouv.outputs.budget_url }} | |
| output: scans/budget_page.json | |
| exactExpectedRegex: ^budget$ | |
| - name: Budget page retry on url | |
| continue-on-error: true | |
| timeout-minutes: 10 | |
| uses: "betagouv/check-url-action@main" | |
| if: ${{ steps.budget_page.outcome=='failure' }} | |
| with: | |
| url: ${{ format('{0}/budget', matrix.sites.url) }} | |
| output: scans/budget_page.json | |
| exactExpectedRegex: ^budget$ | |
| - name: Open Github repository | |
| continue-on-error: true | |
| timeout-minutes: 10 | |
| uses: "betagouv/check-url-action@main" | |
| if: ${{ matrix.sites.tools.betagouv }} | |
| with: | |
| url: ${{ steps.betagouv.outputs.github_repository }} | |
| output: scans/github_repository.json | |
| - name: Screenshot Website | |
| uses: swinton/[email protected] | |
| if: ${{ matrix.sites.tools.screenshot }} | |
| timeout-minutes: 5 | |
| continue-on-error: true | |
| with: | |
| source: "${{ matrix.sites.url }}" | |
| type: jpeg | |
| destination: screenshot.jpeg | |
| width: 1280 | |
| scaleFactor: 0.5 | |
| - name: Wappalyzer scan | |
| if: ${{ matrix.sites.tools.wappalyzer }} | |
| uses: "socialgouv/wappalyzer-action@master" | |
| timeout-minutes: 10 | |
| continue-on-error: true | |
| with: | |
| url: "${{ matrix.sites.url }}" | |
| output: scans/wappalyzer.json | |
| # https://github.com/treosh/lighthouse-ci-action#inputs | |
| - name: Lighthouse scan | |
| if: ${{ matrix.sites.tools.lighthouse }} | |
| timeout-minutes: 10 | |
| uses: socialgouv/dashlord-actions/lhci@v1 | |
| with: | |
| url: "${{ join(matrix.sites.subpages, ',') }}" | |
| - name: Mozilla HTTP Observatory | |
| if: ${{ matrix.sites.tools.http }} | |
| timeout-minutes: 10 | |
| id: http | |
| continue-on-error: true | |
| uses: SocialGouv/httpobs-action@master | |
| with: | |
| url: "${{ matrix.sites.url }}" | |
| output: "scans/http.json" | |
| - name: Mozilla HTTP Observatory retry | |
| if: steps.http.outcome=='failure' | |
| continue-on-error: true | |
| timeout-minutes: 10 | |
| uses: SocialGouv/httpobs-action@master | |
| with: | |
| url: "${{ matrix.sites.url }}" | |
| output: "scans/http.json" | |
| # testssl.sh action needs an hostname to save its output so we build it here | |
| - name: Extract hostname | |
| id: hostname | |
| run: | | |
| HOSTNAME=$(echo "${{ matrix.sites.url }}" | sed -e 's/[^/]*\/\/\([^@]*@\)\?\([^:/]*\).*/\2/') | |
| echo "::set-output name=value::$HOSTNAME" | |
| - name: testssl.sh scan | |
| if: ${{ matrix.sites.tools.testssl }} | |
| timeout-minutes: 10 | |
| continue-on-error: true | |
| uses: "mbogh/[email protected]" | |
| with: | |
| host: ${{ steps.hostname.outputs.value }} | |
| output: scans | |
| grade: "F" | |
| options: "--fast" | |
| - name: Updown.io checks | |
| if: ${{ matrix.sites.tools.updownio }} | |
| continue-on-error: true | |
| uses: "MTES-MCT/updownio-action@main" | |
| with: | |
| apiKey: ${{ secrets.UPDOWNIO_API_KEY }} | |
| url: ${{ matrix.sites.url }} | |
| output: scans/updownio.json | |
| - name: Dependabot vulnerabilities alerts | |
| if: ${{ matrix.sites.tools.dependabot && matrix.sites.repositories }} | |
| continue-on-error: true | |
| uses: "MTES-MCT/dependabotalerts-action@main" | |
| with: | |
| token: ${{ secrets.DEPENDABOTALERTS_TOKEN }} | |
| repositories: ${{ join(matrix.sites.repositories) }} | |
| output: scans/dependabotalerts.json | |
| maxAlerts: 100 | |
| states: "OPEN" | |
| - name: Code quality alerts | |
| if: ${{ matrix.sites.tools.codescan && matrix.sites.repositories }} | |
| continue-on-error: true | |
| uses: "MTES-MCT/codescanalerts-action@main" | |
| with: | |
| token: ${{ secrets.CODESCANALERTS_TOKEN }} | |
| repositories: ${{ join(matrix.sites.repositories) }} | |
| output: scans/codescanalerts.json | |
| state: open | |
| - uses: SocialGouv/dashlord-actions/save@v1 | |
| with: | |
| url: ${{ matrix.sites.url }} | |
| # only clean up previous stats when all tools runned | |
| cleanup: ${{ github.event.inputs.tool == 'all' && true || false }} | |
| - uses: EndBug/add-and-commit@v9 | |
| with: | |
| add: "results" | |
| author_name: "incubateur-ademe-admin" | |
| author_email: "[email protected]" | |
| message: "update: ${{ matrix.sites.url }}" | |
| pull: "--rebase --autostash" |