mirror of
https://github.com/BagelHole/DevOps-Security-Agent-Skills.git
synced 2026-08-22 12:49:53 +02:00
82 lines
2.2 KiB
Bash
82 lines
2.2 KiB
Bash
#!/bin/bash
|
|
# Repository Vulnerability Scanner
|
|
# Scans for vulnerabilities in dependencies and IaC
|
|
# Usage: ./scan-repo.sh [directory] [--output report.json]
|
|
|
|
set -euo pipefail
|
|
|
|
SCAN_DIR="${1:-.}"
|
|
OUTPUT="${2:-}"
|
|
|
|
echo "========================================="
|
|
echo "Repository Security Scan"
|
|
echo "Directory: $SCAN_DIR"
|
|
echo "========================================="
|
|
echo ""
|
|
|
|
ISSUES_FOUND=0
|
|
|
|
# Trivy filesystem scan
|
|
if command -v trivy &>/dev/null; then
|
|
echo "=== Trivy Filesystem Scan ==="
|
|
trivy fs "$SCAN_DIR" \
|
|
--severity HIGH,CRITICAL \
|
|
--scanners vuln,secret,config \
|
|
--ignore-unfixed \
|
|
|| ISSUES_FOUND=1
|
|
echo ""
|
|
fi
|
|
|
|
# Check for secrets with gitleaks
|
|
if command -v gitleaks &>/dev/null; then
|
|
echo "=== GitLeaks Secret Scan ==="
|
|
gitleaks detect --source "$SCAN_DIR" --no-git || ISSUES_FOUND=1
|
|
echo ""
|
|
fi
|
|
|
|
# Check Terraform with tfsec
|
|
if command -v tfsec &>/dev/null && [ -d "$SCAN_DIR" ]; then
|
|
if find "$SCAN_DIR" -name "*.tf" -print -quit | grep -q .; then
|
|
echo "=== TFSec Terraform Scan ==="
|
|
tfsec "$SCAN_DIR" --minimum-severity HIGH || ISSUES_FOUND=1
|
|
echo ""
|
|
fi
|
|
fi
|
|
|
|
# Check Kubernetes manifests with kubesec
|
|
if command -v kubesec &>/dev/null; then
|
|
for manifest in $(find "$SCAN_DIR" -name "*.yaml" -o -name "*.yml" 2>/dev/null | head -10); do
|
|
if grep -q "kind:" "$manifest" 2>/dev/null; then
|
|
echo "=== Kubesec: $manifest ==="
|
|
kubesec scan "$manifest" 2>/dev/null || true
|
|
fi
|
|
done
|
|
fi
|
|
|
|
# Python dependencies
|
|
if [ -f "$SCAN_DIR/requirements.txt" ]; then
|
|
if command -v pip-audit &>/dev/null; then
|
|
echo "=== Python Dependency Audit ==="
|
|
pip-audit -r "$SCAN_DIR/requirements.txt" || ISSUES_FOUND=1
|
|
echo ""
|
|
fi
|
|
fi
|
|
|
|
# Node.js dependencies
|
|
if [ -f "$SCAN_DIR/package.json" ]; then
|
|
if command -v npm &>/dev/null; then
|
|
echo "=== NPM Audit ==="
|
|
(cd "$SCAN_DIR" && npm audit --audit-level=high 2>/dev/null) || ISSUES_FOUND=1
|
|
echo ""
|
|
fi
|
|
fi
|
|
|
|
echo "========================================="
|
|
if [ $ISSUES_FOUND -eq 1 ]; then
|
|
echo "⚠ Security issues found - review above"
|
|
exit 1
|
|
else
|
|
echo "✓ No critical security issues found"
|
|
fi
|
|
echo "========================================="
|