From 85f4a037be783da22ef05216a1413192601379da Mon Sep 17 00:00:00 2001
From: Kjeld Schouten-Lebbing <kjeld@schouten-lebbing.nl>
Date: Thu, 22 Dec 2022 19:34:48 +0100
Subject: [PATCH] feat(docs): add initial job to generate security reports for
 Apps

---
 .github/workflows/secgen.yaml | 109 ++++++++++++++++++++++++++++++++++
 1 file changed, 109 insertions(+)
 create mode 100644 .github/workflows/secgen.yaml

diff --git a/.github/workflows/secgen.yaml b/.github/workflows/secgen.yaml
new file mode 100644
index 00000000000..a83b2452df5
--- /dev/null
+++ b/.github/workflows/secgen.yaml
@@ -0,0 +1,109 @@
+name: "Chore: Generate Security Docs"
+
+concurrency: helm-release
+
+on:
+  workflow_dispatch:
+
+jobs:
+  gen-sec:
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/truecharts/devcontainer:v3.1.1@sha256:f0ecaa533663f88346b745eb497f6f6acf63561ad88e345cd71c8280963b8c1e
+    steps:
+      - name: Install Kubernetes tools
+        uses: yokawasa/action-setup-kube-tools@b91bb02bc122bd84ac7bbea5f25ed6b0f2ec6275 # tag=v0.9.2
+        with:
+          setup-tools: |
+            helmv3
+          helm: "3.8.0"
+
+      - name: Prep Helm
+        run: |
+          helm repo add truecharts https://charts.truecharts.org
+          helm repo add truecharts-library https://library-charts.truecharts.org
+          helm repo add bitnami https://charts.bitnami.com/bitnami
+          helm repo add prometheus https://prometheus-community.github.io/helm-charts
+          helm repo update
+
+      - name: Checkout
+        uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3
+        with:
+          token: ${{ secrets.BOT_TOKEN }}
+          fetch-depth: 0
+
+      - name: Setting repo parent dir as safe safe.directory
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
+
+      - name: Checkout
+        uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3
+        with:
+          fetch-depth: 1
+          repository: truecharts/website
+          token: ${{ secrets.BOT_TOKEN }}
+          path: website
+
+      - name: Copy docs to website
+        shell: bash
+        run: |
+          helm_sec_scan() {
+              local chart="$1"
+              local chartname="$2"
+              local train="$3"
+              echo "Scanning helm security for ${chartname}"
+              mkdir -p ${chart}/render
+              rm -rf website/docs/charts/${train}/${chartname}/helm-security.md | echo "removing old sec-scan.md file failed..."
+              echo "# Security Scan" >> website/docs/charts/${train}/${chartname}/helm-security.md
+              echo "" >> website/docs/charts/${train}/${chartname}/helm-security.md
+              echo "## Helm-Chart" >> website/docs/charts/${train}/${chartname}/helm-security.md
+              echo "" >> website/docs/charts/${train}/${chartname}/helm-security.md
+              echo "##### Scan Results" >> website/docs/charts/${train}/${chartname}/helm-security.md
+              echo "" >> website/docs/charts/${train}/${chartname}/helm-security.md
+              helm template ${chart} --output-dir ${chart}/render
+              trivy config -f template --template "@./templates/trivy.tpl" ${chart}/render >> website/docs/charts/${train}/${chartname}/helm-security.md
+              echo "" >> website/docs/charts/${train}/${chartname}/helm-security.md
+              }
+          container_sec_scan() {
+              local chart="$1"
+              local chartname="$2"
+              local train="$3"
+              echo "Scanning container security for ${chartname}"
+              echo "## Containers" >> website/docs/charts/${train}/${chartname}/container-security.md
+              echo "" >> website/docs/charts/${train}/${chartname}/container-security.md
+              echo "##### Detected Containers" >> website/docs/charts/${train}/${chartname}/container-security.md
+              echo "" >> website/docs/charts/${train}/${chartname}/container-security.md
+              find ${chart}/render/ -name '*.yaml' -type f -exec cat {} \; | grep image: | sed "s/image: //g" | sed "s/\"//g" >> ${chart}/render/containers.tmp
+              cat ${chart}/render/containers.tmp >> website/docs/charts/${train}/${chartname}/container-security.md
+              echo "" >> website/docs/charts/${train}/${chartname}/container-security.md
+              echo "##### Scan Results" >> website/docs/charts/${train}/${chartname}/container-security.md
+              echo "" >> website/docs/charts/${train}/${chartname}/container-security.md
+              for container in $(cat ${chart}/render/containers.tmp); do
+                echo "**Container: ${container}**" >> website/docs/charts/${train}/${chartname}/container-security.md
+                echo "" >> website/docs/charts/${train}/${chartname}/container-security.md
+                ghcrcont=$(echo ${container} | sed "s/tccr.io/ghcr.io/g")
+                trivy image -f template --template "@./templates/trivy.tpl" ${ghcrcont} >> website/docs/charts/${train}/${chartname}/container-security.md
+                echo "" >> website/docs/charts/${train}/${chartname}/container-security.md
+                done
+          
+              }
+          for train in stable SCALE incubator games enterprise develop non-free deprecated dependency core; do
+            for chart in charts/${train}/*; do
+              if [ -d "${chart}" ]; then
+          	    chartname="$(basename "$(dirname "$path")")"
+		        helm_sec_scan ${chart} ${chartname} ${train}
+          	    #container_sec_scan ${chart} ${chartname} ${train}
+              fi
+            done
+          done
+
+      - name: Commit Website Changes
+        if: |
+          steps.collect-changes.outputs.changesDetected == 'true'
+        run: |
+          cd website
+          git config user.name "TrueCharts-Bot"
+          git config user.email "bot@truecharts.org"
+          git add --all
+          git commit -sm "Commit released docs for TrueCharts" || exit 0
+          git push
+