oss_pygoat-devsecops-basic.yml

name: OSS_pygoat-devsecops-basic
on:
  # push:
  #   branches:
  #     - main
  workflow_dispatch:
    inputs:
      DEFECTDOJO_URL:
        description: 'DefectDojo URL'
        required: true
        default: 'https://defectdojo.cad4devops.com:8443/api/v2'
      DEFECTDOJO_COMMONUSER:
        description: 'DefectDojo Common User'
        required: true
        default: 'Student000'
      DEFECTDOJO_COMMONPRODUCTNAME:
        description: 'DefectDojo Common Product Name'
        required: true
        default: 'GitHub-OSS-pygoat-devsecops-workshop-002-product-000'

permissions:
  # The permissions for azure federation
  #id-token: write
  #contents: read
  # write to security events
  security-events: write

env:
  #DEFECTDOJO_PRODUCTID: 4
  # basic settings
  useCommonDefectDojoProduct: true # for DEMO purposes
  pushDockerImage: false # for DEMO purposes
  continue-on-error: true # for DEMO purposes
  # # advanced settings
  # useCommonDefectDojoProduct: false # advanced setting
  # pushDockerImage: true # advanced setting
  # continue-on-error: false # advanced setting
  useAzureCliForK8s: false
  doImageScanWithDockerHubScout: false
  adjustDNS: false
  listArtifacts: true
  DEFECTDOJO_URL: ${{ inputs.DEFECTDOJO_URL }} #https://defectdojo-002.cad4devops.com:8443/api/v2
  DEFECTDOJO_COMMONUSER: ${{ inputs.DEFECTDOJO_COMMONUSER }} #Student000
  DEFECTDOJO_COMMONPRODUCTNAME: ${{ inputs.DEFECTDOJO_COMMONPRODUCTNAME }} #GitHub-OSS-pygoat-devsecops-workshop-001-product-000
  DEFECTDOJO_TOKEN: ${{ secrets.DEFECTDOJO_TOKEN }} # 8116113b49d62b5affe822be7cf260778c5f62b1
  appUrl: http://gh-pygoat-test.cad4devops.com
  containerName: owaspzapproxy
  doActiveScan: false
  dockerWaitTime: 30s
  tag: "${{ github.run_id }}"
  host: gh-pygoat-test.cad4devops.com
  kubernetesServiceConnection: OSS_Microk8s
  loopWaitTime: 10s
  maxAlerts: 5000
  owaspImageName: softwaresecurityproject/zap-stable
  owaspZapApiPort: 8090
  owaspZapWebPort: 8080
  owaspzap-report-json: owasp-zap.json
  owaspzap-report-sarif: owasp-zap.sarif
  sarifTemplate: sarif-json
  traditionalJsonTemplate: traditional-json
jobs:
  build-build_and_push_app:
    name: Build and Push App
    runs-on: ubuntu-latest
    env:
      image: ${{ vars.DOCKER_USERNAME }}.azurecr.io/devsecops-pygoat
    environment:
      name: dev
    steps:
      - name: Fixes docker image name if not being pushed to Azure Container Registry
        run: |-
          echo "image=devsecops-pygoat" >> $GITHUB_ENV
        if: vars.DOCKER_USERNAME == ''
      - name: test action get auth token
        if: env.useCommonDefectDojoProduct == 'true'
        run: |-
          echo "testing action"
          # get token from common user 
          echo "DEFECTDOJO_COMMONUSER: ${{ env.DEFECTDOJO_COMMONUSER }}"
          echo "DEFECTDOJO_COMMONPASSWORD: ${{ secrets.DEFECTDOJO_COMMONPASSWORD }}"
          # throw error if token is not set
          if [ -z "${{ secrets.DEFECTDOJO_COMMONPASSWORD }}" ]; then
            echo "Error: DEFECTDOJO_COMMONPASSWORD is not set. Please set the secret in the dev environment."
            exit 1
          fi
          DEFECTDOJO_TOKEN_COMMON=`curl --fail --location --request POST "${{ env.DEFECTDOJO_URL }}/api-token-auth/" \
            --header 'Content-Type: application/json' \
            --data-raw "{
              \"username\": \"${{ env.DEFECTDOJO_COMMONUSER }}\",
              \"password\": \"${{ secrets.DEFECTDOJO_COMMONPASSWORD }}\"
            }" | jq -r '.token'`
          if [ -z "${DEFECTDOJO_TOKEN_COMMON}" ]; then
            echo "Error: Failed to get token from common user ${{ env.DEFECTDOJO_COMMONUSER }}. Please check the credentials."
            exit 1
          else
            #echo "DEFECTDOJO_TOKEN: $DEFECTDOJO_TOKEN_COMMON"
            echo "DEFECTDOJO_TOKEN is set"
            echo "DEFECTDOJO_TOKEN=$DEFECTDOJO_TOKEN_COMMON" >> $GITHUB_ENV
            exit 0
          fi
      - name: test action get product id
        if: env.useCommonDefectDojoProduct == 'true'
        run: |-
          echo "testing action"
          # now get the product id
          echo "DEFECTDOJO_COMMONPRODUCTNAME: ${{ env.DEFECTDOJO_COMMONPRODUCTNAME }}"
          DEFECTDOJO_PRODUCTID_COMMON=`curl --fail --location --request GET "${{ env.DEFECTDOJO_URL }}/products/?name=${{ env.DEFECTDOJO_COMMONPRODUCTNAME }}" \
            --header "Authorization: Token ${{ env.DEFECTDOJO_TOKEN }}" | jq -r '.results[0].id'`
          if [ -z "${DEFECTDOJO_PRODUCTID_COMMON}" ]; then
            echo "Error: Failed to get product id for ${{ env.DEFECTDOJO_COMMONPRODUCTNAME }}. Please check the product name."
            exit 1
          else
            echo "DEFECTDOJO_PRODUCTID: $DEFECTDOJO_PRODUCTID_COMMON"
            echo "DEFECTDOJO_PRODUCTID is set"
            echo "DEFECTDOJO_PRODUCTID=$DEFECTDOJO_PRODUCTID_COMMON" >> $GITHUB_ENV
            exit 0
          fi
      - name: test env settings
        if: env.useCommonDefectDojoProduct == 'true'
        run: |-
          #echo $DEFECTDOJO_TOKEN
          #echo ${{ env.DEFECTDOJO_TOKEN }}
          echo $DEFECTDOJO_PRODUCTID
          echo ${{ env.DEFECTDOJO_PRODUCTID }}
      - name: checkout
        uses: actions/checkout@v4.1.0
      - name: Setup Python
        uses: actions/setup-python@v5.0.0
        with:
          python-version: "3.8"
          architecture: x64
      - name: Install Dependencies
        run: pip install -r requirements.txt
      - name: Check some variables
        run: |-
          echo "DOCKER_REGISTRY: ${{ vars.DOCKER_USERNAME }}.azurecr.io, DOCKER_USERNAME: ${{ vars.DOCKER_USERNAME }}"
          echo "DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}"
      - name: Build Docker image
        run: docker build . --file "Dockerfile" -t ${{ env.image }}:${{ github.run_id }} -t ${{ env.image }}:latest
      - name: Docker Login
        if: env.pushDockerImage == 'true'
        uses: docker/login-action@v3.0.0
        with:
          registry: "${{ vars.DOCKER_USERNAME }}.azurecr.io"
          username: "${{ vars.DOCKER_USERNAME }}"
          password: "${{ secrets.DOCKER_PASSWORD }}"
      - name: Push Docker image ${{ env.image }}:${{ github.run_id }}
        if: env.pushDockerImage == 'true'
        run: docker push ${{ env.image }}:${{ github.run_id }}
      - name: Push Docker image ${{ env.image }}:latest
        if: env.pushDockerImage == 'true'
