From 832fb26fc88750bb641f1bfd28dabdd7b556ac34 Mon Sep 17 00:00:00 2001 From: AljonViray-JFrog Date: Mon, 28 Jul 2025 15:32:02 -0700 Subject: [PATCH 1/6] Update workflow.yml add test comment to trigger push --- .../simple-github-action-example/.github/workflows/workflow.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/github-action-examples/simple-github-action-example/.github/workflows/workflow.yml b/github-action-examples/simple-github-action-example/.github/workflows/workflow.yml index abafec42e3..1d07ebae5f 100644 --- a/github-action-examples/simple-github-action-example/.github/workflows/workflow.yml +++ b/github-action-examples/simple-github-action-example/.github/workflows/workflow.yml @@ -30,3 +30,5 @@ jobs: jf rt bag # Publish build info jf rt bp + +# test comment From 34611b14c2fdc2570504c419e3ad0314df9fba01 Mon Sep 17 00:00:00 2001 From: AljonViray-JFrog Date: Mon, 28 Jul 2025 15:37:57 -0700 Subject: [PATCH 2/6] Create frogbot.yml --- .github/workflows/frogbot.yml | 37 +++++++++++++++++++++++++++++++++++ 1 file changed, 37 insertions(+) create mode 100644 .github/workflows/frogbot.yml diff --git a/.github/workflows/frogbot.yml b/.github/workflows/frogbot.yml new file mode 100644 index 0000000000..a6d3ac5590 --- /dev/null +++ b/.github/workflows/frogbot.yml @@ -0,0 +1,37 @@ +name: "Frogbot Security Scan" + +on: + pull_request_target: + types: [opened, synchronize] # Triggers scan-pr flow for every opened/updated pull request + push: # Triggers scan-repo flow for every push to the specified branches + branches: + - main + schedule: + - cron: "0 0 * * *" # The repository will be scanned once a day at 00:00 GMT. + workflow_dispatch: # The repository will be scanned on demand + +permissions: + pull-requests: write + contents: write + security-events: write + # [Mandatory If using OIDC authentication protocol instead of JF_ACCESS_TOKEN] + # id-token: write + +jobs: + frogbot-scan: + runs-on: ubuntu-latest + strategy: + matrix: + # The repository scanning will be triggered periodically on the following branches. + branch: ["main"] + steps: + - uses: jfrog/frogbot@v2 + # [Mandatory if using OIDC authentication protocol instead of JF_ACCESS_TOKEN] + # Insert to oidc-provider-name the 'Provider Name' defined in the OIDC integration configured in the JPD + # with: + # oidc-provider-name: "" + env: + JF_URL: ${{ secrets.JF_URL }} + JF_ACCESS_TOKEN: ${{ secrets.JF_ACCESS_TOKEN }} + JF_GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }} + JF_GIT_BASE_BRANCH: ${{ matrix.branch }} # For repository scan action From 1d2e3553bb27558599fee2de10568d128230e49b Mon Sep 17 00:00:00 2001 From: AljonViray-JFrog Date: Mon, 28 Jul 2025 15:39:41 -0700 Subject: [PATCH 3/6] Update README --- README | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/README b/README index 6410938791..53c5f826b9 100644 --- a/README +++ b/README @@ -1,2 +1,4 @@ The JFrog Platform is an enterprise-ready automated end-to-end DevOps platform, ideal for managing all of your software releases from code to production. -This repository includes sample projects, which can help you get started using the JFrog Platform. \ No newline at end of file +This repository includes sample projects, which can help you get started using the JFrog Platform. + +[![Scanned by Frogbot](https://raw.github.com/jfrog/frogbot/master/images/frogbot-badge.svg)](https://docs.jfrog-applications.jfrog.io/jfrog-applications/frogbot) From 