wrongsecrets
wrongsecrets copied to clipboard
OWASP
Optimize Github actions
In order to become more efficient in CLI time there are a bunch of things we can simplify:
- [ ] 1. create 1 clean-install with all the sskips in place materials to have the jar file
- [ ] 2. Change swagger action to depend on 1
- [ ] 3. Change DAST to depend on 1
- [ ] 4. Change Docker container creation action to depend on1
- [ ] Optimize many of the github actions to just run once instead of twice during a PR.
- [ ] quickfail container test if something is wrong...
Ive noticed the docker container Github action check does not immediately fail when something goes wrong. It hangs until the timeout has been exceeded. I think this will be using a lot of your Github minutes as the timeout is 6 hours.
Might be good to add that to the fix
@commjoen I'm really interested in working on this. Please give me this incredible opportunity.
So ive got a couple of other ideas of how to clean up the pipelines a little. @commjoen @puneeth072003 let me know if I should start another ticket or we should add to this one.
-
Clean up test workflow output. Right now as we are running everything through maven we get a lot of output based on the build and running. I find it can be a little tricky to figure out the debug message you are actually looking for. I either think simplified output from maven or perhaps a test report that is exported with each run.
-
Consistent naming conventions and a workflow file for each distinct piece e.g. a test workflow file and a security workflow file. The only problems I can forsee with this is that you can't move artifacts between each workflow file so if you want workflows to depend on each other it is tricky.
Will be picked up after https://github.com/OWASP/wrongsecrets-binaries/pull/35 :) .