This repo demonstrates how to combine multiple code scanning tools using Github Actions and Github Advanced Security.
- Fork this repository into your account
- You will need to enable Actions in this repository. Go to
Actionstab and click onI understand my workflows, go ahead and enabled thembutton. - Even though each workflow exists, you will need to approve it for your repo. On the next screen, select each workflow.
- You should see
This scheduled workflow is disabled because scheduled workflows are disabled by default in forks.warning. Click onEnable workflowbutton next to it. - Configure the following secrets for your environment
- AZURE_LOGIN_SECRET -> output from
az ad sp create-for-rbac --sdk-auth - AZURE_SERVICE_PRINCIPAL_CLIENT_ID -> Client ID from above
- AZURE_SERVICE_PRINCIPAL_CLIENT_SECRET -> Client Secret from above
- AZ_APPINSIGHTS_CONNECTION_STRING -> As per setup instructions from Microsoft.
- AZ_SUBSCRIPTION_TOKEN -> As per setup instructions from Microsoft.
- AZURE_LOGIN_SECRET -> output from
- Configure an environment titled
production_environment - Each of the workflows have been configured for manual dispatch, select these as you require and execute.
The following repos are leveraged for examples:
- terragoat
- dvna
- h3kz-security# Github-Advanced-Security-Demo
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent