Secure Software Releases

# What someone meant to do:
aws s3 cp file.txt s3://internal-bucket/

# What actually got deployed:
aws s3api put-bucket-acl --bucket internal-bucket --acl public-read

# ⚠️ Now every file in the bucket is publicly accessible

# GitHub Actions example for CodeQL SAST scan (snippet)
name: Run SAST Scan
on: [push, pull_request]
jobs:
  codeql-analysis:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v2
        with:
          languages: javascript, python

      - name: Run CodeQL analysis
        uses: github/codeql-action/analyze@v2

      - name: Fail on critical issues
        if: env.CRITICAL_ISSUES != ''
        run: |
          echo "Critical security issues found. Failing build."
          exit 1

# For Python
pip-audit --strict

# For Node.js
npm audit --audit-level=moderate

// Bad: effectively full admin
{
  "Effect": "Allow",
  "Action": "*",
  "Resource": "*"
}

// Better: scoped to S3 object read/write in one bucket
{
  "Effect": "Allow",
  "Action": [
    "s3:GetObject",
    "s3:PutObject"
  ],
  "Resource": "arn:aws:s3:::app-uploads/*"
}

# Example artifact signing with cosign (bash)
cosign sign --key cosign.key ghcr.io/my-org/myapp:v1.2.3

# Verify during deployment
cosign verify --key cosign.pub ghcr.io/my-org/myapp:v1.2.3

git clone https://github.com/YOUR_USERNAME/kodekloud-records-store-web-app.git
cd kodekloud-records-store-web-app

# Create a branch for testing
git checkout -b develop-test

# Workflow header + limited token permissions
name: Progressive Config Management & Secure Release Pipeline
on:
  push:
    branches:
      - main
      - develop-test
  pull_request:
    types: [closed]
    branches:
      - main
  workflow_dispatch:
    inputs:
      environment:
        description: 'Target environment for deployment'
        required: true
        default: 'staging'
        type: choice
        options: [development, staging, production]
permissions:
  contents: read
  packages: write
  id-token: write

jobs:
  build-and-test:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.10'

      - name: Install dependencies
        run: |
          python -m venv venv
          source venv/bin/activate
          pip install --upgrade pip setuptools
          pip install -r requirements.txt

      - name: Dependency vulnerability scan (pip-audit)
        run: |
          source venv/bin/activate
          pip install pip-audit
          pip-audit --format json > security-report.json || echo "vulnerabilities found"

# ❌ INSECURE: hardcoded password (do not use)
echo "password123" | docker login ghcr.io -u admin --password-stdin

- name: Log in to GitHub Container Registry
  run: |
    echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u $GITHUB_ACTOR --password-stdin
    echo "✅ Using secure GitHub token authentication"

- name: Install Docker Compose
  run: |
    sudo curl -L "https://github.com/docker/compose/releases/download/v2.29.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
    sudo chmod +x /usr/local/bin/docker-compose
    docker-compose version

- name: Build and tag Docker image
  run: |
    docker build -t ghcr.io/${{ github.repository }}/kodekloud-records:${{ github.sha }} .
    docker push ghcr.io/${{ github.repository }}/kodekloud-records:${{ github.sha }}

- name: Generate Software Bill of Materials (SBOM)
  run: |
    curl -sSFL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
    syft -o cyclonedx-json . > sbom.json

- name: Upload SBOM as artifact
  uses: actions/upload-artifact@v4
  with:
    name: software-bill-of-materials
    path: sbom.json

- name: Install Grype
  run: |
    curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin

- name: Scan image for vulnerabilities
  run: |
    grype ghcr.io/${{ github.repository }}/kodekloud-records:${{ github.sha }} -o json > grype-report.json || true

jobs:
  deploy-staging:
    environment: staging
    runs-on: ubuntu-latest
    steps:
      - name: Deploy to staging
        run: |
          echo "Deploying to staging..."
          # deployment commands here

  deploy-production:
    environment: production
    runs-on: ubuntu-latest
    steps:
      - name: Production Promotion Gate
        run: |
          echo "🔒 MANUAL APPROVAL REQUIRED FOR PRODUCTION"
          echo "Approved by: ${{ github.actor }}"

Error response from daemon: Get "https://ghcr.io/v2/": denied: denied
Error: Process completed with exit code 1.