        run: docker push ${{ env.image }}:latest
      # - name: Aqua Security Trivy
      #   # You may pin to the exact commit or the version.
      #   # uses: aquasecurity/trivy-action@fd25fed6972e341ff0007ddb61f77e88103953c2
      #   uses: aquasecurity/trivy-action@0.21.0
      #   with:
      #     # image reference(for backward compatibility)
      #     image-ref: ${{ env.image }}:latest
  devsecops-tasks:
    name: Do DevSecOps Tasks
    needs:
      - build-build_and_push_app
    runs-on: ubuntu-latest
    environment:
      name: dev
    steps:
      - name: checkout
        uses: actions/checkout@v4.1.0
      # - name: Gitleaks
      #   continue-on-error: true
      #   # You may pin to the exact commit or the version.
      #   # uses: gitleaks/gitleaks-action@e6dab246340401bf53eec993b8f05aebe80ac636
      #   uses: gitleaks/gitleaks-action@v2.3.4
      #   env:
      #     GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      #     #GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE}} # Only required for Organizations, not personal accounts.
      # - name: Dependency Review
      #   uses: actions/dependency-review-action@v4.3.2
      #   with:
      #     base-ref: ${{ github.ref }}
      #     head-ref: ${{ github.sha }}
      #     # Token for the repository. Can be passed in using `{{ secrets.GITHUB_TOKEN }}`.
      #     repo-token: ${{ github.token }} # optional, default is ${{ github.token }}
      #     # A boolean to determine if license checks should be performed
      #     license-check: true # optional
      #     # A boolean to determine if vulnerability checks should be performed
      #     vulnerability-check: true # optional
      #     # Show a summary of the OpenSSF Scorecard scores.
      #     show-openssf-scorecard: true # optional
      # - name: Run Microsoft Security DevOps
      #   uses: microsoft/security-devops-action@v1
      #   id: msdo
      # - name: Upload results to Security tab
      #   uses: github/codeql-action/upload-sarif@v2
      #   with:
      #     sarif_file: ${{ steps.msdo.outputs.sarifFile }}
  test-run_devopsshield_scan_linux:
    name: Run DevOps Shield Scan Linux
    needs:
      - devsecops-tasks
    runs-on: ubuntu-latest
    environment:
      name: dev
    steps:
      - name: checkout
        uses: actions/checkout@v4.1.0
      - name: DevOps Shield Security Scanner Linux
        run: |-
          # Run DevOps Shield CLI with dosType=GitHub for current repository
          echo "Current Repo: ${{ github.repository }}"
          echo "Current Org: ${{ github.repository_owner }}"
          echo "GitHub Token: ${{ secrets.TOKEN_FOR_DOS }}"
          # throw error if token is not set
          if [ -z "${{ secrets.TOKEN_FOR_DOS }}" ]; then
            echo "Error: TOKEN_FOR_DOS is not set. Please set the secret in the dev environment. You need to create a personal access token (classic). In general, you only need read permissions."
            exit 1
          fi
          # check os linux or windows
          echo "Linux OS"
          docker run --name devopsshield \
            -v "${{ github.workspace }}:/devopsshield" \
            --rm -t \
            -e dosOrganizationName=${{ github.repository_owner }} \
            -e dosPatToken=${{ secrets.TOKEN_FOR_DOS }} \
            -e dosType=GitHub \
            devopsshield/devopsshield
          ls ${{ github.workspace }}
          cat ${{ github.workspace }}/DevOpsShield-SecurityScanner-Report.sarif
          cat ${{ github.workspace }}/DevOpsShield-SecurityScanner-Report.csv
          mkdir "${{ github.workspace }}/devops-shield-reports-linux"
          cp ${{ github.workspace }}/DevOpsShield-SecurityScanner-Report.sarif "${{ github.workspace }}/devops-shield-reports-linux"
          cp ${{ github.workspace }}/DevOpsShield-SecurityScanner-Report.csv "${{ github.workspace }}/devops-shield-reports-linux"
        shell: bash
      - name: Fix DOS SARIF (temporary workaround)
        run: |-
          Write-Host "Fixing DOS Sarif"
          # read sarif and fix it
          $SarifFile = "${{ github.workspace }}/devops-shield-reports-linux/DevOpsShield-SecurityScanner-Report.sarif"
          $SarifFileFixed = "${{ github.workspace }}/devops-shield-reports-linux/DevOpsShield-SecurityScanner-Report-Fixed.sarif"

          $sarifObject = Get-Content -Path $SarifFile | ConvertFrom-Json -Depth 100

          foreach ($run in $sarifObject.runs) {
              foreach ($result in $run.results) {
                  # echo ruleId
                  Write-Host $result.ruleId
                  # loop through fixes
                  foreach ($fix in $result.fixes) {
                      # echo fix
                      Write-Host $fix
                      # echo fix description
                      $description = $fix.description
                      # echo description id
                      $descriptionId = $description.id
                      Write-Host `t`t$descriptionId
                      # echo description arguments
                      $descriptionArguments = $description.arguments
                      foreach ($argument in $descriptionArguments) {
                          Write-Host `t`t`t$argument
                      }
                      # check if there are more than one argument
                      if ($descriptionArguments.Count -gt 1) {
                          # throw error
                          Write-Error "Error: More than one argument found"
                          exit 1
                      }
                      # prepare new description text
                      $newText = "$descriptionId - $($descriptionArguments[0])"
                      $fix.description = $newText
                      # echo new fix description
                      Write-Host `t`t$newText

                      # change description object
                      # create new custom object for description with a single text property
                      $newDescription = [PSCustomObject]@{ text = $newText }
                      # replace description object with new object
                      $fix.description = $newDescription
                  }
              }
          }
          $sarifObject | ConvertTo-Json -Depth 100 | Set-Content -Path $SarifFileFixed
        shell: pwsh
      - name: Upload DevOps Shield Reports
        uses: actions/upload-artifact@v4.1.0
        with:
          name: devops-shield-reports-linux
          path: "${{ github.workspace }}/devops-shield-reports-linux"
  test-run_sca_analysis:
    name: Run SCA Analysis
    needs:
      - devsecops-tasks
    runs-on: ubuntu-latest
    env:
      image: ${{ vars.DOCKER_USERNAME }}.azurecr.io/devsecops-pygoat
    environment:
      name: dev
    steps:
