A Script For Checking In Code to GitHub
ACM.258 Create a function to check in code that can eventually trigger a deployment at the same time
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
⚙️ Part of my series on Automating Cybersecurity Metrics. The Code.
🔒 Related Stories: GitHub Security | Application Security | Secure Code
💻 Free Content on Jobs in Cybersecurity | ✉️ Sign up for the Email List
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In the last post I wrote about an alternative approach to GitHub actions and why you might consider using it.
The first step is a script to check in code for a static website. Let’s take a look at that step.
I showed you how I wrote a script to create a new GitHub repository for my static website here:
I wrote a function that creates a new GitHub repository in my GitHub functions file. Then I call it from my static website initial deployment script like this:
Essentially I change to the folder where the GitHub scripts are and call the create_repository function. We can ditch the $basepath variable after simplification in a recent post.
To check in and deploy changes I can take a similar approach. I can write a function for each. I went over all the different mechanisms for handling credentials in a prior GitHub post and incorporated those thoughts into my create_repository function. I’ll use that same approach for my new functions. Read the related posts here if you want to know more about that.
In the future I may integrate with Okta.
I don’t know if there’ s a way to add MFA to the above approach but I would like to figure that out at some point but at least we can use MFA on the AWS deployment side.
I’ve defined the location for the code as follows and moved this to the top of my functions file, outside of a specific function, because I need it in multiple places now:
I change to the appropriate directory and check to see if the repo exists before creating it.
I’m going to presume the repository exists when checking in code and simply change to the appropriate directory.
Then I can use the git command line to check in the code.
A function to check in code
I can write a function like the following to check in code from a script and call it as shown above.
And test it like this using the repository we’ve been working with:
That works.
Automatically deploy when checking in code
Now let’s say I want to check in and deploy the code at the same time. I can write a check_in_and_deploy function. My new function calls the check_in function and then can proceed with the code to deploy the site from GitHub:
This is basically the same as a GitHub action but the deployment code is not run by the system where the code resides. We don’t have to store our credentials for our cloud environment on GitHub. We don’t have to give access to GitHub to deploy things in our cloud environment. We have more control over the process and can use multiple steps and different sets of credentials to reduce risk.
You may or may not want to go through the trouble of doing this but don’t be surprised the next time a GitHub vulnerability or an improper script allows something rogue to get inserted into your deployment pipeline. There’s no perfect solution, but there are more and less risky solutions.
Follow for updates.
Teri Radichel | © 2nd Sight Lab 2023
About Teri Radichel:
~~~~~~~~~~~~~~~~~~~~
⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight LabNeed Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for PresentationFollow for more stories like this:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
❤️ Sign Up my Medium Email List
❤️ Twitter: @teriradichel
❤️ LinkedIn: https://www.linkedin.com/in/teriradichel
❤️ Mastodon: @teriradichel@infosec.exchange
❤️ Facebook: 2nd Sight Lab
❤️ YouTube: @2ndsightlab
