OpenSSF Scorecard

OpenSSF Scorecard is one of the initiative from Open Source Security Foundation or OpenSSF. It is a tool to provide quick access to opensource projects for any risky practices via automated checks.

To run the checks, there are 2 ways:

1. Run automatically on code you own using the GitHub Action
2. Run manually on your (or somebody else’s) project via the Command Line
   

Scorecard checks for vulnerabilities affecting different parts of the software chain including source code, build, dependencies, testing, and project maintenance.

Links:

• OpenSSF Scorecard
  

Learn CI/CD Pipeline with Jenkins

Jenkins is an open source automation server which makes it easier to build, test, and deploy software.

Jenkins can help developers automate their software development process and improve their productivity. It can also help users obtain a fresh build of their software project more easily. Jenkins is an important tool for creating a DevOps pipeline.

A DevOps pipeline is a set of processes and tools that enable the continuous delivery of software applications. The term "DevOps" is a combination of the words "development" and "operations." DevOps pipelines are used to automate the build, test, and deploy phases of the software development life cycle.

Watch the full course below or on the freeCodeCamp.org YouTube channel (1-hour watch).

Here are all the sections covered in this course:

•     Course Overview
•     What is Jenkins?
•     Terms & Definitions
•     Project Architecture
•     Linode Intro
•     Setting Up Jenkins
•     Tour of Jenkins Interface
•     Installing Plugins
•     Blue Ocean
•     Creating a Pipeline
•     Installing Git
•     Jenkinsfile
•     Updating a Pipeline
•     Jenkins with nom
•     Docker & Dockerhub
•     Closing Remarks

 

GitHub Actions is another CI/CD tool (similar to Jenkins) for the GitHub flow. You can use it to integrate and deploy code changes to a third-party cloud application platform as well as test, track, and manage code changes. GitHub Actions also supports third-party CI/CD tools, the container platform Docker, and other automation platforms.

Links:

• https://alternativeto.net/software/jenkins/
• https://blog.bitsrc.io/github-actions-or-jenkins-making-the-right-choice-for-you-9ac774684c8
  

GitHub Actions + Nuclei

This is a demo on using GitHub Action and Nuclei to protect your CI. It also includes how an attacker can leverage GHA to mine cryptocurrencies, pivot into other targets, and distribute backdoors into different repositories. 

Links:

• GHA Runners - Security In Action
  
• Nuclei - Community Powered Vulnerability Scanner
  

GHA Runners - Security In Action

An excellent write up, from Magno Logan, about the GitHub Actions (GHA), one of the commonly used CI tools today.

This article covers some security risks and best practices about using GHA as your primary CI tool.

About GitHub Actions (GHA)

GitHub Actions released in 2019. Working as CI tools, tt helps developers automate tasks within the software development life cycle (SDLC). One advantage of GHA is that developers do not need a separate CI tool but executes the workflow directly from GitHub. 

Actions are formed by a set of components. These are the six main components of a GHA:

• Workflows: Automated procedure added to the repository, and is the actual Action itself
• Events: An activity that triggers a workflow; these can be based on events such as push or pull requests, but they can also be scheduled using the crontab syntax
• Jobs: A group of one or more steps that are executed inside a runner
• Steps: These are tasks from a job that can be used to run commands
• Actions: The standalone commands from the steps
• Runners: A server that has the GHA runner application installed

 

The full article contains many more information including:

1. GitHub Actions (GHA) and its components
2. GitHub Action (GHA) runners
3. Cryptomining with GitHub Actions
4. Ubuntu Runner reconnaissance
5. Scanning for vulnerabilities
6. Setting up a reverse shell with Netcat and more
7. The Mono Web Server XSP
8. Scanning other runners
9. Conclusions and recommendations
10. Trend Micro solutions
    

GitHub Action Runners

Links:

• GitHub Action Runners - Analyzing the Environment and Security in Action