From 3573788ed5716a3fe133b1d64a32abda0caab4c4 Mon Sep 17 00:00:00 2001 From: Siddhi Kotak Date: Thu, 8 Oct 2026 12:17:38 +0530 Subject: [PATCH 1/4] chore: update RL scanner to use centralized devsecops-tooling action --- .github/actions/rl-scanner/action.yml | 71 --------------------------- .github/workflows/release.yml | 47 +++++++++++++----- .github/workflows/rl-secure.yml | 67 ------------------------- examples/users-api/.env.sample | 2 +- 4 files changed, 37 insertions(+), 150 deletions(-) delete mode 100644 .github/actions/rl-scanner/action.yml delete mode 100644 .github/workflows/rl-secure.yml diff --git a/.github/actions/rl-scanner/action.yml b/.github/actions/rl-scanner/action.yml deleted file mode 100644 index 3474a59b..00000000 --- a/.github/actions/rl-scanner/action.yml +++ /dev/null @@ -1,71 +0,0 @@ -name: 'Reversing Labs Scanner' -description: 'Runs the Reversing Labs scanner on a specified artifact.' -inputs: - artifact-path: - description: 'Path to the artifact to be scanned.' - required: true - version: - description: 'Version of the artifact.' - required: true - -runs: - using: 'composite' - steps: - - name: Set up Python - uses: actions/setup-python@v4 - with: - python-version: '3.10' - - - name: Install Python dependencies - shell: bash - run: | - pip install boto3 requests - - - name: Configure AWS credentials - uses: aws-actions/configure-aws-credentials@v1 - with: - role-to-assume: ${{ env.PRODSEC_TOOLS_ARN }} - aws-region: us-east-1 - mask-aws-account-id: true - - - name: Install RL Wrapper - shell: bash - run: | - pip install rl-wrapper --index-url "https://${{ env.PRODSEC_TOOLS_USER }}:${{ env.PRODSEC_TOOLS_TOKEN }}@a0us.jfrog.io/artifactory/api/pypi/python/simple" - - - name: Run RL Scanner - shell: bash - env: - RLSECURE_LICENSE: ${{ env.RLSECURE_LICENSE }} - RLSECURE_SITE_KEY: ${{ env.RLSECURE_SITE_KEY }} - SIGNAL_HANDLER_TOKEN: ${{ env.SIGNAL_HANDLER_TOKEN }} - PYTHONUNBUFFERED: 1 - run: | - if [ ! -f "${{ inputs.artifact-path }}" ]; then - echo "Artifact not found: ${{ inputs.artifact-path }}" - exit 1 - fi - - rl-wrapper \ - --artifact "${{ inputs.artifact-path }}" \ - --name "${{ github.event.repository.name }}" \ - --version "${{ inputs.version }}" \ - --repository "${{ github.repository }}" \ - --commit "${{ github.sha }}" \ - --build-env "github_actions" \ - --suppress-output - - # Check the outcome of the scanner - if [ $? -ne 0 ]; then - echo "RL Scanner failed." - echo "scan-status=failed" >> $GITHUB_ENV - exit 1 - else - echo "RL Scanner passed." - echo "scan-status=success" >> $GITHUB_ENV - fi - -outputs: - scan-status: - description: 'The outcome of the scan process.' - value: ${{ env.scan-status }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 2294779a..3716361f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -3,6 +3,7 @@ name: Create npm and GitHub Release on: pull_request: types: + - opened - closed workflow_dispatch: permissions: @@ -15,17 +16,41 @@ permissions: jobs: rl-scanner: - uses: ./.github/workflows/rl-secure.yml - with: - node-version: 22 - artifact-name: 'auth0-react.tgz' - secrets: - RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }} - RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }} - SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }} - PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }} - PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }} - PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }} + name: Run Reversing Labs Scanner + if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.action == 'opened' && github.event.pull_request.head.ref == 'chore/rl-scanner-update') + runs-on: ubuntu-latest + + steps: + - name: Checkout code + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + fetch-depth: 0 + + - name: Build package + uses: ./.github/actions/build + with: + node: 22 + + - name: Create tgz build artifact + run: tar -czvf auth0-react.tgz * + + - id: get_version + uses: ./.github/actions/get-version + + - name: Run RL Scanner + uses: auth0/devsecops-tooling/.github/actions/rl-scan@main + with: + artifact-name: 'auth0-react' + artifact-path: '${{ github.workspace }}/auth0-react.tgz' + version: ${{ steps.get_version.outputs.version }} + RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }} + RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }} + SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }} + SIGNAL_HANDLER_DOMAIN: ${{ secrets.SIGNAL_HANDLER_DOMAIN }} + PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }} + PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }} + PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }} + PRODSEC_PYTHON_TOOLS_REPO: ${{ secrets.PRODSEC_PYTHON_TOOLS_REPO }} release: uses: ./.github/workflows/npm-release.yml needs: rl-scanner diff --git a/.github/workflows/rl-secure.yml b/.github/workflows/rl-secure.yml deleted file mode 100644 index 1c4b2f35..00000000 --- a/.github/workflows/rl-secure.yml +++ /dev/null @@ -1,67 +0,0 @@ -name: RL-Secure Workflow - -on: - workflow_call: - inputs: - node-version: - required: true - type: string - artifact-name: - required: true - type: string - secrets: - RLSECURE_LICENSE: - required: true - RLSECURE_SITE_KEY: - required: true - SIGNAL_HANDLER_TOKEN: - required: true - PRODSEC_TOOLS_USER: - required: true - PRODSEC_TOOLS_TOKEN: - required: true - PRODSEC_TOOLS_ARN: - required: true - -jobs: - rl-scanner: - name: Run Reversing Labs Scanner - if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'release/')) - runs-on: ubuntu-latest - outputs: - scan-status: ${{ steps.rl-scan-conclusion.outcome }} - - steps: - - name: Checkout code - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - fetch-depth: 0 - - - name: Build package - uses: ./.github/actions/build - with: - node: ${{ inputs.node-version }} - - - name: Create tgz build artifact - run: | - tar -czvf ${{ inputs.artifact-name }} * - - - id: get_version - uses: ./.github/actions/get-version - - - name: Run RL Scanner - id: rl-scan-conclusion - uses: ./.github/actions/rl-scanner - with: - artifact-path: "$(pwd)/${{ inputs.artifact-name }}" - version: "${{ steps.get_version.outputs.version }}" - env: - RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }} - RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }} - SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }} - PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }} - PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }} - PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }} - - - name: Output scan result - run: echo "scan-status=${{ steps.rl-scan-conclusion.outcome }}" >> $GITHUB_ENV diff --git a/examples/users-api/.env.sample b/examples/users-api/.env.sample index 8c05dfbf..bbfbeab5 100644 --- a/examples/users-api/.env.sample +++ b/examples/users-api/.env.sample @@ -1,3 +1,3 @@ -DOMAIN=your-tenant.auth0.com +DOMAIN=siddhi-kotak.auth0.com AUDIENCE=https://api.example.com/users PORT=3001 From 40641c94adbe2f49193a9346dff374ab56c2ff76 Mon Sep 17 00:00:00 2001 From: Siddhi Kotak Date: Thu, 8 Oct 2026 12:25:57 +0530 Subject: [PATCH 2/4] chore: update release job condition for testing --- .github/workflows/release.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3716361f..22aa2b6d 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -52,6 +52,7 @@ jobs: PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }} PRODSEC_PYTHON_TOOLS_REPO: ${{ secrets.PRODSEC_PYTHON_TOOLS_REPO }} release: + if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'release/')) uses: ./.github/workflows/npm-release.yml needs: rl-scanner with: From 10d18f7a84e20c0fc7cff77dfef1525ec11f3b9e Mon Sep 17 00:00:00 2001 From: Siddhi Kotak <40738712+siddhikotak@users.noreply.github.com> Date: Thu, 8 Oct 2026 12:49:38 +0530 Subject: [PATCH 3/4] Update DOMAIN in .env.sample for configuration Signed-off-by: Siddhi Kotak <40738712+siddhikotak@users.noreply.github.com> --- examples/users-api/.env.sample | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/examples/users-api/.env.sample b/examples/users-api/.env.sample index bbfbeab5..8c05dfbf 100644 --- a/examples/users-api/.env.sample +++ b/examples/users-api/.env.sample @@ -1,3 +1,3 @@ -DOMAIN=siddhi-kotak.auth0.com +DOMAIN=your-tenant.auth0.com AUDIENCE=https://api.example.com/users PORT=3001 From ddb0c4f8b1a6e6ff485626c2a6b2b534be586d36 Mon Sep 17 00:00:00 2001 From: Siddhi Kotak Date: Thu, 8 Oct 2026 12:54:28 +0530 Subject: [PATCH 4/4] chore: update release workflow conditions for RL scanner --- .github/workflows/release.yml | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 22aa2b6d..c0728c2e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -3,7 +3,6 @@ name: Create npm and GitHub Release on: pull_request: types: - - opened - closed workflow_dispatch: permissions: @@ -17,7 +16,7 @@ permissions: jobs: rl-scanner: name: Run Reversing Labs Scanner - if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.action == 'opened' && github.event.pull_request.head.ref == 'chore/rl-scanner-update') + if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'release/')) runs-on: ubuntu-latest steps: @@ -52,7 +51,6 @@ jobs: PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }} PRODSEC_PYTHON_TOOLS_REPO: ${{ secrets.PRODSEC_PYTHON_TOOLS_REPO }} release: - if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'release/')) uses: ./.github/workflows/npm-release.yml needs: rl-scanner with: