From 8957ef66d5533c1acf4fa3aa36b70f12a523dd01 Mon Sep 17 00:00:00 2001
From: Juho Nurminen <juho.nurminen@mattermost.com>
Date: Tue, 26 May 2020 11:00:12 +0300
Subject: [PATCH] MM-23524: Integrate Dependency-Check into CircleCI (#4271)

* Integrate Dependency-Check into CircleCI

* Do a simple cache restore instead of npm-dependencies
---
 .circleci/config.yml | 53 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 53 insertions(+)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index df8db9b23..e793c20de 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -1,4 +1,6 @@
 version: 2.1
+orbs:
+  owasp: entur/owasp@0.0.10
 
 executors:
   android:
@@ -225,6 +227,53 @@ jobs:
           name: Check i18n
           command: make i18n-extract-ci
 
+  check-deps:
+    parameters:
+      cve_data_directory:
+        type: string
+        default: "~/.owasp/dependency-check-data"
+    working_directory: ~/mattermost-mobile
+    executor: owasp/default
+    environment:
+      version_url: "https://jeremylong.github.io/DependencyCheck/current.txt"
+      executable_url: "https://dl.bintray.com/jeremy-long/owasp/dependency-check-VERSION-release.zip"
+    steps:
+      - checkout
+      - restore_cache:
+          name: Restore npm cache
+          key: v2-npm-{{ checksum "package.json" }}-{{ arch }}
+      - run:
+          name: Checkout config
+          command: cd .. && git clone https://github.com/mattermost/security-automation-config
+      - run:
+          name: Install Go
+          command: sudo apt-get update && sudo apt-get install golang
+      - owasp/with_commandline:
+          steps:
+            # Taken from https://github.com/entur/owasp-orb/blob/master/src/%40orb.yml#L349-L361
+            - owasp/generate_cache_keys:
+                cache_key: commmandline-default-cache-key-v6
+            - owasp/restore_owasp_cache
+            - run:
+                name: Update OWASP Dependency-Check Database
+                command: ~/.owasp/dependency-check/bin/dependency-check.sh --data << parameters.cve_data_directory >> --updateonly
+            - owasp/store_owasp_cache:
+                cve_data_directory: <<parameters.cve_data_directory>>
+            - run:
+                name: Run OWASP Dependency-Check Analyzer
+                command: |
+                  ~/.owasp/dependency-check/bin/dependency-check.sh \
+                    --data << parameters.cve_data_directory >> --format ALL --noupdate --enableExperimental \
+                    --propertyfile ../security-automation-config/dependency-check/dependencycheck.properties \
+                    --suppression ../security-automation-config/dependency-check/suppression.xml \
+                    --suppression ../security-automation-config/dependency-check/suppression.$CIRCLE_PROJECT_REPONAME.xml \
+                    --scan './**/*' || true
+            - owasp/collect_reports:
+                persist_to_workspace: false
+      - run:
+          name: Post results to Mattermost
+          command: go run ../security-automation-config/dependency-check/post_results.go
+
   build-android-beta:
     executor: android
     steps:
@@ -377,6 +426,10 @@ workflows:
   build:
     jobs:
       - test
+      - check-deps:
+          context: sast-webhook
+          requires:
+            - test
 
       - build-android-release:
           context: mattermost-mobile-android-release