Skip to content

Commit 28105e5

Browse files
douzdouz
committed
Initial release
0 parents  commit 28105e5

13 files changed

+631
-0
lines changed

‎.github/workflows/build-image.yml

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
---
2+
name: Build and publish image to Github Packages
3+
on:
4+
release:
5+
types:
6+
- published
7+
workflow_dispatch:
8+
9+
jobs:
10+
publish-wp-scanner-action-image:
11+
runs-on: ubuntu-latest
12+
13+
steps:
14+
# Checkout repository
15+
- name: Checkout repository
16+
uses: actions/checkout@v3
17+
with:
18+
ref: ${{ github.ref }}
19+
20+
- name: Login to Github Packages
21+
uses: docker/login-action@v3
22+
with:
23+
registry: ghcr.io
24+
username: ${{ github.actor }}
25+
password: ${{ secrets.GITHUB_TOKEN }}
26+
27+
- name: Generate Docker metadata
28+
id: meta
29+
uses: docker/metadata-action@v5
30+
with:
31+
images: ghcr.io/${{ github.repository }}
32+
tags: |
33+
type=semver,pattern={{raw}}
34+
type=semver,pattern={{major}}
35+
type=semver,pattern={{version}}
36+
type=sha
37+
type=raw,enable=true,value=latest
38+
39+
- name: Set up Docker Buildx
40+
uses: docker/setup-buildx-action@v3
41+
42+
- name: Build and push
43+
uses: docker/build-push-action@v5
44+
with:
45+
context: image
46+
push: true
47+
tags: ${{ steps.meta.outputs.tags }}

‎.github/workflows/release-tag-major-version.yml

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
---
2+
name: Tag major version on release
3+
on:
4+
release:
5+
types:
6+
- published
7+
8+
jobs:
9+
tag-release:
10+
runs-on: ubuntu-latest
11+
12+
steps:
13+
# Checkout repository
14+
- name: Checkout repository
15+
uses: actions/checkout@v3
16+
with:
17+
fetch-depth: 0
18+
19+
- name: Tag release with vX tag
20+
shell: bash
21+
run: |
22+
RELEASE_NAME="${GITHUB_REF#refs/tags/}"
23+
echo "Release name: ${RELEASE_NAME}"
24+
if [[ "${RELEASE_NAME}" =~ ^(v[0-9]+)[.] ]]; then
25+
RELEASE_TAG_SHORT="${BASH_REMATCH[1]}"
26+
echo "Release tag short: ${RELEASE_TAG_SHORT}"
27+
# Git config
28+
git config --local user.name 10upbot
29+
git config --local user.email [email protected]
30+
# Create tag locally
31+
git tag -f -a "${RELEASE_TAG_SHORT}" -m "Automated GitHub Actions release: ${RELEASE_TAG_SHORT}"
32+
# Delete remote tag
33+
git push origin :refs/tags/"${RELEASE_TAG_SHORT}"
34+
# Push tag to remote
35+
git push origin "${RELEASE_TAG_SHORT}"
36+
else
37+
echo "Release name does not match vX pattern: ${RELEASE_NAME}"
38+
echo "Nothing to do!"
39+
fi

‎.github/workflows/tests.yml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
---
2+
name: Shellcheck test
3+
4+
on:
5+
push:
6+
branches:
7+
- '**'
8+
- '!trunk'
9+
10+
jobs:
11+
shellcheck:
12+
runs-on: ubuntu-latest
13+
14+
steps:
15+
# Checkout repository
16+
- name: Checkout repository
17+
uses: actions/checkout@v3
18+
with:
19+
ref: ${{ github.ref }}
20+
21+
- name: shellcheck
22+
uses: ludeeus/action-shellcheck@master

‎.gitignore

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# Ignore temporary OS files
2+
.DS_Store
3+
.DS_Store?
4+
.Spotlight-V100
5+
.Trashes

