Merge pull request #6 from reload/pull_request

Add security pull request from Dependabot

Author: achton

.mdlrc

@@ -0,0 +1,2 @@
+# Disable "MD013 Line length" and "MD029 Ordered list item prefix".
+rules "~MD013", "~MD029"

.phpcs.xml

@@ -0,0 +1,17 @@
+<?xml version="1.0"?>
+<ruleset>
+    <file>./src</file>
+    <file>./tests</file>
+    <config name="installed_paths" value="../../appocular/coding-standard"/>
+    <rule ref="AppocularCodingStandard"/>
+    <rule ref="SlevomatCodingStandard.Files.TypeNameMatchesFileName">
+      <properties>
+        <!-- Tell Slevomat the root directories of our namespaces, so
+             it can check if the filepath is correct. -->
+	<property name="rootNamespaces" type="array">
+	  <element key="src" value="GitHubSecurityJira"/>
+	  <element key="tests" value="GitHubSecurityJira"/>
+	</property>
+      </properties>
+    </rule>
+</ruleset>

Dockerfile

@@ -1,5 +1,5 @@
 # -----------------
-FROM composer:1.9 AS build-env
+FROM composer:1.9.1 AS build-env
 
 COPY . /opt/ghsec-jira/
 
@@ -8,7 +8,7 @@ WORKDIR /opt/ghsec-jira
 RUN composer install --prefer-dist --no-dev
 
 # -----------------
-FROM php:7.3.12-alpine
+FROM php:7.4.1-alpine
 
 COPY --from=build-env /opt/ghsec-jira/ /opt/ghsec-jira/
 

Makefile

@@ -0,0 +1,13 @@
+.PHONY: check phpstan phpcs markdownlint
+
+check: phpstan phpcs markdownlint
+
+phpstan:
+	-vendor/bin/phpstan analyse .
+
+phpcs:
+	-vendor/bin/phpcs -s bin/ src/
+
+# gem install mdl
+markdownlint:
+	-mdl *.md

README.md

@@ -1,6 +1,6 @@
 # github-security-jira
-GitHub Action for mapping security alerts to Jira tickets.
 
+GitHub Action for mapping security alerts to Jira tickets.
 
 ## Setup
 
@@ -9,28 +9,26 @@ You need the following pieces set up to sync alerts with Jira:
 1. Two repo secrets containing a GitHub access token and a Jira API token, respectively.
 2. A workflow file which runs the action on a schedule, continually creating new tickets when necessary.
 
-
 ### Repo secrets
+
 The `reload/github-security-jira` action requires you to [create two encrypted secrets](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/creating-and-using-encrypted-secrets#creating-encrypted-secrets) in the repo:
 
 1. A secret called `GitHubSecurityToken` which should contain a [Personal Access Token](https://help.github.com/en/github/authenticating-to-github/creating-a-personal-access-token-for-the-command-line) for the GitHub user under which this action should be executed. The token must include the `public_repo` scope if checking only public repos, or the `repo` scope for use on private repos. Also, the user must have [access to security alerts in the repo](https://help.github.com/en/github/managing-security-vulnerabilities/managing-alerts-for-vulnerable-dependencies-in-your-organization).
 2. A secret called `JiraApiToken` containing an [API Token](https://confluence.atlassian.com/cloud/api-tokens-938839638.html) for the Jira user that should be used to create tickets.
 
-
 ### Workflow file setup
+
 The [GitHub workflow file](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/configuring-a-workflow#creating-a-workflow-file) should reside in any repo where you want to sync security alerts with Jira.
 
 It has some required and some optional settings, which are passed to the action as environment variables:
 
 - `GH_SECURITY_TOKEN`: A reference to the repo secret `GitHubSecurityToken` (**REQUIRED**)
 - `JIRA_TOKEN`: A reference to the repo secret `JiraApiToken` (**REQUIRED**)
-- `JIRA_HOST`: The endpoint for your Jira instance, e.g. https://foo.atlassian.net (**REQUIRED**)
+- `JIRA_HOST`: The endpoint for your Jira instance, e.g. <https://foo.atlassian.net> (**REQUIRED**)
 - `JIRA_USER`: The ID of the Jira user which is associated with the 'JiraApiToken' secret, eg '[email protected]' (**REQUIRED**)
 - `JIRA_PROJECT`: The project key for the Jira project where issues should be created, eg `TEST` or `ABC`. (**REQUIRED**)
 - `JIRA_ISSUE_TYPE`: Type of issue to create, e.g. `Security`. Defaults to `Bug`. (*Optional*)
-- `JIRA_WATCHERS`: Jira users to add as watchers to tickets. Use the [YAML block scalar literal style indicator with stripping chomping indicator](https://yaml-multiline.info/) (pipe and dash: `|-`) to add multiple watchers. (*Optional*)
-- `JIRA_RESTRICTED_GROUP`: If set, the action will add a restricted comment to the ticket, viewable by only this Jira group. (*Optional*)
-- `JIRA_RESTRICTED_COMMENT`: The comment to post. Use the YAML multiline operator for adding linebreaks to the comment. (*Optional, but required if group is set*)
+- `JIRA_WATCHERS`: Jira users to add as watchers to tickets. Separate multiple watchers with comma (no spaces).
 
 Here is an example setup which runs this action every 6 hours.
 
@@ -54,16 +52,9 @@ jobs:
           JIRA_USER: [email protected]
           JIRA_PROJECT: ABC
           JIRA_ISSUE_TYPE: Security
-          JIRA_WATCHERS: |-
-            [email protected]
-            [email protected]
-          JIRA_RESTRICTED_GROUP: Developers
-          JIRA_RESTRICTED_COMMENT: |-
-            Remember to evaluate severity here and set ticket priority.
-            Check out the guide [in our wiki|https://foo.atlassian.net/wiki/]!
+          JIRA_WATCHERS: [email protected],[email protected]
 ```
 
-
 ## Local development
 
 Copy `docker-composer.override.example.yml` to `docker-composer.override.yml` and edit according to your settings.

composer.json

@@ -4,14 +4,28 @@
     "license": "MIT",
     "require": {
         "php": ">=7.2.0",
-        "lesstif/php-jira-rest-client": "^1",
         "softonic/graphql-client": "^1.2",
         "symfony/console": "^4",
-        "symfony/yaml": "^5.0"
+        "symfony/yaml": "^5.0",
+        "reload/jira-security-issue": "dev-master"
     },
+    "repositories": [
+      {
+        "type": "vcs",
+        "url": "https://github.com/appocular/coding-standard"
+      },
+      {
+        "type": "vcs",
+        "url": "https://github.com/reload/jira-security-issue"
+      }
+    ],
     "autoload": {
         "psr-4": {
             "GitHubSecurityJira\\": "src/"
         }
+    },
+    "require-dev": {
+        "appocular/coding-standard": "^1.0",
+        "phpstan/phpstan": "^0.12.5"
     }
 }