{"id":20676552,"url":"https://github.com/ryosukedtomita/devsecops-demo-aws-ecs","last_synced_at":"2026-02-20T22:39:20.569Z","repository":{"id":212037453,"uuid":"730297615","full_name":"RyosukeDTomita/devsecops-demo-aws-ecs","owner":"RyosukeDTomita","description":"GITHUB ACTIONS and devsecops tools document and demo.","archived":false,"fork":false,"pushed_at":"2025-01-15T01:24:04.000Z","size":17559,"stargazers_count":2,"open_issues_count":7,"forks_count":1,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-06-14T11:05:30.590Z","etag":null,"topics":["aqua","devsecops","ghalint","github-comment","github-pages","githubactions","semgrep","trivy"],"latest_commit_sha":null,"homepage":"https://ryosukedtomita.github.io/devsecops-demo-aws-ecs/","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"unlicense","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/RyosukeDTomita.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":"CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2023-12-11T16:10:43.000Z","updated_at":"2025-01-04T07:10:17.000Z","dependencies_parsed_at":"2024-03-23T05:29:35.907Z","dependency_job_id":"76f79c95-f06e-4b64-993e-980d2cf182a2","html_url":"https://github.com/RyosukeDTomita/devsecops-demo-aws-ecs","commit_stats":null,"previous_names":["ryosukedtomita/react-roulette-frontend","ryosukedtomita/devsecops-demo-aws-ecs"],"tags_count":3,"template":false,"template_full_name":null,"purl":"pkg:github/RyosukeDTomita/devsecops-demo-aws-ecs","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/RyosukeDTomita%2Fdevsecops-demo-aws-ecs","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/RyosukeDTomita%2Fdevsecops-demo-aws-ecs/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/RyosukeDTomita%2Fdevsecops-demo-aws-ecs/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/RyosukeDTomita%2Fdevsecops-demo-aws-ecs/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/RyosukeDTomita","download_url":"https://codeload.github.com/RyosukeDTomita/devsecops-demo-aws-ecs/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/RyosukeDTomita%2Fdevsecops-demo-aws-ecs/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29667093,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-20T19:49:36.704Z","status":"ssl_error","status_checked_at":"2026-02-20T19:44:05.372Z","response_time":59,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aqua","devsecops","ghalint","github-comment","github-pages","githubactions","semgrep","trivy"],"created_at":"2024-11-16T21:12:58.342Z","updated_at":"2026-02-20T22:39:20.540Z","avatar_url":"https://github.com/RyosukeDTomita.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# DevSecOps demo React application for AWS ECS on Fargate\n\n![no license](https://img.shields.io/github/license/RyosukeDTomita/devsecops-demo-aws-ecs)\n[![jest](https://github.com/RyosukeDTomita/devsecops-demo-aws-ecs/actions/workflows/react-jest.yaml/badge.svg)](https://github.com/RyosukeDTomita/devsecops-demo-aws-ecs/actions/workflows/react-jest.yaml)\n[![Semgrep](https://github.com/RyosukeDTomita/devsecops-demo-aws-ecs/actions/workflows/react-semgrep.yaml/badge.svg)](https://github.com/RyosukeDTomita/devsecops-demo-aws-ecs/actions/workflows/react-semgrep.yaml)\n[![trivy-dependency-check](https://github.com/RyosukeDTomita/devsecops-demo-aws-ecs/actions/workflows/react-dependency-check.yaml/badge.svg)](https://github.com/RyosukeDTomita/devsecops-demo-aws-ecs/actions/workflows/react-dependency-check.yaml)\n[![actions-lint](https://github.com/RyosukeDTomita/devsecops-demo-aws-ecs/actions/workflows/actions-linter.yaml/badge.svg)](https://github.com/RyosukeDTomita/devsecops-demo-aws-ecs/actions/workflows/actions-linter.yaml)\n\n## INDEX\n\n- [ABOUT](#about)\n- [FEATURE](#feature)\n- [ENVIRONMENT](#environment)\n- [PREPARING](#preparing)\n- [HOW TO USE](#how-to-use)\n- [ERROR LOG](#error-log)\n\n---\n\n## ABOUT\n\nSample React application for Trying to Use DevSecOps tools.\n\n\u003e [!WARNING]\n\u003e Since it costs money to maintain the AWS environment created with copilot-cli for the demo environment, I plan to use `GitHub-Pages` for future demos. I have archived [this branch](https://github.com/RyosukeDTomita/devsecops-demo-aws-ecs).\n\u003e デモ環境に対して`copilot-cli`で作ったAWS環境を維持するのにお金がかかるのはもったいないので，以降は`github-pages`を使ってデモを動かそうと思います。[このブランチ](https://github.com/RyosukeDTomita/devsecops-demo-aws-ecs)をアーカイブとして残してあります。