      - name: checkout
        uses: actions/checkout@v4.1.0
      - name: Safety Dependency Check
        run: |-
          pip install safety
          mkdir -p ${{ github.workspace }}/dependency-check-reports
          safety check -r requirements.txt --continue-on-error --output json > ${{ github.workspace }}/dependency-check-reports/dependency-check-report-safety-check.json
      - name: Pip Audit Dependency Check
        run: |-
          pip install pip-audit
          mkdir -p ${{ github.workspace }}/dependency-check-reports
          # suppress the error code to continue the pipeline even if there are vulnerabilities
          pip-audit -r requirements.txt --format json --output ${{ github.workspace }}/dependency-check-reports/dependency-check-report-pip-audit.json || true
          #cat ${{ github.workspace }}/dependency-check-reports/dependency-check-report-pip-audit.json
      - uses: actions/upload-artifact@v4.1.0
        with:
          name: dependency-check-reports
          path: "${{ github.workspace }}/dependency-check-reports"
      - name: Docker Login
        if: env.doImageScanWithDockerHubScout == 'true'
        uses: docker/login-action@v3.0.0
        with:
          registry: "${{ vars.DOCKER_USERNAME }}.azurecr.io"
          username: "${{ vars.DOCKER_USERNAME }}"
          password: "${{ secrets.DOCKER_PASSWORD }}"
      - name: Image Scanning
        if: env.doImageScanWithDockerHubScout == 'true'
        run: |-
          # Install the Docker Scout CLI
          curl -sSfL https://raw.githubusercontent.com/docker/scout-cli/main/install.sh | sh -s --
          # Login to Docker Hub required for Docker Scout CLI
          #docker login -u ${{ vars.DOCKER_USERNAME }} -p ${{ secrets.DOCKER_PASSWORD }}
          # Get a CVE report for the built image and fail the pipeline when critical or high CVEs are detected
          docker scout cves ${{ env.image }}:${{ env.tag }} --only-severity critical,high --format sarif --output ${{ github.workspace }}/image-scan-report.json
      - name: Publish Image Scan Report
        if: success() || failure()
        uses: actions/upload-artifact@v4.1.0
        with:
          name: image-scan-report
          path: "${{ github.workspace }}/image-scan-report.json"
  test-run_unit_tests:
    name: Run Unit Tests
    needs:
      - devsecops-tasks
    runs-on: ubuntu-latest
    steps:
      - name: checkout
        uses: actions/checkout@v4.1.0
      - name: Setup Python
        uses: actions/setup-python@v5.0.0
        with:
          python-version: "3.8"
          architecture: x64
      - name: Install Dependencies
        run: pip install -r requirements.txt
      - name: UnitTests with PyTest
        run: |-
          python -m pip install pytest-azurepipelines pytest-cov
          python -m pytest introduction/tests/unit/ --junitxml=${{ github.workspace }}/TEST-output.xml --cov=. --cov-report=xml
      - name: Publish UnitTest Report
        if: success() || failure()
        uses: actions/upload-artifact@v4.1.0
        with:
          name: unit-test-results
          path: "${{ github.workspace }}/TEST-output.xml"
  test-run_sast_analysis:
    name: Run SAST Analysis
    needs:
      - devsecops-tasks
    runs-on: ubuntu-latest
    steps:
      - name: checkout
        uses: actions/checkout@v4.1.0
      - name: Bandit Scan
        run: |-
          pip3 install --upgrade pip
          pip3 install --upgrade setuptools
          pip3 install bandit
          bandit -ll -ii -r ./introduction -f json -o ${{ github.workspace }}/sast-report.json --exit-zero
      - name: Publish SAST Scan Report
        if: success() || failure()
        uses: actions/upload-artifact@v4.1.0
        with:
          name: bandit-sast-report
          path: "${{ github.workspace }}/sast-report.json"
  test-upload_reports:
    name: Upload Reports
    needs:
      - test-run_devopsshield_scan_linux
      - test-run_sast_analysis
      - test-run_unit_tests
      - test-run_sca_analysis
      - build-build_and_push_app
    runs-on: ubuntu-latest
    environment:
      name: dev
    env:
      DEFECTDOJO_PRODUCTID: ${{ vars.DEFECTDOJO_PRODUCTID }}
      DEFECTDOJO_TOKEN: ${{ secrets.DEFECTDOJO_TOKEN }}
      DEFECTDOJO_COMMONPASSWORD: ${{ secrets.DEFECTDOJO_COMMONPASSWORD }}
      DEFECTDOJO_ENGAGEMENT_REASON: "CI/CD Pipeline Scan"
      DEFECTDOJO_ANCHORE_DISABLE: "false"
      DEFECTDOJO_ENGAGEMENT_API_TEST: "true"
      DEFECTDOJO_ENGAGEMENT_BUILD_SERVER: "null"
      DEFECTDOJO_ENGAGEMENT_CHECK_LIST: "true"
      DEFECTDOJO_ENGAGEMENT_DEDUPLICATION_ON_ENGAGEMENT: "true"
      DEFECTDOJO_ENGAGEMENT_ORCHESTRATION_ENGINE: "null"
      DEFECTDOJO_ENGAGEMENT_PEN_TEST: "true"
      DEFECTDOJO_ENGAGEMENT_PERIOD: 7
      DEFECTDOJO_ENGAGEMENT_SOURCE_CODE_MANAGEMENT_SERVER: "null"
      DEFECTDOJO_ENGAGEMENT_STATUS: Not Started
      DEFECTDOJO_ENGAGEMENT_THREAT_MODEL: "true"
      DEFECTDOJO_NOT_ON_MASTER: "false"
      DEFECTDOJO_SCAN_ACTIVE: "true"
      DEFECTDOJO_SCAN_CLOSE_OLD_FINDINGS: "true"
      DEFECTDOJO_SCAN_ENVIRONMENT: Default
      DEFECTDOJO_SCAN_MINIMUM_SEVERITY: Info
      DEFECTDOJO_SCAN_PUSH_TO_JIRA: "false"
      DEFECTDOJO_SCAN_TEST_TYPE: SAST and SCA Scan
      DEFECTDOJO_SCAN_VERIFIED: "true"
    steps:
      - name: checkout
        uses: actions/checkout@v4.1.0
      - name: Download Reports From Pipeline Artifacts
        uses: actions/download-artifact@v4.1.0
        with:
          path: "${{ github.workspace }}"
      - name: check if secrets are set
        if: false
        run: |-
          echo "DEFECTDOJO_URL: ${{ env.DEFECTDOJO_URL }}"
          echo "DEFECTDOJO_PRODUCTID: ${{ vars.DEFECTDOJO_PRODUCTID }}"
          echo "DEFECTDOJO_TOKEN: ${{ secrets.DEFECTDOJO_TOKEN }}"
          echo "DEFECTDOJO_COMMONUSER: ${{ env.DEFECTDOJO_COMMONUSER }}"
          echo "DEFECTDOJO_COMMONPASSWORD: ${{ secrets.DEFECTDOJO_COMMONPASSWORD }}"
          # throw error if token is not set and common password is not set
          if [ -z "${{ secrets.DEFEECTDOJO_TOKEN }}" ]; then
            echo "Warning: DEFEECTDOJO_TOKEN is not set. Please set the secret in the dev environment."
            echo "Checking for DEFECTDOJO_COMMONPASSWORD"
            if [ -z "${{ secrets.DEFEECTDOJO_COMMONPASSWORD }}" ]; then
              echo "Error: DEFECTDOJO_TOKEN is not set. Please set the secret in the dev environment."
              echo "Error: DEFECTDOJO_COMMONPASSWORD is not set. Please set the secret in the dev environment."
              echo "You need to set either DEFECTDOJO_TOKEN or DEFECTDOJO_COMMONPASSWORD to run the pipeline."
              exit 1
            else
              echo "DEFECTDOJO_COMMONPASSWORD is set"
              echo "Trying to get token from common user ${{ env.DEFECTDOJO_COMMONUSER }}..."
