issues.yml

# An example workflow using the NowSecure Issues action.
# This action is run each time a commit is pushed to the "main" branch,
# on pull requests or the workflow is manually triggered
#
# This workflow builds an Android application saving the output apk as
# an artifact in the "build" phase.
#
# In the "scan" phase the apk is uploaded to NowSecure, generating a
# report.
#
# In the "issues" phase the report is downloaded from NowSecure and
# issues are generated for findings that match the filter criteria
# (which can be overridden in .nsconfig.yml)
#
# In the CI/CD config:
# - Set the NS_TOKEN secret to a NowSecure Api token for your NowSecure user
# - Set the NS_GROUP_ID secret to the id of the group to which the
#      application should be added.

name: "NowSecure"

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  workflow_dispatch:
    branches: [main]

env:
  # Name of the output file from the build stage without a path
  # defined as a var since it's used more than once.
  BUILD_OUTPUT_NAME: "app-insecure-debug.apk"

jobs:
  # EXAMPLE: Build and upload an Android application to GH artifacts.
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v2

      - name: Install Java
        uses: actions/setup-java@v2
        with:
          java-version: "11"
          distribution: "adopt"
          cache: "gradle"

      - name: Validate Gradle wrapper
        uses: gradle/wrapper-validation-action@v1

      - name: Build application
        run: ./gradlew assembleDebug --stacktrace --no-daemon

      - name: Upload application
        uses: actions/upload-artifact@v2
        with:
          name: app
          path: ./app/build/outputs/apk/insecure/debug/${{ env.BUILD_OUTPUT_NAME }}
          retention-days: 3

  # Scan the Android application with NowSecure.
  scan:
    runs-on: ubuntu-latest
    outputs:
      report_id: ${{ steps.upload.outputs.report_id }}
    needs: build
    steps:
      - name: Checkout repository
        uses: actions/checkout@v2

      # NOTE: ripgrep is required for line-of-code identification.
      - name: Install ripgrep
        run: sudo apt-get install -y ripgrep

      - name: Download application
        uses: actions/download-artifact@v2
        with:
          name: app

      - id: upload
        name: NowSecure upload app
        uses: nowsecure/nowsecure-action/upload-app@v3
        with:
          platform_token: ${{ secrets.NS_TOKEN }}
          group_id: ${{ secrets.NS_GROUP_ID }}
          app_file: ${{ env.BUILD_OUTPUT_NAME }}

  issues:
    needs: scan
    if: ${{ needs.scan.outputs.report_id }}
    runs-on: ubuntu-latest
    permissions: write-all
    steps:
      - name: Checkout repository
        uses: actions/checkout@v2

      # create issues. Uses the defaults: create issues in the current
      # repository and assign them to the repository owner
      - id: createIssues
        uses: nowsecure/nowsecure-action/create-issues@v3
        timeout-minutes: 60
        with:
          report_id: ${{ needs.scan.outputs.report_id }}
          platform_token: ${{ secrets.NS_TOKEN }}
          config: "issues"