Create initial proof of concept application security pipeline repository
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	sbassett
	Aug 19 2021, 7:22 PM

Description

Choose and migrate a few repositories to gitlab.wikimedia.org for testing purposes (these can be MediaWiki extensions, etc)
- PHP/front-end JS (https://gitlab.wikimedia.org/security/secteam-boilerplate-fork)
- node (https://gitlab.wikimedia.org/security/service-runner-fork-nodejs)
- python (https://gitlab.wikimedia.org/security/pywikibot-fork-python-3)
- golang (https://gitlab.wikimedia.org/security/blubber)
- java (https://gitlab.wikimedia.org/security/extra-fork-java)
Create initial application security pipeline / ci templates repository under the Security Team space (need to choose a name, see also: T289292) (https://gitlab.wikimedia.org/security/gitlab-ci-security-templates)

...moved some of this to sub-tasks for improved project management...

Potentially benchmark and write tests for the above (needs research - this might not be feasible)

Details

	Title	Reference	Author	Source Branch	Dest Branch
	Merge recent project work back to main	repos/security/gitlab-ci-security-templates!2	sbassett	scotts-security-testing	main

Customize query in GitLab

Related Objects
Search...

Status	Assigned	Task
Resolved	sbassett	T289290 Design and Build Application Security Pipeline Components for Gitlab
Resolved	brennen	T289292 Create Security Team group within gitlab.wikimedia.org
Resolved	sbassett	T289293 Create initial proof of concept application security pipeline repository
Invalid	thcipriani	T294306 Migrate existing proof-of-concept node ci templates to slim node wm node docker images
Invalid	None	T294307 Research and design basic ci processing scripts (to exit 1 for tools that report errors and generate report artifacts)
Resolved	sbassett	T294309 Finish node/npm initial tool ci templates for npm audit (Node 10, 12, 14)
Resolved	sbassett	T294310 Finish for node/npm initial tool ci templates for npm outdated (Node 10, 12, 14)
Resolved	sbassett	T294311 Finish node/npm initial tool ci templates for auditjs (Node 10, 12, 14)
Resolved	mmartorana	T294312 Investigate SAST template options now included with Gitlab CE and formulate use-cases and documentation
Resolved	sbassett	T294596 Add minimal yaml file linting as part of ci for security ci templates repository
Resolved	sbassett	T295333 Create a simple tool to check for bidirectional unicode characters
Resolved	mmartorana	T295374 Create best practices / guidelines documentation for Gitlab application security ci templates
Resolved	thcipriani	T296805 Confirm with releng which docker images make the most sense to use
Resolved	sbassett	T296806 Find optimal solution for projects with nested package.json files (within the context of Gitlab CI)
Resolved	sbassett	T297991 Create semgrep initial tool ci template
Resolved	sbassett	T301828 Create local-php-security-checker/php-security-checker ci yaml template
Resolved	mmartorana	T301829 Create composer outdated ci yaml template
Resolved	sbassett	T301830 Create safety (w/ poetry support) ci yaml template
Resolved	mmartorana	T301831 Create nancy ci yaml template
Resolved	sbassett	T301832 Create phan/phan-taint-check plugin port as ci template
Resolved	sbassett	T301833 Create python bandit ci template
Resolved	mmartorana	T301834 Create gosec ci yaml template
Resolved	sbassett	T303482 Merge templates that are part of initial release to production branch

Event Timeline

sbassett created this task.Aug 19 2021, 7:22 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptAug 19 2021, 7:22 PM

sbassett assigned this task to Mstyles.Aug 19 2021, 7:51 PM

sbassett triaged this task as Medium priority.

sbassett added a project: user-sbassett.

sbassett moved this task from Incoming to In Progress on the Security-Team board.

sbassett moved this task from Backlog to In Progress on the user-sbassett board.

sbassett updated the task description. (Show Details)Sep 14 2021, 6:58 PM

sbassett updated the task description. (Show Details)

sbassett updated the task description. (Show Details)Sep 14 2021, 7:29 PM

sbassett updated the task description. (Show Details)Sep 14 2021, 7:40 PM

sbassett updated the task description. (Show Details)

sbassett updated the task description. (Show Details)Sep 21 2021, 7:25 PM

sbassett updated the task description. (Show Details)Sep 21 2021, 7:31 PM

sbassett updated the task description. (Show Details)Sep 21 2021, 7:56 PM

sbassett updated the task description. (Show Details)

brennen moved this task from Inbox to CI & Job Runners on the GitLab board.Sep 28 2021, 6:59 PM

brennen edited projects, added GitLab (CI & Job Runners); removed GitLab.

Per a recent chat with @brennen and @thcipriani - we'd love to have a quick chat about (or some async feedback) on our proposed systems design here from @dduvall or anyone else working on kubernetes security deployments. I guess the general question would be: is what we're proposing here for fairly basic security-related CI within Gitlab (the two common use-cases being merge requests and manual runs) potentially compatible with any proposed security-related kubernetes deployment process?