              # get token from common user
              DEFECTDOJO_TOKEN=`curl --fail --location --request POST "${{ env.DEFECTDOJO_URL }}/api-token-auth/" \
                --header 'Content-Type: application/json' \
                --data-raw "{
                  \"username\": \"${{ env.DEFECTDOJO_COMMONUSER }}\",
                  \"password\": \"${{ secrets.DEFECTDOJO_COMMONPASSWORD }}\"
                }" | jq -r '.token'`
              if [ -z "${DEFECTDOJO_TOKEN}" ]; then
                echo "Error: Failed to get token from common user ${{ env.DEFECTDOJO_COMMONUSER }}. Please check the credentials."
                exit 1
              else
                echo "DEFECTDOJO_TOKEN: $DEFECTDOJO_TOKEN"
                echo "DEFECTDOJO_TOKEN is set"
                exit 0
              fi
              exit 0
            fi
          else
            echo "DEFECTDOJO_TOKEN is set"
            exit 0
          fi
      - name: check if secrets are set
        if: env.useCommonDefectDojoProduct == 'true'
        shell: pwsh
        run: |-
          echo "DEFECTDOJO_URL: $env:DEFECTDOJO_URL"
          echo "DEFECTDOJO_PRODUCTID: $env:DEFECTDOJO_PRODUCTID"
          echo "DEFECTDOJO_TOKEN: $env:DEFECTDOJO_TOKEN"
          echo "DEFECTDOJO_COMMONUSER: $env:DEFECTDOJO_COMMONUSER"
          echo "DEFECTDOJO_COMMONPASSWORD: $env:DEFECTDOJO_COMMONPASSWORD"
          # throw error if token is not set and common password is not set
          $defectDojoTokenIsSet = $null -ne $env:DEFECTDOJO_TOKEN -and $env:DEFECTDOJO_TOKEN -ne ""
          Write-Host "DefectDojo Token is set: $defectDojoTokenIsSet"
          $defectDojoCommonPasswordIsSet = $null -ne $env:DEFECTDOJO_COMMONPASSWORD -and $env:DEFECTDOJO_COMMONPASSWORD -ne ""
          Write-Host "DefectDojo Common Password is set: $defectDojoCommonPasswordIsSet"

          if ($defectDojoTokenIsSet) {
            Write-Host "DEFECTDOJO_TOKEN is set"
            exit 0
          }
          else {
            Write-Host "Warning: DEFEECTDOJO_TOKEN is not set. Please set the secret in the dev environment."
            Write-Host "checking for DEFECTDOJO_COMMONPASSWORD"
            if ($defectDojoCommonPasswordIsSet) {
              Write-Host "DEFECTDOJO_COMMONPASSWORD is set"
              Write-Host "Trying to get token from common user ${{ env.DEFECTDOJO_COMMONUSER }}..."
              # get token from common user
              $DEFECTDOJO_TOKEN_COMMON = (Invoke-RestMethod -Method Post -Uri "${env:DEFECTDOJO_URL}/api-token-auth/" `
                    -ContentType 'application/json' `
                    -Body (@{
                        "username" = "$env:DEFECTDOJO_COMMONUSER";
                        "password" = "$env:DEFECTDOJO_COMMONPASSWORD"
                    } | ConvertTo-Json)).token

              if ($DEFECTDOJO_TOKEN_COMMON) {
                #Write-Host "DEFECTDOJO_TOKEN: $DEFECTDOJO_TOKEN_COMMON"
                Write-Host "DEFECTDOJO_TOKEN is set"
                #echo "DEFECTDOJO_TOKEN=$DEFECTDOJO_TOKEN_COMMON" >> $GITHUB_ENV
                echo "DEFECTDOJO_TOKEN=$DEFECTDOJO_TOKEN_COMMON" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append

                # now to fetch the product id
                # Get the product id
                $DEFECTDOJO_PRODUCTID_COMMON = Invoke-RestMethod -Method Get -Uri "${env:DEFECTDOJO_URL}/products/?name=${env:DEFECTDOJO_COMMONPRODUCTNAME}" `
                    -Headers @{ "Authorization" = "Token $DEFECTDOJO_TOKEN_COMMON" }

                Write-Host "DEFECTDOJO_PRODUCTID_COMMON: $DEFECTDOJO_PRODUCTID_COMMON"

                if ($DEFECTDOJO_PRODUCTID_COMMON) {
                    $DEFECTDOJO_PRODUCTID_COMMON_ID = $DEFECTDOJO_PRODUCTID_COMMON.results[0].id
                    Write-Host "DEFECTDOJO_PRODUCTID: $DEFECTDOJO_PRODUCTID_COMMON_ID"
                    Write-Host "DEFECTDOJO_PRODUCTID is set"
                    #echo "DEFECTDOJO_PRODUCTID=$DEFECTDOJO_PRODUCTID_COMMON_ID" >> $GITHUB_ENV
                    echo "DEFECTDOJO_PRODUCTID=$DEFECTDOJO_PRODUCTID_COMMON_ID" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf8 -Append
                    exit 0
                }
                else {
                    Write-Host "Error: Failed to get product id for $DEFECTDOJO_COMMONPRODUCTNAME. Please check the product name."
                    exit 1
                }
              }
              else {
                Write-Host "Error: Failed to get token from common user ${env:DEFECTDOJO_COMMONUSER}. Please check the credentials."
                exit 1
              }
            }
            else {
              Write-Host "Error: DEFECTDOJO_TOKEN is not set. Please set the secret in the dev environment."
              Write-Host "Error: DEFECTDOJO_COMMONPASSWORD is not set. Please set the secret in the dev environment."
              Write-Host "You need to set either DEFECTDOJO_TOKEN or DEFECTDOJO_COMMONPASSWORD to run the pipeline."
