Merge pull request #5 from ZupIT/feature/add-pipeline

Adding pipeline workflows, makefile and templates

.github/CODEOWNERS

@@ -0,0 +1,3 @@
+# GitHub code owners
+# See https://github.com/blog/2392-introducing-code-owners
+* @wiliansilvazup @nathannascimentozup @igorreiszup @lucasbrunozup @nathanmartinszup

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,26 @@
+---
+name: Bug report
+about: Create a report to help us improve
+labels: bug
+assignees: ''
+
+---
+
+<!-- Please use this template while reporting a bug and provide as much info as possible. 
+Not doing so may result in your bug not being addressed in a timely manner. Thanks!
+-->
+
+
+**What happened**:
+
+**What you expected to happen**:
+
+**How to reproduce it (as minimally and precisely as possible)**:
+
+**Anything else we need to know?**:
+
+**Environment**:
+- Horusec version (use `horus version`):
+- Operating System:
+- Network plugin / Tool and version (if this is a network-related / tool bug):
+- Others:

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,13 @@
+---
+name: Feature request
+about: Suggest a new feature for this project
+labels: feature
+assignees: ''
+
+---
+
+<!-- Please only use this template for submitting new feature or enhancement requests -->
+
+**What would you like to be added**:
+
+**Why is this needed**:

.github/ISSUE_TEMPLATE/improvement.md

@@ -0,0 +1,13 @@
+---
+name: Improvement
+about: Suggest a improvement for this project
+labels: improvement
+assignees: ''
+---
+
+<!-- Please only use this template for submitting improvement suggesion-->
+
+**What would you like to be added**:
+
+
+**Why is this needed**:

.github/ISSUE_TEMPLATE/support_request.md

@@ -0,0 +1,26 @@
+---
+name: Support request
+about: Support request or question relating to Ritchie
+labels: support
+assignees: ''
+
+---
+
+<!--
+    Use this template when requesting support or to ask questions.
+    Please include useful information for understanding your question.
+    Thanks!
+-->
+
+
+**What happened**:
+
+**How to reproduce it (as minimally and precisely as possible)**:
+
+**Anything else we need to know?**:
+
+**Environment**:
+- Horusec version (use `horus version`):
+- Operating System:
+- Network plugin / Tool and version (if this is a network-related / tool bug):
+- Others:

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,18 @@
+<!--
+Customized from the template (https://github.com/docker/cli/blob/master/.github/PULL_REQUEST_TEMPLATE.md)
+
+Please make sure you've read and understood our contributing guidelines;
+https://github.com/ZupIT/horus-engine/blob/master/CONTRIBUTING.md
+
+Please provide the following information:
+-->
+
+**- What I did**
+
+**- How to verify it**
+
+**- Description for the changelog**
+<!--
+Write a short (one line) summary that describes the changes in this
+pull request for inclusion in the changelog:
+-->

.github/workflows/horus-engine-pipeline.yml

@@ -0,0 +1,34 @@
+name: HorusEnginePipeline
+
+on: [push]
+
+jobs:
+  fmt-lint-test-coverage:
+    name: fmt-lint-test-coverage
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set up Go 1.14
+        uses: actions/setup-go@v1
+        with:
+          go-version: 1.14
+        id: go
+      - name: Check out code
+        uses: actions/checkout@v2
+      - name: fmt
+        run: |
+          echo "==> Checking that code complies with gofmt requirements..."
+          gofmt_files=$(gofmt -l `find . -name '*.go' | grep -v vendor`)
+          echo $gofmt_files
+          if [ ! -z $gofmt_files ]; then
+              echo 'gofmt needs running on the following files:'
+              echo "$gofmt_files"
+              echo "You can use the command: \`gofmt -w \$(gofmt -l \'find . -name \'*.go\' | grep -v vendor)\` to reformat code."
+              exit 1
+          fi
+          echo "=) The project horus-cli it's OK!"
+      - name: lint
+        run: make lint
+      - name: test
+        run: make test
+      - name: coverage
+        run: make coverage

.github/workflows/security-pipeline.yml

@@ -0,0 +1,16 @@
+name: SecurityPipeline
+
+on: [push]
+
+jobs:
+  horus-security:
+    name: horus-security
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out code into the Go module directory
+        uses: actions/checkout@v2
+      - name: Running Horus Security
+        shell: bash
+        run: |
+          curl -fsSL https://horus-assets.s3.amazonaws.com/install.sh | bash
+          horus start -p="./"