‎CHANGELOG.md

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# Changelog
2+
3+
All notable changes to this project will be documented in this file, per [the Keep a Changelog standard](http://keepachangelog.com/).
4+
5+
## [v1.0.0] - 2024-07-19
6+
7+
### Added
8+
9+
- Initial action release

‎CODE_OF_CONDUCT.md

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
# Contributor Covenant Code of Conduct
2+
3+
## Our Pledge
4+
5+
In the interest of fostering an open and welcoming environment, we as
6+
contributors and maintainers pledge to making participation in our project and
7+
our community a harassment-free experience for everyone, regardless of age, body
8+
size, disability, ethnicity, sex characteristics, gender identity and expression,
9+
level of experience, education, socio-economic status, nationality, personal
10+
appearance, race, religion, or sexual identity and orientation.
11+
12+
## Our Standards
13+
14+
Examples of behavior that contributes to creating a positive environment
15+
include:
16+
17+
* Using welcoming and inclusive language
18+
* Being respectful of differing viewpoints and experiences
19+
* Gracefully accepting constructive criticism
20+
* Focusing on what is best for the community
21+
* Showing empathy towards other community members
22+
23+
Examples of unacceptable behavior by participants include:
24+
25+
* The use of sexualized language or imagery and unwelcome sexual attention or
26+
advances
27+
* Trolling, insulting/derogatory comments, and personal or political attacks
28+
* Public or private harassment
29+
* Publishing others' private information, such as a physical or electronic
30+
address, without explicit permission
31+
* Other conduct which could reasonably be considered inappropriate in a
32+
professional setting
33+
34+
## Our Responsibilities
35+
36+
Project maintainers are responsible for clarifying the standards of acceptable
37+
behavior and are expected to take appropriate and fair corrective action in
38+
response to any instances of unacceptable behavior.
39+
40+
Project maintainers have the right and responsibility to remove, edit, or
41+
reject comments, commits, code, wiki edits, issues, and other contributions
42+
that are not aligned to this Code of Conduct, or to ban temporarily or
43+
permanently any contributor for other behaviors that they deem inappropriate,
44+
threatening, offensive, or harmful.
45+
46+
## Scope
47+
48+
This Code of Conduct applies both within project spaces and in public spaces
49+
when an individual is representing the project or its community. Examples of
50+
representing a project or community include using an official project e-mail
51+
address, posting via an official social media account, or acting as an appointed
52+
representative at an online or offline event. Representation of a project may be
53+
further defined and clarified by project maintainers.
54+
55+
## Enforcement
56+
57+
Instances of abusive, harassing, or otherwise unacceptable behavior may be
58+
reported by contacting the project team at [email protected]. All
59+
complaints will be reviewed and investigated and will result in a response that
60+
is deemed necessary and appropriate to the circumstances. The project team is
61+
obligated to maintain confidentiality with regard to the reporter of an incident.
62+
Further details of specific enforcement policies may be posted separately.
63+
64+
Project maintainers who do not follow or enforce the Code of Conduct in good
65+
faith may face temporary or permanent repercussions as determined by other
66+
members of the project's leadership.
67+
68+
## Attribution
69+
70+
This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
71+
available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
72+
73+
[homepage]: https://www.contributor-covenant.org
74+
75+
For answers to common questions about this code of conduct, see
76+
https://www.contributor-covenant.org/faq