4cccd2b3505902b3ff295749258e17cd0ad42c1f Mon Sep 17 00:00:00 2001 From: AljonViray-JFrog Date: Mon, 28 Jul 2025 15:41:35 -0700 Subject: [PATCH 4/6] Rename README to README.md --- README => README.md | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename README => README.md (100%) diff --git a/README b/README.md similarity index 100% rename from README rename to README.md From 58588b5d8b464a03311e3d9862b237bfc24f91a0 Mon Sep 17 00:00:00 2001 From: Aljon Viray Date: Mon, 28 Jul 2025 15:48:04 -0700 Subject: [PATCH 5/6] add txt file --- my_new_file.txt | 1 + 1 file changed, 1 insertion(+) create mode 100644 my_new_file.txt diff --git a/my_new_file.txt b/my_new_file.txt new file mode 100644 index 0000000000..3b18e512db --- /dev/null +++ b/my_new_file.txt @@ -0,0 +1 @@ +hello world From d369e515a957fb01493cef9d97da95d08c4d80aa Mon Sep 17 00:00:00 2001 From: AljonViray-JFrog Date: Mon, 28 Jul 2025 15:52:17 -0700 Subject: [PATCH 6/6] Update frogbot.yml --- .github/workflows/frogbot.yml | 53 +++++++++++++++++++++-------------- 1 file changed, 32 insertions(+), 21 deletions(-) diff --git a/.github/workflows/frogbot.yml b/.github/workflows/frogbot.yml index a6d3ac5590..662c51f580 100644 --- a/.github/workflows/frogbot.yml +++ b/.github/workflows/frogbot.yml @@ -1,37 +1,48 @@ -name: "Frogbot Security Scan" - +name: "Frogbot Scan and Fix" on: - pull_request_target: - types: [opened, synchronize] # Triggers scan-pr flow for every opened/updated pull request - push: # Triggers scan-repo flow for every push to the specified branches - branches: - - main schedule: - - cron: "0 0 * * *" # The repository will be scanned once a day at 00:00 GMT. - workflow_dispatch: # The repository will be scanned on demand - + # The repository will be scanned once a day at 00:00 GMT. + - cron: "0 0 * * *" permissions: - pull-requests: write contents: write + pull-requests: write security-events: write - # [Mandatory If using OIDC authentication protocol instead of JF_ACCESS_TOKEN] - # id-token: write - jobs: - frogbot-scan: + create-fix-pull-requests: runs-on: ubuntu-latest strategy: matrix: # The repository scanning will be triggered periodically on the following branches. - branch: ["main"] + branch: [ "main" ] steps: + - uses: actions/checkout@v3 + with: + ref: ${{ matrix.branch }} + + # Install prerequisites + - name: Setup NodeJS + uses: actions/setup-node@v3 + with: + node-version: "16.x" + - uses: jfrog/frogbot@v2 - # [Mandatory if using OIDC authentication protocol instead of JF_ACCESS_TOKEN] - # Insert to oidc-provider-name the 'Provider Name' defined in the OIDC integration configured in the JPD - # with: - # oidc-provider-name: "" env: + # [Mandatory] + # JFrog platform URL JF_URL: ${{ secrets.JF_URL }} + + # [Mandatory if JF_USER and JF_PASSWORD are not provided] + # JFrog access token with 'read' permissions on Xray service JF_ACCESS_TOKEN: ${{ secrets.JF_ACCESS_TOKEN }} + + # [Mandatory if JF_ACCESS_TOKEN is not provided] + # JFrog username with 'read' permissions for Xray. Must be provided with JF_PASSWORD + # JF_USER: ${{ secrets.JF_USER }} + + # [Mandatory if JF_ACCESS_TOKEN is not provided] + # JFrog password. Must be provided with JF_USER + # JF_PASSWORD: ${{ secrets.JF_PASSWORD }} + + # [Mandatory] + # The GitHub token automatically generated for the job JF_GIT_TOKEN: ${{ secrets.GITHUB_TOKEN }} - JF_GIT_BASE_BRANCH: ${{ matrix.branch }} # For repository scan action