              exit 1
            }
          }
      - name: test env settings
        if: env.useCommonDefectDojoProduct == 'true'
        shell: pwsh
        run: |-
          #echo $env:DEFECTDOJO_TOKEN
          echo $env:DEFECTDOJO_PRODUCTID
      - name: Create DefectDojo Engagement with Common Product
        if: env.useCommonDefectDojoProduct == 'true'
        run: |-
          TODAY=`date +%Y-%m-%d`
          ENDDAY=$(date -d "+${{ env.DEFECTDOJO_ENGAGEMENT_PERIOD }} days" +%Y-%m-%d)
          ENGAGEMENTID=`curl --fail --location --request POST "${{ env.DEFECTDOJO_URL }}/engagements/" \
            --header "Authorization: Token ${{ env.DEFECTDOJO_TOKEN }}" \
            --header 'Content-Type: application/json' \
              --data-raw "{
                \"tags\": [\"GITHUB\"],
                \"name\": \"pygoat-${{ github.run_id }}\",
                \"description\": \"${{ github.event.head_commit.message }}\",
                \"version\": \"${{ github.ref }}\",
                \"first_contacted\": \"${TODAY}\",
                \"target_start\": \"${TODAY}\",
                \"target_end\": \"${ENDDAY}\",
                \"reason\": \"${{ env.DEFECTDOJO_ENGAGEMENT_REASON }}\",
                \"tracker\": \"${{ github.server_url }}/${{ github.repository }}/\",
                \"threat_model\": \"${{ env.DEFECTDOJO_ENGAGEMENT_THREAT_MODEL }}\",
                \"api_test\": \"${{ env.DEFECTDOJO_ENGAGEMENT_API_TEST }}\",
                \"pen_test\": \"${{ env.DEFECTDOJO_ENGAGEMENT_PEN_TEST }}\",
                \"check_list\": \"${{ env.DEFECTDOJO_ENGAGEMENT_CHECK_LIST }}\",
                \"status\": \"${{ env.DEFECTDOJO_ENGAGEMENT_STATUS }}\",
                \"engagement_type\": \"CI/CD\",
                \"build_id\": \"${{ github.run_id }}\",
                \"commit_hash\": \"${{ github.sha }}\",
                \"branch_tag\": \"${{ github.ref }}\",
                \"deduplication_on_engagement\": \"${{ env.DEFECTDOJO_ENGAGEMENT_DEDUPLICATION_ON_ENGAGEMENT }}\",
                \"product\": \"${{ env.DEFECTDOJO_PRODUCTID }}\",
                \"source_code_management_uri\": \"${{ github.server_url }}/${{ github.repository }}\",
                \"build_server\": ${{ env.DEFECTDOJO_ENGAGEMENT_BUILD_SERVER }},
                \"source_code_management_server\": ${{ env.DEFECTDOJO_ENGAGEMENT_SOURCE_CODE_MANAGEMENT_SERVER }},
                \"orchestration_engine\": ${{ env.DEFECTDOJO_ENGAGEMENT_ORCHESTRATION_ENGINE }}
            }" | jq -r '.id'` &&
            echo ${ENGAGEMENTID} > ENGAGEMENTID.env
      - name: Create DefectDojo Engagement
        if: env.useCommonDefectDojoProduct == 'false'
        run: |-
          TODAY=`date +%Y-%m-%d`
          ENDDAY=$(date -d "+${{ env.DEFECTDOJO_ENGAGEMENT_PERIOD }} days" +%Y-%m-%d)
          ENGAGEMENTID=`curl --fail --location --request POST "${{ env.DEFECTDOJO_URL }}/engagements/" \
            --header "Authorization: Token ${{ secrets.DEFECTDOJO_TOKEN }}" \
            --header 'Content-Type: application/json' \
              --data-raw "{
                \"tags\": [\"GITHUB\"],
                \"name\": \"pygoat-${{ github.run_id }}\",
                \"description\": \"${{ github.event.head_commit.message }}\",
                \"version\": \"${{ github.ref }}\",
                \"first_contacted\": \"${TODAY}\",
                \"target_start\": \"${TODAY}\",
                \"target_end\": \"${ENDDAY}\",
                \"reason\": \"${{ env.DEFECTDOJO_ENGAGEMENT_REASON }}\",
                \"tracker\": \"${{ github.server_url }}/${{ github.repository }}/\",
                \"threat_model\": \"${{ env.DEFECTDOJO_ENGAGEMENT_THREAT_MODEL }}\",
                \"api_test\": \"${{ env.DEFECTDOJO_ENGAGEMENT_API_TEST }}\",
                \"pen_test\": \"${{ env.DEFECTDOJO_ENGAGEMENT_PEN_TEST }}\",
                \"check_list\": \"${{ env.DEFECTDOJO_ENGAGEMENT_CHECK_LIST }}\",
                \"status\": \"${{ env.DEFECTDOJO_ENGAGEMENT_STATUS }}\",
                \"engagement_type\": \"CI/CD\",
                \"build_id\": \"${{ github.run_id }}\",
                \"commit_hash\": \"${{ github.sha }}\",
                \"branch_tag\": \"${{ github.ref }}\",
                \"deduplication_on_engagement\": \"${{ env.DEFECTDOJO_ENGAGEMENT_DEDUPLICATION_ON_ENGAGEMENT }}\",
                \"product\": \"${{ env.DEFECTDOJO_PRODUCTID }}\",
                \"source_code_management_uri\": \"${{ github.server_url }}/${{ github.repository }}\",
                \"build_server\": ${{ env.DEFECTDOJO_ENGAGEMENT_BUILD_SERVER }},
                \"source_code_management_server\": ${{ env.DEFECTDOJO_ENGAGEMENT_SOURCE_CODE_MANAGEMENT_SERVER }},
                \"orchestration_engine\": ${{ env.DEFECTDOJO_ENGAGEMENT_ORCHESTRATION_ENGINE }}
            }" | jq -r '.id'` &&
            echo ${ENGAGEMENTID} > ENGAGEMENTID.env
      - name: list artifacts
        if: env.listArtifacts == 'true'
        run: |-
          ls -l ${{ github.workspace }}
          #ls -l ${{ github.workspace }}/image-scan-report
          ls -l ${{ github.workspace }}/dependency-check-reports
          ls -l ${{ github.workspace }}/bandit-sast-report
          ls -l ${{ github.workspace }}/devops-shield-reports-linux
      - name: Upload Reports To DefectDojo with Common Product
        if: env.useCommonDefectDojoProduct == 'true'
        run: |-
          TODAY=`date +%Y-%m-%d`
          ENGAGEMENTID=`cat ENGAGEMENTID.env`
          echo "TODAY: $TODAY"
          echo "ENGAGEMENTID: $ENGAGEMENTID"
          array=('type=("SARIF" "pip-audit Scan" "SARIF" "Bandit Scan")' 'file=("devops-shield-reports-linux/DevOpsShield-SecurityScanner-Report-Fixed.sarif" "dependency-check-reports/dependency-check-report-pip-audit.json" "image-scan-report/image-scan-report.json" "bandit-sast-report/sast-report.json")')
          for elt in "${array[@]}";do eval $elt;done
          for scan in 0 1 2 3; do \
            echo ""
            echo "======================= Scan No $scan ======================="
            echo "Uploading ${type[$scan]} report"
            echo "Uploading ${file[$scan]}"
            #echo "Contents are:"
            #cat ${{ github.workspace }}/${file[$scan]}
            # check if the file exists
            if [ -f ${{ github.workspace }}/${file[$scan]} ]; then
              echo "File exists"
            else
              echo "File does not exist"
              continue
            fi
            curl --fail --location --request POST "${{ env.DEFECTDOJO_URL }}/import-scan/" \
              --header "Authorization: Token ${{ env.DEFECTDOJO_TOKEN }}" \
              --form "scan_date=${TODAY}" \
              --form "minimum_severity=${{ env.DEFECTDOJO_SCAN_MINIMUM_SEVERITY }}" \
              --form "active=${{ env.DEFECTDOJO_SCAN_ACTIVE }}" \
