MM-23524: Integrate Dependency-Check to CircleCI (#5375)

Automatic Merge

.circleci/config.yml

@@ -2,6 +2,7 @@ version: 2.1
 
 orbs:
  aws-s3: circleci/[email protected]
+ owasp: entur/[email protected]
 
 executors:
  default:
@@ -32,6 +33,59 @@ jobs:
  cd node_modules/mattermost-redux && npm i && npm run build
  - *save_cache
 
+ check-deps:
+ parameters:
+ cve_data_directory:
+ type: string
+ default: "~/.owasp/dependency-check-data"
+ working_directory: ~/mattermost/mattermost-webapp
+ executor: owasp/default
+ environment:
+ version_url: "https://jeremylong.github.io/DependencyCheck/current.txt"
+ executable_url: "https://dl.bintray.com/jeremy-long/owasp/dependency-check-VERSION-release.zip"
+ steps:
+ - checkout
+ - run:
+ name: Link dependency cache
+ command: |
+ sudo mkdir /root/mattermost
+ sudo ln -s ~/mattermost/mattermost-webapp /root/mattermost/mattermost-webapp; sudo chmod 777 /root
+ - *restore_cache
+ - run:
+ name: Adjust permissions
+ command: sudo chown -R `id -nu`:`id -ng` node_modules
+ - run:
+ name: Checkout config
+ command: cd .. && git clone https://github.com/mattermost/security-automation-config
+ - run:
+ name: Install Go
+ command: sudo apt-get update && sudo apt-get install golang
+ - owasp/with_commandline:
+ steps:
+ # Taken from https://github.com/entur/owasp-orb/blob/master/src/%40orb.yml#L349-L361
+ - owasp/generate_cache_keys:
+ cache_key: commmandline-default-cache-key-v6
+ - owasp/restore_owasp_cache
+ - run:
+ name: Update OWASP Dependency-Check Database
+ command: ~/.owasp/dependency-check/bin/dependency-check.sh --data << parameters.cve_data_directory >> --updateonly
+ - owasp/store_owasp_cache:
+ cve_data_directory: <<parameters.cve_data_directory>>
+ - run:
+ name: Run OWASP Dependency-Check Analyzer
+ command: |
+ ~/.owasp/dependency-check/bin/dependency-check.sh \
+ --data << parameters.cve_data_directory >> --format ALL --noupdate --enableExperimental \
+ --propertyfile ../security-automation-config/dependency-check/dependencycheck.properties \
+ --suppression ../security-automation-config/dependency-check/suppression.xml \
+ --suppression ../security-automation-config/dependency-check/suppression.$CIRCLE_PROJECT_REPONAME.xml \
+ --scan './**/*' || true
+ - owasp/collect_reports:
+ persist_to_workspace: false
+ - run:
+ name: Post results to Mattermost
+ command: go run ../security-automation-config/dependency-check/post_results.go
+
  lint:
  executor:
  name: default
@@ -191,6 +245,10 @@ workflows:
  untagged-build:
  jobs:
  - install
+ - check-deps:
+ context: sast-webhook
+ requires:
+ - install
  - lint:
  requires:
  - install