\n\n1. [PREPARING](#preparing)の設定を先にやる。\n2. commit時にはpre-commitとgit-secretが作動。\n3. push時にはGitHub ActionsによりSAST(semgrep)，UnitTest(jest)，Dependency Check(trivy)が実行される。\n4. github-pagesにデプロイされる。 # TODO: more info\n\n---\n\n## FEATURE\nこのRepositoryで学べること。\n\n### GitHub Actions等(git push後)で使用されるツールの使い方\n\n- [ghalint](./doc/tools_doc/ghalint.md): GitHub Actionsで実行されるworkflows用のlinter\n- [github-comment](./doc/tools_doc/github-comment.md): GitHub Actionsで実行されるCIが失敗したときにコメントとしてエラーを出力する。\n- [semgrep](./doc/tools_doc/semgrep.md): GitHub Actionsで実行するSASTツール\n- [trivy](./doc/tools_doc/trivy.md): イメージのスキャンやdependency checkができる。dependency checkはGitHub Actionsで実行，イメージスキャンはTODO\n\n### GitHub Actionsのテクニック\n\n- [github-actoins.md](./doc/github-actions.md)\n  - matrixでバージョンや環境を変えて並列テスト\n  - pathsフィルター\n  - GitHub Environments variablesやsecretsの使い方\n  - WorkflowのバッチをREADME.mdにつける\n  - CodeQLを使ってスキャン結果等を出力する\n- [zipを作ってartifactとして配置する](./.github/workflows/create_zip.yaml)\n- [RepositoryのReleasesを自動作成](./.github/workflows/release_document.yaml)\n- [github-pages](./doc/github-pages.md)にデプロイする。\n\n### GitHub Actions関連のバージョン管理ツールの使い方\n\n- [aqua](./doc/tools_doc/aqua.md): GitHub Actions等で使用するCLIツールのバージョン管理ができる。\n- [pinact](./doc/tools_doc/pinact.md): GitHub Actionsで使うactionsのバージョンをフルコミットハッシュに変換。\n\n### pre commit(git committ前)に使うツールの使い方\n\n- [pre-commit](./doc/tools_doc/pre-commit.md): git commit前に特定のツールを実行し，失敗ならcommitさせない。\n  - [hadolint](./doc/tools_doc/hadolint.md)\n  - ESLint\n  - Prettier(Formatter)\n  - [Markdown linter](./doc/tools_doc/markdown_tools.md)\n- [git-secret](./doc/tools_doc/pre-commit.md): git commit時にクレデンシャルのパターンにマッチするものがあれば，commitさせない。\n\n### VSCode Extensions(Securityに関係のありそうなものだけ抜粋)\n\n- [hadolint](https://marketplace.visualstudio.com/items?itemName=exiasr.hadolint): Dockerfileのlinter\n- [markdownlint](https://marketplace.visualstudio.com/items?itemName=DavidAnson.vscode-markdownlint)\n- [zenkaku](https://marketplace.visualstudio.com/items?itemName=mosapride.zenkaku): 半角スペースを可視化\n- [Code spell checker](https://marketplace.visualstudio.com/items?itemName=streetsidesoftware.code-spell-checker)\n- ESLint\n- Prettier\n\n### その他細かいGitHubのテクニック\n- CODEOWNERSの使い方 TODO: そのうちドキュメント化する\n- RepositoryのTemplates関連\n  - [pull_request_template](./.github/workflows/pull_request_template.md)\n  - [ISSUE_TEMPLATE](./.github/ISSUE_TEMPLATE)\n  - [reply template](./doc/tools_doc/reply_template.md)\n- branchルールセットについて TODO: そのうちドキュメント化する\n\n---\n\n## ENVIRONMENT\n\n### デプロイするアプリ\n\n`create-react-app`で作られるデフォルトそのまま。\n\n---\n\n## PREPARING\n\n### 最初にやること\n- Reopsitoryをforkしてcloneする。\n- [gh](https://github.com/cli/cli/releases/tag/v2.54.0)コマンドをインストールする。\n\n### GitHubの設定\n\n#### RepositoryにEnvironment variablesを登録する\n\n- Repositoryのsettingsから[Environment](https://github.com/RyosukeDTomita/devsecops-demo-aws-ecs/settings/environments)を作る。\n![Environment例](./doc/fig/github-environment.png)\n- ローカルに3環境分の.envファイルを作成する。これによってブラウザからどの環境のアプリ化識別する。\n\n```shell\n# 作成\nfor environment in development staging production;\ndo\n  touch .env.${environment}\n  echo $REACT_APP_MESSAGE=${environment} \u003e .env.${environment}\ndone\n```\n\n- github actions enrironment variablesに登録/更新する。\n\n```shell\nsource ./update_github_actions_variables.sh\n```\n\n#### GitHub Actionsで実行したスキャン結果をアップロードできるようにGitHubリポジトリの設定を変更する\n\n- GitHub Actionsがスキャン結果のファイルをアップロードできるようにGitHubリポジトリの設定を変更。詳細は[semgrepのyaml](./.github/workflows/react-semgrep.yaml)を参照。\n\n#### GitHub Actionsでghコマンドを使うための設定\n\n- [Personal access tokens](https://github.com/settings/tokens)を作り，repository secretsに登録する。\nTODO: 一旦これくらいで作成。もっと権限しぼれるかも\n![personal acccess token例](./doc/fig/pat-gh.png)\n- repository secretsに登録する。\n![Actions secrets and variables](./doc/fig/actions-secrets-set.png)\n\n#### GitHub Pagesの設定\n\n[./doc/github-pages.md](./doc/github-pages.md)\n\n\n### その他ローカルにインストールするツール\n\n- [pre-commit](./doc/tools_doc/pre-commit.md)\n- [git secret](./doc/tools_doc/git-secret.md)\n- VSCodeのExtensionsもお好みでインストール。TODO: Devcontainer化する。\n\n---\n\n## ERROR LOG\n\n[error.md](./doc/error.md)を参照。\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fryosukedtomita%2Fdevsecops-demo-aws-ecs","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fryosukedtomita%2Fdevsecops-demo-aws-ecs","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fryosukedtomita%2Fdevsecops-demo-aws-ecs/lists"}