              --form "verified=${{ env.DEFECTDOJO_SCAN_VERIFIED }}" \
              --form "scan_type=${type[$scan]}" \
              --form "engagement=${ENGAGEMENTID}" \
              --form "file=@${{ github.workspace }}/${file[$scan]}" \
              --form "close_old_findings=${{ env.DEFECTDOJO_SCAN_CLOSE_OLD_FINDINGS }}" \
              --form "push_to_jira=${{ env.DEFECTDOJO_SCAN_PUSH_TO_JIRA }}" \
              --form "test_type=${{ env.DEFECTDOJO_SCAN_TEST_TYPE }}" \
              --form "environment=${{ env.DEFECTDOJO_SCAN_ENVIRONMENT }}"
          done
      - name: Upload Reports To DefectDojo
        if: env.useCommonDefectDojoProduct == 'false'
        run: |-
          TODAY=`date +%Y-%m-%d`
          ENGAGEMENTID=`cat ENGAGEMENTID.env`
          echo "TODAY: $TODAY"
          echo "ENGAGEMENTID: $ENGAGEMENTID"
          array=('type=("SARIF" "pip-audit Scan" "SARIF" "Bandit Scan")' 'file=("devops-shield-reports-linux/DevOpsShield-SecurityScanner-Report-Fixed.sarif" "dependency-check-reports/dependency-check-report-pip-audit.json" "image-scan-report/image-scan-report.json" "bandit-sast-report/sast-report.json")')
          for elt in "${array[@]}";do eval $elt;done
          for scan in 0 1 2 3; do \
            echo ""
            echo "======================= Scan No $scan ======================="
            echo "Uploading ${type[$scan]} report"
            echo "Uploading ${file[$scan]}"
            #echo "Contents are:"
            #cat ${{ github.workspace }}/${file[$scan]}
            # check if the file exists
            if [ -f ${{ github.workspace }}/${file[$scan]} ]; then
              echo "File exists"
            else
              echo "File does not exist"
              continue
            fi
            curl --fail --location --request POST "${{ env.DEFECTDOJO_URL }}/import-scan/" \
              --header "Authorization: Token ${{ secrets.DEFECTDOJO_TOKEN }}" \
              --form "scan_date=${TODAY}" \
              --form "minimum_severity=${{ env.DEFECTDOJO_SCAN_MINIMUM_SEVERITY }}" \
              --form "active=${{ env.DEFECTDOJO_SCAN_ACTIVE }}" \
              --form "verified=${{ env.DEFECTDOJO_SCAN_VERIFIED }}" \
              --form "scan_type=${type[$scan]}" \
              --form "engagement=${ENGAGEMENTID}" \
              --form "file=@${{ github.workspace }}/${file[$scan]}" \
              --form "close_old_findings=${{ env.DEFECTDOJO_SCAN_CLOSE_OLD_FINDINGS }}" \
              --form "push_to_jira=${{ env.DEFECTDOJO_SCAN_PUSH_TO_JIRA }}" \
              --form "test_type=${{ env.DEFECTDOJO_SCAN_TEST_TYPE }}" \
              --form "environment=${{ env.DEFECTDOJO_SCAN_ENVIRONMENT }}"
          done
  deploy_test-deploy_to_test_k8s_cluster:
    name: Deploy To Test K8S Cluster
    needs:
      - test-upload_reports
    runs-on: ubuntu-latest
    env:
      RESOURCE_GROUP: rg-k8s-pygoat-dev-001
      CLUSTER_NAME: aks-k8s-pygoat-dev-001
      NAMESPACE: pygoat-test
      Pygoat_Service: pygoat-svc
      DnsResourceGroup: rg-dns-prod
      zoneName: cad4devops.com
      dnsRecordSetName: gh-pygoat-test
      image: ${{ vars.DOCKER_USERNAME }}.azurecr.io/devsecops-pygoat
    environment:
      name: OSS_pygoat-test
    steps:
      - name: checkout
        uses: actions/checkout@v4.1.0
      - name: download artifact
        if: false
        uses: actions/download-artifact@v4.1.0
      - uses: actions/checkout@v4.1.0
      - uses: cschleiden/replace-tokens@v1
        with:
          tokenPrefix: "#{"
          tokenSuffix: "}#"
          files: '["${{ github.workspace }}/manifests/k8s-*.yaml"]'
        env:
          host: ${{ env.host }}
          image: ${{ env.image }}
          tag: ${{ env.tag }}
      - name: See the files
        run: |-
          cat ${{ github.workspace }}/manifests/k8s-deployment.yaml
          cat ${{ github.workspace }}/manifests/k8s-ingress.yaml
      - name: Azure login
        if: env.useAzureCliForK8s == 'true'
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
      - name: Create k8s namespace ${{ env.NAMESPACE }}
        if: env.useAzureCliForK8s == 'true'
        uses: azure/cli@v2
        with:
          azcliversion: latest
          inlineScript: |
            az account show
            az aks get-credentials --resource-group ${{ env.RESOURCE_GROUP }} --name ${{ env.CLUSTER_NAME }}
            az aks install-cli
            echo "Sleeping for 10 seconds - waiting for kubectl to be ready"
            sleep 10
            kubectl version --client
            kubectl get nodes
            kubectl get namespaces
            # create namespace if it does not exist
            kubectl create namespace ${{ env.NAMESPACE }} --dry-run=client -o yaml | kubectl apply -f -
      - uses: tale/kubectl-action@v1
        continue-on-error: true
        with:
          base64-kube-config: ${{ secrets.KUBE_CONFIG }}
          kubectl-version: v1.28.9
      - name: Create k8s namespace ${{ env.NAMESPACE }}
        continue-on-error: true
        run: |-
          kubectl version --client
          kubectl get nodes
          kubectl get namespaces
          # create namespace if it does not exist
          kubectl create namespace ${{ env.NAMESPACE }} --dry-run=client -o yaml | kubectl apply -f -
      - name: Install k8s manifests - namespace ${{ env.NAMESPACE }}
        if: env.useAzureCliForK8s == 'true'
        uses: azure/cli@v2
        with:
          azcliversion: latest
          inlineScript: |
            az account show
            az aks get-credentials --resource-group ${{ env.RESOURCE_GROUP }} --name ${{ env.CLUSTER_NAME }}
            az aks install-cli
            echo "Sleeping for 10 seconds - waiting for kubectl to be ready"
            sleep 10
            kubectl version --client
            # apply the manifests
            kubectl apply -f ${{ github.workspace }}/manifests/k8s-deployment.yaml -n ${{ env.NAMESPACE }}
            kubectl apply -f ${{ github.workspace }}/manifests/k8s-service.yaml -n ${{ env.NAMESPACE }}
            kubectl apply -f ${{ github.workspace }}/manifests/k8s-ingress.yaml -n ${{ env.NAMESPACE }}
            # wait for the service to be ready
            kubectl wait --for=condition=available --timeout=600s deployment.apps/pygoat-app -n ${{ env.NAMESPACE }}
      - name: Install k8s manifests - namespace ${{ env.NAMESPACE }}
        continue-on-error: true
        run: |-
          kubectl version --client
          # apply the manifests
          kubectl apply -f ${{ github.workspace }}/manifests/k8s-deployment.yaml -n ${{ env.NAMESPACE }}
          kubectl apply -f ${{ github.workspace }}/manifests/k8s-service.yaml -n ${{ env.NAMESPACE }}
          kubectl apply -f ${{ github.workspace }}/manifests/k8s-ingress.yaml -n ${{ env.NAMESPACE }}