‎CONTRIBUTING.md

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Contributing and Maintaining
2+
3+
First, thank you for taking the time to contribute!
4+
5+
The following is a set of guidelines for contributors as well as information and instructions around our maintenance process. The two are closely tied together in terms of how we all work together and set expectations, so while you may not need to know everything in here to submit an issue or pull request, it's best to keep them in the same document.
6+
7+
## Ways to contribute
8+
9+
Contributing isn't just writing code - it's anything that improves the project. All contributions are managed right here on GitHub. Here are some ways you can help:
10+
11+
### Reporting bugs
12+
13+
If you're running into an issue, please take a look through [existing issues](https://github.com/10up/wp-scanner-action/issues) and [open a new one](https://github.com/10up/wp-scanner-action/issues/new) if needed. If you're able, include steps to reproduce, environment information, and screenshots/screencasts as relevant.
14+
15+
### Suggesting enhancements
16+
17+
New features and enhancements are also managed via [issues](https://github.com/10up/wp-scanner-action/issues).
18+
19+
### Pull requests
20+
21+
Pull requests represent a proposed solution to a specified problem. They should always reference an issue that describes the problem and contains discussion about the problem itself. Discussion on pull requests should be limited to the pull request itself, i.e. code review.
22+
23+
For more on how 10up writes and manages code, check out our [10up Engineering Best Practices](https://10up.github.io/Engineering-Best-Practices/).

‎CREDITS.md

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# Credits
2+
3+
The following acknowledges the Maintainers for this repository, those who have Contributed to this repository (via bug reports, code, design, ideas, project management, translation, testing, etc.).
4+
5+
## Maintainers
6+
7+
The following individuals are responsible for curating the list of issues, responding to pull requests, and ensuring regular releases happen.
8+
9+
[Douglas Barahona(@douz)](https://github.com/douz)

