diff --git a/.github/workflows/pr-security.yml b/.github/workflows/pr-security.yml new file mode 100644 index 00000000..ac452d1a --- /dev/null +++ b/.github/workflows/pr-security.yml @@ -0,0 +1,59 @@ +name: PR Security Scan + +on: + pull_request: + branches: [main] + paths: + - 'backend/**/requirements*.txt' + - 'backend/**/Dockerfile' + - 'frontend/Dockerfile' + - 'k8s/**' + - '.github/workflows/**' + +jobs: + trivy-fs: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - name: Trivy scan (filesystem) + uses: aquasecurity/trivy-action@0.24.0 + with: + scan-type: fs + ignore-unfixed: true + severity: CRITICAL,HIGH + exit-code: '1' + + trivy-backend-image: + runs-on: ubuntu-latest + needs: trivy-fs + steps: + - uses: actions/checkout@v4 + + - name: Build backend product_service image + run: docker build -t prscan-product:tmp backend/product_service + + - name: Trivy scan (product_service image) + uses: aquasecurity/trivy-action@0.24.0 + with: + image-ref: prscan-product:tmp + ignore-unfixed: true + severity: CRITICAL,HIGH + exit-code: '1' + + trivy-frontend-image: + runs-on: ubuntu-latest + needs: trivy-fs + steps: + - uses: actions/checkout@v4 + + - name: Build frontend image + run: docker build -t prscan-frontend:tmp frontend + + - name: Trivy scan (frontend image) + uses: aquasecurity/trivy-action@0.24.0 + with: + image-ref: prscan-frontend:tmp + ignore-unfixed: true + severity: CRITICAL,HIGH + exit-code: '1' diff --git a/README.md b/README.md index 23009398..4d737db8 100644 --- a/README.md +++ b/README.md @@ -36,3 +36,6 @@ image: .azurecr.io/: ### 2. Update Backend Pipeline (`.github/workflows/backend-cd.yml`) & Frontend Pipeline (`.github/workflows/frontend-cd.yml`) Ensure you replace all placeholders value to actual values. + + +Changes \ No newline at end of file diff --git a/docker-compose.yml b/docker-compose.yml index ffe144c7..9b8b8c1f 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -53,9 +53,9 @@ services: - "8000:8000" environment: POSTGRES_HOST: product_db # Connects to the 'product_db' service within Docker network - AZURE_STORAGE_ACCOUNT_NAME: # Replace with your Azure Storage account name - AZURE_STORAGE_ACCOUNT_KEY: # Replace with your Azure Storage account key - AZURE_STORAGE_CONTAINER_NAME: # Replace with your Azure Storage container name + AZURE_STORAGE_ACCOUNT_NAME: rsit722stgacc # Replace with your Azure Storage account name + AZURE_STORAGE_ACCOUNT_KEY: QyxZRd8Kt2r38+Z94jGdUvWGlK2sGnN3J3nDjcJQCdNHFWEOuqAf9EFnsAgKOTL9CbeQ7mc6T8we+ASt7W9Edw== # Replace with your Azure Storage account key + AZURE_STORAGE_CONTAINER_NAME: datacontainer # Replace with your Azure Storage container name AZURE_SAS_TOKEN_EXPIRY_HOURS: 24 depends_on: product_db: diff --git a/k8s/frontend.yaml b/k8s/frontend.yaml index 1948536d..fd779006 100644 --- a/k8s/frontend.yaml +++ b/k8s/frontend.yaml @@ -18,7 +18,7 @@ spec: spec: containers: - name: frontend-container - image: durgeshsamariya.azurecr.io/frontend:latest + image: acrsit722r.azurecr.io/frontend:latest imagePullPolicy: Always ports: - containerPort: 80 diff --git a/k8s/order-service.yaml b/k8s/order-service.yaml index c9d92e4d..07f5f942 100644 --- a/k8s/order-service.yaml +++ b/k8s/order-service.yaml @@ -18,7 +18,7 @@ spec: spec: containers: - name: order-service-container - image: durgeshsamariya.azurecr.io/order_service:latest + image: acrsit722r.azurecr.io/order_service:latest imagePullPolicy: Always ports: - containerPort: 8000 diff --git a/k8s/product-service.yaml b/k8s/product-service.yaml index 0cbbd505..cbee8335 100644 --- a/k8s/product-service.yaml +++ b/k8s/product-service.yaml @@ -18,7 +18,7 @@ spec: spec: containers: - name: product-service-container - image: durgeshsamariya.azurecr.io/product_service:latest + image: acrsit722r.azurecr.io/product_service:latest imagePullPolicy: Always ports: - containerPort: 8000 diff --git a/k8s/secrets.yaml b/k8s/secrets.yaml index 5eebe1fa..49a63c4b 100644 --- a/k8s/secrets.yaml +++ b/k8s/secrets.yaml @@ -13,6 +13,6 @@ data: # Azure Storage Account Credentials for Product Service image uploads # REPLACE WITH YOUR ACTUAL BASE64 ENCODED VALUES from your Azure Storage Account # Example: echo -n 'myblobstorageaccount' | base64 - AZURE_STORAGE_ACCOUNT_NAME: "ZHVyZ2VzaHNhbWFyaXlh" + AZURE_STORAGE_ACCOUNT_NAME: "cnNpdDcyMnN0Z2FjYw==" # Example: echo -n 'your_storage_account_key_string' | base64 - AZURE_STORAGE_ACCOUNT_KEY: "aEFNQ24rbkh2cmhwSGFEaW5jSnAxNFlHaU5nTnJja2NJR05Bc3Y5VXZPUlpsblJkbkVUR3drdTREdSszblBDR3E4ZEVTVjlFNE1jMytBU3RubmZ5QVE9PQ==" + AZURE_STORAGE_ACCOUNT_KEY: "UXl4WlJkOEt0MnIzOCtaOTRqR2RVdldHbEsyc0duTjNKM25EamNKUUNkTkhGV0VPdXFBZjlFRm5zQWdLT1RMOUNiZVE3bWM2VDh3ZStBU3Q3VzlFZHc9PQ=="