          # wait for the service to be ready
          kubectl wait --for=condition=available --timeout=600s deployment.apps/pygoat-app -n ${{ env.NAMESPACE }}
      - name: Adjust DNS for environment
        if: env.adjustDNS == 'true'
        uses: azure/cli@v2
        with:
          azcliversion: latest
          inlineScript: |
            az account show
            az aks get-credentials --resource-group ${{ env.RESOURCE_GROUP }} --name ${{ env.CLUSTER_NAME }}
            az aks install-cli
            echo "Sleeping for 10 seconds - waiting for kubectl to be ready"
            sleep 10
            kubectl version --client
            kubectl get pods -n ${{ env.NAMESPACE }}
            kubectl get services -n ${{ env.NAMESPACE }}
            # get external IP from the service
            externalIp=$(kubectl get service ${{ env.Pygoat_Service }} -n ${{ env.NAMESPACE }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
            echo "External IP: $externalIp"
            az network dns record-set a add-record \
              -g ${{ env.DnsResourceGroup }} \
              -z ${{ env.zoneName }} \
              -n ${{ env.dnsRecordSetName }} \
              -a $externalIp
      - name: Get Resources - namespace ${{ env.NAMESPACE }}
        continue-on-error: true
        run: |-
          kubectl version --client
          kubectl get pods -n ${{ env.NAMESPACE }}
          kubectl get services -n ${{ env.NAMESPACE }}
          # get external IP from the service
          externalIp=$(kubectl get service ${{ env.Pygoat_Service }} -n ${{ env.NAMESPACE }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
          echo "External IP: $externalIp"
  dast-run_integration_tests:
    name: Run Integration Tests
    needs:
      - deploy_test-deploy_to_test_k8s_cluster
    runs-on: ubuntu-latest
    steps:
      - name: checkout
        uses: actions/checkout@v4.1.0
      - name: Integration Tests with Selenium
        if: success() || failure()
        run: |-
          python -m pip install -r requirements.txt
          python -m pip install pytest-cov
          python -m pytest introduction/tests/integration/ --junitxml=${{ github.workspace }}/selenium-test-output.xml --cov=. --cov-report=xml
      - name: Publish Selenium Report
        if: success() || failure()
        uses: actions/upload-artifact@v4.1.0
        with:
          name: selenium-test-results
          path: "${{ github.workspace }}/selenium-test-output.xml"
  dast-run_dast_scan:
    name: Run DAST Scan
    needs:
      - deploy_test-deploy_to_test_k8s_cluster
    runs-on: ubuntu-latest
    steps:
      - name: checkout
        uses: actions/checkout@v4.1.0
      - name: load owasp detached
        run: "docker run --name ${{ env.containerName }} -d -u zap \\\n  -p ${{ env.owaspZapWebPort }}:${{ env.owaspZapWebPort }} \\\n  -p ${{ env.owaspZapApiPort }}:${{ env.owaspZapApiPort }} \\\n  -i ${{ env.owaspImageName }} zap.sh -daemon \\\n  -port ${{ env.owaspZapApiPort }} -host 0.0.0.0 \\\n  -config api.disablekey=true \\\n  -config api.addrs.addr.name=.* \\\n  -config api.addrs.addr.regex=true\n\n# wait for docker to load\necho \"waiting for docker to load for ${{ env.dockerWaitTime }}\"\nsleep ${{ env.dockerWaitTime }}\n\n# wait for zap to start\necho \"waiting for zap to start with loop time ${{ env.loopWaitTime }}\"\necho \"\"\nwhile [ \"$(curl -s http://localhost:${{ env.owaspZapApiPort }}/JSON/core/view/version/ | jq -r '.version')\" == \"null\" ]; do\n  echo \"\"\n  echo \"waiting for zap to start with loop time ${{ env.loopWaitTime }}\"\n  sleep ${{ env.loopWaitTime }}\n  curl -s http://localhost:${{ env.owaspZapApiPort }}/JSON/core/view/version/ | jq -r '.version'\ndone\n\n# check zap version\necho \"\"\ncurl \"http://localhost:${{ env.owaspZapApiPort }}/JSON/core/view/version/\"\n\n# To start the spider scan\necho \"\"\ncurl \"http://localhost:${{ env.owaspZapApiPort }}/JSON/spider/action/scan/?url=${{ env.appUrl }}\"\n\n# loop until response is 100\necho \"\"\nwhile [ \"$(curl -s http://localhost:${{ env.owaspZapApiPort }}/JSON/spider/view/status/?scanId=0 | jq -r '.status')\" != \"100\" ]; do\n  echo \"\"\n  echo \"waiting for spider to finish with loop time ${{ env.loopWaitTime }}\"\n  sleep ${{ env.loopWaitTime }}\n  curl -s http://localhost:${{ env.owaspZapApiPort }}/JSON/spider/view/status/?scanId=0 | jq -r '.status'\ndone\n\n# To view the status of spider\necho \"\"\ncurl \"http://localhost:${{ env.owaspZapApiPort }}/JSON/spider/view/status/?scanId=0\"\n\n# To start the the active scan if doActiveScan is true\nif [ \"${{ env.doActiveScan }}\" == \"true\" ]; then\n  echo \"\"\n  echo \"starting active scan\"\n  curl \"http://localhost:${{ env.owaspZapApiPort }}/JSON/ascan/action/scan/?url=${{ env.appUrl }}&recurse=true&inScopeOnly=&scanPolicyName=&method=&postData=&contextId=\"\n  \n  # To view the the status of active scan\n  echo \"\"\n  curl \"http://localhost:${{ env.owaspZapApiPort }}/JSON/ascan/view/status/?scanId=0\"\n\n  # loop until response is 100\n  echo \"\"\n  while [ \"$(curl -s http://localhost:${{ env.owaspZapApiPort }}/JSON/ascan/view/status/?scanId=0 | jq -r '.status')\" != \"100\" ]; do\n    echo \"\"\n    echo \"waiting for active scan to finish with loop time ${{ env.loopWaitTime }}\"\n    sleep ${{ env.loopWaitTime }}\n    curl -s http://localhost:${{ env.owaspZapApiPort }}/JSON/ascan/view/status/?scanId=0 | jq -r '.status'\n  done\n\n  # To view the alerts of active scan\n  echo \"\"\n  curl \"http://localhost:${{ env.owaspZapApiPort }}/JSON/ascan/view/status/?scanId=0\"\n\n  # To view the alerts of active scan\n  echo \"\"\n  echo \"viewing ${{ env.maxAlerts }} alerts\"\n  curl \"http://localhost:${{ env.owaspZapApiPort }}/JSON/core/view/alerts/?baseurl=${{ env.appUrl }}&start=0&count=${{ env.maxAlerts }}\"\nfi\n\necho \"\"\necho \"generating JSON report ${{ env.owaspzap-report-json }}\"\n#curl \"http://localhost:${{ env.owaspZapApiPort }}/OTHER/core/other/jsonreport/\"\ncurl \"http://localhost:${{ env.owaspZapApiPort }}/JSON/reports/action/generate/?template=${{ env.traditionalJsonTemplate }}&title=repoTitle&reportFileName=${{ env.owaspzap-report-json }}\"\necho \"\"\necho \"contents of ${{ env.owaspzap-report-json }}\"\ndocker exec ${{ env.containerName }} cat /home/zap/${{ env.owaspzap-report-json }}\necho \"\"\necho \"generating SARIF report ${{ env.owaspzap-report-sarif }}.json\"\ncurl \"http://localhost:${{ env.owaspZapApiPort }}/JSON/reports/action/generate/?template=${{ env.sarifTemplate }}&title=repoTitle&reportFileName=${{ env.owaspzap-report-sarif }}.json\"\necho \"\"\necho \"create folder for owaspzap reports\"\nmkdir -p \"${{ runner.temp }}/owaspzap\"\necho \"\"\necho \"contents of ${{ env.owaspzap-report-sarif }}.json\"\ndocker exec ${{ env.containerName }} cat /home/zap/${{ env.owaspzap-report-sarif }}.json\necho \"\"\necho \"copying $(owaspzap-report-sarif-json) to artifact directory\"\ndocker cp \"${{ env.containerName }}:/home/zap/${{ env.owaspzap-report-json }}\" \"${{ runner.temp }}/owaspzap/${{ env.owaspzap-report-json }}\"\necho \"\"\necho \"copying ${{ env.owaspzap-report-sarif }}.json to artifact directory\"\ndocker cp \"${{ env.containerName }}:/home/zap/${{ env.owaspzap-report-sarif }}.json\" \"${{ runner.temp }}/owaspzap/${{ env.owaspzap-report-sarif }}\""