‎README.md

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
# WordPress Scanner Action
2+
3+
> Performs syntax checks, virus scanning and plugins and themes vulnerability checks for WordPress sites
4+
5+
[![Support Level](https://img.shields.io/badge/support-active-green.svg)](#support-level) [![Release Version](https://img.shields.io/github/release/10up/wp-scanner-action.svg)](https://github.com/10up/wp-scanner-action/releases/latest) [![GPLv3 License](https://img.shields.io/badge/License-GPL%20v3-yellow.svg)](https://github.com/10up/wp-scanner-action/blob/trunk/LICENSE) [![Automated Tests](https://github.com/10up/wp-scanner-action/actions/workflows/test.yml/badge.svg)](https://github.com/10up/wp-scanner-action/actions/workflows/test.yml)
6+
7+
This Github Action performs standard scanning for WordPress sites which includes PHP syntax checks, virus scanning and plugins and themes vulnerabilities scanning.
8+
9+
# API Access
10+
11+
This Action leverages our own [WP-CLI Vulnerability Scanner](https://github.com/10up/wpcli-vulnerability-scanner) to perform the known vulnerabilities scanning of WordPress plugins and themes. WP-CLI Vulnerability Scanner works with [WPScan](https://wpscan.com), [Patchstack](https://patchstack.com/) and [Wordfence Intelligence](https://www.wordfence.com/threat-intel/) to check reported vulnerabilities; you can choose any one of these three to use.
12+
***Note**: Authentication is optional for the Wordfence Intelligence Vulnerability API.*
13+
14+
# Inputs
15+
16+
| Name | Required | Default | Description |
17+
| --- | --- | --- | --- |
18+
| `vuln_api_provider` | True | - | The vulnerability API provider for the WordPress plugins and themes scanning. Supported values: `wordfence`, `patchstack` and `wpscan` |
19+
| `vuln_api_token` | False | - | The API token to authenticate against the vulnerability API provider. This input is optional if `vuln_api_provider` is set to `wordfence` |
20+
| `disable_vuln_scan` | False | `false` | Disable the WordPress plugins and themes vulnerability scanner |
21+
| `virus_scan_update` | False | `true` | Update the ClamAV definitions database before executing the virus scanner (recommended) |
22+
| `disable_virus_scan` | False | `false` | Disable the ClamAV virus scanner |
23+
| `phpsyntax_enable_debug` | False | `false` | The PHP syntax checks could generate a large output depending on the amount of PHP files in the repository, for this reason the output is suppresed by default. Set this input to `true` if you want to visualize the full output. Useful for troubleshooting in case the PHP syntax checks fails |
24+
| `disable_phpsyntax_check` | False | `false` | Disable the PHP syntax checks |
25+
| `content_dir` | False | `$GITHUB_WORKSPACE` | Location of the `wp-content` directory inside the repository. Set this input to `./` if you have a `wp-content` based repository |
26+
| `wp_core_version` | False | `latest` | WordPress core version to use for the plugins and themes vulnerability scanner. Must match the version of your WordPress site for better results |
27+
| `composer_build` | False | `false` | Install the Composer dependencies in your `composer.json` file before executing the WordPress plugins and themes vulnerability scanner. The `composer.json` file must exists in the repository's root directory. Set this input to `true` if you install plugins and themes via Composer in CI. ***Note: This won't affect your final deploy artifact*** |
28+
| `no_fail` | False | `false` | Exits the scanner without failing even if any issues are found |
29+
30+
31+
# Examples
32+
33+
## Install Composer dependencies before scanning
34+
35+
This example assumes that you have a `wp-content` based repository and uses [Patchstack](https://patchstack.com/) as the API provider.
36+
37+
```yaml
38+
name: "PHP Syntax Check, virus scanning, and WP Plugins & Themes vulnerability scanning"
39+
40+
on:
41+
push:
42+
branches:
43+
- '**'
44+
45+
jobs:
46+
wp-scanner:
47+
runs-on: ubuntu-latest
48+
49+
steps:
50+
- name: Checkout code
51+
uses: actions/checkout@v4
52+
with:
53+
ref: ${{ github.ref }}
54+
55+
- name: WordPress Scanner
56+
uses: 10up/wp-scanner-action@v1
57+
with:
58+
vuln_api_provider: 'patchstack'
59+
vuln_api_token: ${{ secrets.PATCHSTACK_TOKEN }}
60+
content_dir: './'
61+
wp_core_version: '6.5.5'
62+
composer_build: 'true'
63+
```
64+
65+
## Plugins and Themes under version control
66+
67+
This example assumes that you have all plugins and themes under version control inside a directory named `wp-content` in the repository.
68+
69+
```yaml
70+
name: "PHP Syntax Check, virus scanning, and WP Plugins & Themes vulnerability scanning"
71+
72+
on:
73+
push:
74+
branches:
75+
- '**'
76+
77+
jobs:
78+
wp-scanner:
79+
runs-on: ubuntu-latest
80+
81+
steps:
82+
- name: Checkout code
83+
uses: actions/checkout@v4
84+
with:
85+
ref: ${{ github.ref }}
86+
87+
- name: WordPress Scanner
88+
uses: 10up/wp-scanner-action@v1
89+
with:
90+
vuln_api_provider: 'patchstack'
91+
vuln_api_token: ${{ secrets.PATCHSTACK_TOKEN }}
92+
content_dir: './wp-content'
93+
wp_core_version: '6.5.5'
94+
```
95+
96+
# Support Level
97+
98+
**Active:** 10up is actively working on this, and we expect to continue work for the foreseeable. Bug reports, feature requests, questions, and pull requests are welcome.
99+
100+
# Changelog
101+
102+
A complete listing of all notable changes to this Github Action are documented in [CHANGELOG.md](https://github.com/10up/wp-scanner-action/blob/trunk/CHANGELOG.md).
103+
104+
# Contributing
105+
106+
Please read [CODE_OF_CONDUCT.md](https://github.com/10up/wp-scanner-action/blob/trunk/CODE_OF_CONDUCT.md) for details on our code of conduct, [CONTRIBUTING.md](https://github.com/10up/wp-scanner-action/blob/trunk/CONTRIBUTING.md) for details on the process for submitting pull requests to us, and [CREDITS.md](https://github.com/10up/wp-scanner-action/blob/trunk/CREDITS.md) for a listing of maintainers and contributors.
107+
108+
# Like what you see?
109+
110+
<p align="center">
111+
<a href="http://10up.com/contact/"><img src="https://10up.com/uploads/2016/10/10up-Github-Banner.png" width="850"></a>
112+
</p>

0 commit comments

Comments
 (0)