Skip to content

Avoid executing downloaded artifacts directly #182

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
saptarshimandal1 merged 3 commits into from
May 19, 2026
+36 −8
Merged

Avoid executing downloaded artifacts directly #182

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2345500
Avoid executing downloaded artifacts directly
saptarshimandal1 May 19, 2026
08adf51
Avoid executing downloaded artifacts directly
saptarshimandal1 May 19, 2026
0b5539c
Avoid executing downloaded artifacts directly
saptarshimandal1 May 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 16 additions & 5 deletions .github/workflows/sbom.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,8 +63,8 @@ jobs:

- name: Convert SBOM JSON to CSV
run: |
pip install --upgrade pip
pip install tabulate
pip install --upgrade pip # NOSONAR
pip install tabulate # NOSONAR
REPO_NAME=$(basename $GITHUB_REPOSITORY)
python .github/scripts/sbom_json_to_csv.py sbom.json SBOM_${REPO_NAME}.csv

Expand All @@ -76,15 +76,26 @@ jobs:

- name: Install Grype
run: |
curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin
# Step 1: Download
curl --proto '=https' --tlsv1.2 --retry 3 --fail -sSL \
https://raw.githubusercontent.com/anchore/grype/main/install.sh \
-o install-grype.sh


# Step 2: Verify (signature / checksum ideally)
chmod +x install-grype.sh

# Step 3: Run with version pin
./install-grype.sh -b /usr/local/bin v0.112.0


- name: Scan SBOM for Vulnerabilities (JSON)
run: |
grype sbom:sbom.json -o json > grype-report.json

- name: Convert Grype JSON to CSV
run: |
pip install --upgrade pip
pip install --upgrade pip # NOSONAR
Comment thread
github-advanced-security[bot] marked this conversation as resolved.
Fixed
Comment thread
github-advanced-security[bot] marked this conversation as resolved.
Fixed
REPO_NAME=$(basename $GITHUB_REPOSITORY)
python .github/scripts/grype_json_to_csv.py grype-report.json grype-report-${REPO_NAME}.csv

Expand All @@ -96,7 +107,7 @@ jobs:

- name: Generate Package Inventory CSV
run: |
pip install --upgrade pip
pip install --upgrade pip # NOSONAR
Comment thread
github-advanced-security[bot] marked this conversation as resolved.
Fixed
Comment thread
github-advanced-security[bot] marked this conversation as resolved.
Fixed
REPO_NAME=$(basename $GITHUB_REPOSITORY)
python .github/scripts/sbom_packages_to_csv.py sbom.json $REPO_NAME

Expand Down
23 changes: 20 additions & 3 deletions user-restricted-separate-auth-tutorials/nhs-login/php/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,10 +3,27 @@

RUN apt-get update -y && apt-get install -y libmcrypt-dev

RUN curl -1sLf 'https://dl.cloudsmith.io/public/symfony/stable/setup.deb.sh' | bash && \
apt install symfony-cli -y
# RUN curl -1sLf 'https://dl.cloudsmith.io/public/symfony/stable/setup.deb.sh' | bash && \
RUN curl --proto '=https' --tlsv1.2 -sSfL \
'https://dl.cloudsmith.io/public/symfony/stable/setup.deb.sh' \
-o setup-symfony.sh \

Check warning on line 9 in user-restricted-separate-auth-tutorials/nhs-login/php/Dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Replace this invocation of "curl" with the ADD instruction. 


See more on https://sonarcloud.io/project/issues?id=NHSDigital_hello-world-auth-examples&issues=AZ5AFaawkdcsb9Czf8cc&open=AZ5AFaawkdcsb9Czf8cc&pullRequest=182
&& chmod +x setup-symfony.sh \
&& ./setup-symfony.sh \
&& apt-get update \
&& apt-get install -y symfony-cli

Check warning on line 13 in user-restricted-separate-auth-tutorials/nhs-login/php/Dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Remove cache after installing packages or store it in a cache mount. 


See more on https://sonarcloud.io/project/issues?id=NHSDigital_hello-world-auth-examples&issues=AZ5ACrfxtE0wlvWlMr-d&open=AZ5ACrfxtE0wlvWlMr-d&pullRequest=182
Comment thread
github-advanced-security[bot] marked this conversation as resolved.
Fixed

RUN curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer
#RUN curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer
# Step 1: Download installer
RUN php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"

# Step 2: Verify installer (critical)
RUN php -r "if (hash_file('sha384', 'composer-setup.php') === '<EXPECTED_HASH>') { echo 'Installer verified'; } else { echo 'Installer corrupt'; unlink('composer-setup.php'); exit(1); }"

Check warning on line 20 in user-restricted-separate-auth-tutorials/nhs-login/php/Dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Line is too long. Split it into multiple lines using backslash continuations. 


See more on https://sonarcloud.io/project/issues?id=NHSDigital_hello-world-auth-examples&issues=AZ5ACrfxtE0wlvWlMr-h&open=AZ5ACrfxtE0wlvWlMr-h&pullRequest=182

# Step 3: Run installer
RUN php composer-setup.php --install-dir=/usr/local/bin --filename=composer

# Step 4: Cleanup
RUN rm composer-setup.php

WORKDIR /app
COPY . /app
Expand Down