      - name: Publish OWASP ZAP Reports
        uses: actions/upload-artifact@v4.1.0
        with:
          name: CodeAnalysisLogs
          path: "${{ runner.temp }}/owaspzap"
      - name: Publish ZAP Report
        if: success() || failure()
        uses: actions/upload-artifact@v4.1.0
        with:
          name: owasp_zap_report
          path: "${{ runner.temp }}/owaspzap"
  deploy_prod-deploy_prod:
    name: Deploy To Prod K8S Cluster
    needs:
      - dast-run_integration_tests
      - dast-run_dast_scan
    runs-on: ubuntu-latest
    environment:
      name: OSS_pygoat-prod
    env:
      appUrl: http://gh-pygoat.cad4devops.com
      host: gh-pygoat.cad4devops.com
      RESOURCE_GROUP: rg-k8s-pygoat-dev-001
      CLUSTER_NAME: aks-k8s-pygoat-dev-001
      NAMESPACE: pygoat
      Pygoat_Service: pygoat-svc
      DnsResourceGroup: rg-dns-prod
      zoneName: cad4devops.com
      dnsRecordSetName: gh-pygoat
      image: ${{ vars.DOCKER_USERNAME }}.azurecr.io/devsecops-pygoat
    steps:
      - name: checkout
        uses: actions/checkout@v4.1.0
      - name: download artifact
        if: false
        uses: actions/download-artifact@v4.1.0
      - uses: actions/checkout@v4.1.0
      - uses: cschleiden/replace-tokens@v1
        with:
          tokenPrefix: "#{"
          tokenSuffix: "}#"
          files: '["${{ github.workspace }}/manifests/k8s-*.yaml"]'
        env:
          host: ${{ env.host }}
          image: ${{ env.image }}
          tag: ${{ env.tag }}
      - name: See the files
        run: |-
          cat ${{ github.workspace }}/manifests/k8s-deployment.yaml
          cat ${{ github.workspace }}/manifests/k8s-ingress.yaml
      - name: Azure login
        if: env.useAzureCliForK8s == 'true'
        uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
      - name: Create k8s namespace ${{ env.NAMESPACE }}
        if: env.useAzureCliForK8s == 'true'
        uses: azure/cli@v2
        with:
          azcliversion: latest
          inlineScript: |
            az account show
            az aks get-credentials --resource-group ${{ env.RESOURCE_GROUP }} --name ${{ env.CLUSTER_NAME }}
            az aks install-cli
            echo "Sleeping for 10 seconds - waiting for kubectl to be ready"
            sleep 10
            kubectl version --client
            kubectl get nodes
            kubectl get namespaces
            # create namespace if it does not exist
            kubectl create namespace ${{ env.NAMESPACE }} --dry-run=client -o yaml | kubectl apply -f -
      - uses: tale/kubectl-action@v1
        continue-on-error: true
        with:
          base64-kube-config: ${{ secrets.KUBE_CONFIG }}
          kubectl-version: v1.28.9
      - name: Create k8s namespace ${{ env.NAMESPACE }}
        continue-on-error: true
        run: |-
          kubectl version --client
          kubectl get nodes
          kubectl get namespaces
          # create namespace if it does not exist
          kubectl create namespace ${{ env.NAMESPACE }} --dry-run=client -o yaml | kubectl apply -f -
      - name: Install k8s manifests - namespace ${{ env.NAMESPACE }}
        if: env.useAzureCliForK8s == 'true'
        uses: azure/cli@v2
        with:
          azcliversion: latest
          inlineScript: |
            az account show
            az aks get-credentials --resource-group ${{ env.RESOURCE_GROUP }} --name ${{ env.CLUSTER_NAME }}
            az aks install-cli
            echo "Sleeping for 10 seconds - waiting for kubectl to be ready"
            sleep 10
            kubectl version --client
            # apply the manifests
            kubectl apply -f ${{ github.workspace }}/manifests/k8s-deployment.yaml -n ${{ env.NAMESPACE }}
            kubectl apply -f ${{ github.workspace }}/manifests/k8s-service.yaml -n ${{ env.NAMESPACE }}
            kubectl apply -f ${{ github.workspace }}/manifests/k8s-ingress.yaml -n ${{ env.NAMESPACE }}
            # wait for the service to be ready
            kubectl wait --for=condition=available --timeout=600s deployment.apps/pygoat-app -n ${{ env.NAMESPACE }}
      - name: Install k8s manifests - namespace ${{ env.NAMESPACE }}
        continue-on-error: true
        run: |-
          kubectl version --client
          # apply the manifests
          kubectl apply -f ${{ github.workspace }}/manifests/k8s-deployment.yaml -n ${{ env.NAMESPACE }}
          kubectl apply -f ${{ github.workspace }}/manifests/k8s-service.yaml -n ${{ env.NAMESPACE }}
          kubectl apply -f ${{ github.workspace }}/manifests/k8s-ingress.yaml -n ${{ env.NAMESPACE }}
          # wait for the service to be ready
          kubectl wait --for=condition=available --timeout=600s deployment.apps/pygoat-app -n ${{ env.NAMESPACE }}
      - name: Adjust DNS for environment
        if: env.adjustDNS == 'true'
        uses: azure/cli@v2
        with:
          azcliversion: latest
          inlineScript: |
            az account show
            az aks get-credentials --resource-group ${{ env.RESOURCE_GROUP }} --name ${{ env.CLUSTER_NAME }}
            az aks install-cli
            echo "Sleeping for 10 seconds - waiting for kubectl to be ready"
            sleep 10
            kubectl version --client
            kubectl get pods -n ${{ env.NAMESPACE }}
            kubectl get services -n ${{ env.NAMESPACE }}
            # get external IP from the service
            externalIp=$(kubectl get service ${{ env.Pygoat_Service }} -n ${{ env.NAMESPACE }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
            echo "External IP: $externalIp"
            az network dns record-set a add-record \
              -g ${{ env.DnsResourceGroup }} \
              -z ${{ env.zoneName }} \
              -n ${{ env.dnsRecordSetName }} \
              -a $externalIp
      - name: Get Resources - namespace ${{ env.NAMESPACE }}
        continue-on-error: true
        run: |-
          kubectl version --client
          kubectl get pods -n ${{ env.NAMESPACE }}
          kubectl get services -n ${{ env.NAMESPACE }}
          # get external IP from the service
          externalIp=$(kubectl get service ${{ env.Pygoat_Service }} -n ${{ env.NAMESPACE }} -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
          echo "External IP: $externalIp"