CONTRIBUTING.md

@@ -0,0 +1,92 @@
+# Contributing
+
+When contributing to this repository, please first discuss the change you wish to make via issue,
+email, or any other method with the owners of this repository before making a change.
+
+Please note we have a code of conduct, please follow it in all your interactions with the project.
+
+## Pull Request Process
+
+1. Ensure any install or build dependencies are removed before the end of the layer when doing a
+   build.
+2. Update the README.md with details of changes to the interface, this includes new environment
+   variables, exposed ports, useful file locations and container parameters.
+3. Increase the version numbers in any examples files and the README.md to the new version that this
+   Pull Request would represent. The versioning scheme we use is [SemVer](http://semver.org/). You can usage [SEMVER-CLI](deployments/scripts/install-semver.sh) too.
+4. You may merge the Pull Request in once you have the sign-off of two other developers, or if you
+   do not have permission to do that, you may request the second reviewer to merge it for you.
+
+## Code of Conduct
+
+### Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as
+contributors and maintainers pledge to making participation in our project and
+our community a harassment-free experience for everyone, regardless of age, body
+size, disability, ethnicity, gender identity and expression, level of experience,
+nationality, personal appearance, race, religion, or sexual identity and
+orientation.
+
+### Our Standards
+
+Examples of behavior that contributes to creating a positive environment
+include:
+
+* Using welcoming and inclusive language
+* Being respectful of differing viewpoints and experiences
+* Gracefully accepting constructive criticism
+* Focusing on what is best for the community
+* Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery and unwelcome sexual attention or
+advances
+* Trolling, insulting/derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or electronic
+  address, without explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+### Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable
+behavior and are expected to take appropriate and fair corrective action in
+response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or
+reject comments, commits, code, wiki edits, issues, and other contributions
+that are not aligned to this Code of Conduct, or to ban temporarily or
+permanently any contributor for other behaviors that they deem inappropriate,
+threatening, offensive, or harmful.
+
+### Scope
+
+This Code of Conduct applies both within project spaces and in public spaces
+when an individual is representing the project or its community. Examples of
+representing a project or community include using an official project e-mail
+address, posting via an official social media account, or acting as an appointed
+representative at an online or offline event. Representation of a project may be
+further defined and clarified by project maintainers.
+
+### Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported by contacting the project team at "channel will be created and inserted here". All
+complaints will be reviewed and investigated and will result in a response that
+is deemed necessary and appropriate to the circumstances. The project team is
+obligated to maintain confidentiality with regard to the reporter of an incident.
+Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good
+faith may face temporary or permanent repercussions as determined by other
+members of the project's leadership.
+
+### Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
+available at [http://contributor-covenant.org/version/1/4][version]
+
+[homepage]: http://contributor-covenant.org
+[version]: http://contributor-covenant.org/version/1/4/

Makefile

@@ -0,0 +1,30 @@
+GO ?= go
+GOFMT ?= gofmt
+GOFMT_FILES?=$$(find . -name '*.go' | grep -v vendor)
+GOCILINT ?= ./bin/golangci-lint
+
+# Format all files founded in GO
+fmt:
+	$(GOFMT) -w $(GOFMT_FILES)
+
+# Run converage with threshold
+coverage:
+	deployments/scripts/coverage.sh 75
+
+# Check lint of project setup on file .golangci.yml
+lint:
+    ifeq ($(wildcard $(GOCILINT)), $(GOCILINT))
+#		$(GOCILINT) run -v --timeout=2m -c .golangci.yml ./... # not implemented lint equals of the horusec
+		$(GOCILINT) run -v --timeout=2m ./...
+    else
+		curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s v1.25.0
+#		$(GOCILINT) run -v --timeout=2m -c .golangci.yml ./...  # not implemented lint equals of the horusec
+		$(GOCILINT) run -v --timeout=2m ./...  # not implemented lint equals of the horusec
+    endif
+
+# Run all tests of project but stop the execution on the first test fail
+test:
+	$(GO) clean -testcache && $(GO) test -v ./... -timeout=2m -parallel=1 -failfast -short
+
+# Run all steps required to pass on pipeline
+pipeline: fmt lint test coverage

deployments/scripts/coverage.sh

@@ -0,0 +1,34 @@
+#!/bin/sh
+# Copyright 2020 ZUP IT SERVICOS EM TECNOLOGIA E INOVACAO SA
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+THRESHOLD=$1
+
+go clean -testcache
+go test -timeout=2m -covermode=atomic -coverprofile coverage.out ./...
+sed -i '/mock.go/d' coverage.out
+COVERAGE=$(go tool cover -func=coverage.out | grep total: | awk '{print $3}')
+COVERAGE=${COVERAGE%\%}
+
+if [ 1 -eq "$(echo $COVERAGE'>='$THRESHOLD | bc -l)" ]
+then
+    echo "SUCCESS! Coverage above threshold"
+    echo "coverage: ${COVERAGE} - threshold: ${THRESHOLD}"
+    exit 0
+fi
+
+echo "FAILS! Coverage below threshold"
+echo "coverage: ${COVERAGE} - threshold: ${THRESHOLD}"
+exit 1

engine_test.go

@@ -26,16 +26,6 @@ func (unit TestUnit) Eval(rule Rule) []Finding {
 	}
 }
 
-type AdvisoryExample struct {
-	ID string
-	Name string
-	Description string
-}
-
-func (a *AdvisoryExample) GetID() string { return a.ID }
-func (a *AdvisoryExample) GetName() string { return a.Name }
-func (a *AdvisoryExample) GetDescription() string { return a.Description }
-
 func TestRunWithTextUnits(t *testing.T) {
 	testProgram := []Unit{TestUnit{}}
 	rules := []Rule{TestRule{}}

text/file.go

@@ -122,11 +122,11 @@ func (textfile TextFile) ExtractSample(findingIndex int) string {
 	if lineIndex < len(textfile.newlineEndingIndexes) {
 		endOfPreviousLine := 0
 		if lineIndex > 0 {
-			endOfPreviousLine = textfile.newlineEndingIndexes[lineIndex - 1] + 1
+			endOfPreviousLine = textfile.newlineEndingIndexes[lineIndex-1] + 1
 		}
 		endOfCurrentLine := textfile.newlineEndingIndexes[lineIndex]
 
-		lineContent := textfile.RawString[endOfPreviousLine : endOfCurrentLine]
+		lineContent := textfile.RawString[endOfPreviousLine:endOfCurrentLine]
 
 		return strings.TrimSpace(lineContent)
 	}