payatu · Apr 9, 2020 · Apr 9, 2020 · Apr 9, 2020 · Apr 9, 2020 · May 17, 2021
Showing with 88 additions and 0 deletions.

+26 −0 .github/workflows/boost.yaml

+40 −0 .github/workflows/main.yml

+22 −0 .github/workflows/mobsfscan_sarif.yaml
diff --git a/.github/workflows/boost.yaml b/.github/workflows/boost.yaml
@@ -0,0 +1,26 @@
+name: Boost mobsfscan
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+      - master
+  pull_request:
+    branches:
+      - main
+      - master
+    types:
+      - opened
+      - synchronize
+jobs:
+  scanner:
+    name: mobsfscan
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+      - name: Mobfsscanner
+        uses: boostsecurityio/boostsec-scanner-github@v4
+        with:
+          api_token: ${{ secrets.BOOST_API_TOKEN }}
+          registry_module: opensecurity/mobsfscan
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -0,0 +1,40 @@
+# This is a basic workflow to help you get started with Actions
+
+name: MobSF CI
+
+# Controls when the action will run. Triggers the workflow on push or pull request
+# events but only for the master branch
+on:
+  push:
+    branches: [ master ]
+  pull_request:
+    branches: [ master ]
+
+env:
+  MOBSF_IMG:
+    opensecurity/mobile-security-framework-mobsf:latest
+  MOBSF_API_KEY:
+    d41d8cd98f00b204e9800998ecf8427e859ea234
+
+
+# A workflow run is made up of one or more jobs that can run sequentially or in parallel
+jobs:
+  # This workflow contains a single job called "build"
+  build:
+    # The type of runner that the job will run on
+    runs-on: ubuntu-latest
+
+    # Steps represent a sequence of tasks that will be executed as part of the job
+    steps:
+    # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
+    - uses: actions/checkout@master
+
+    # Pull MobSF Docker Image
+    - name: Pull MobSF Docker Image
+      run: docker pull ${MOBSF_IMG}
+
+    # Scan Source Code
+    - name: Run MobSF Scan
+      run: |
+        zip -r mobsf_files.zip .
+        docker run -d -e MOBSF_API_KEY=${MOBSF_API_KEY} -t ${MOBSF_IMG} && curl -F 'file=@mobsf_files.zip' http://localhost:8000/api/v1/upload -H "Authorization:${MOBSF_API_KEY}"
diff --git a/.github/workflows/mobsfscan_sarif.yaml b/.github/workflows/mobsfscan_sarif.yaml
@@ -0,0 +1,22 @@
+name: mobsfscan sarif
+on:
+  push:
+    branches: [ master, main ]
+  pull_request:
+    branches: [ master, main ]
+
+jobs:
+  mobsfscan:
+    runs-on: ubuntu-latest
+    name: mobsfscan code scanning
+    steps:
+    - name: Checkout the code
+      uses: actions/checkout@v2
+    - name: mobsfscan
+      uses: MobSF/mobsfscan@main
+      with:
+        args: '. --sarif --output result.sarif || true'
+    - name: Upload mobsfscan report
+      uses: github/codeql-action/upload-sarif@v1
+      with:
+        sarif_file: result.sarif