diff --git a/docs/automations/integrations/orca/review-orca-alerts/README.md b/docs/automations/integrations/orca/review-orca-alerts/README.md new file mode 100644 index 00000000..d2e9122e --- /dev/null +++ b/docs/automations/integrations/orca/review-orca-alerts/README.md @@ -0,0 +1,45 @@ +--- +title: Automation - Review Orca Security Alerts +description: Automatically require review from your SecOps team for Orca Security violations in pull requests. +--- +# Require Security Review for Orca Alerts + +Automatically require review from your SecOps team for Orca Security violations in pull requests. + +
+![Review Orca Security Alerts](/automations/integrations/orca/review-orca-alerts/review-orca-alerts-1-light.png#only-light) +![Review Orca Security Alerts](/automations/integrations/orca/review-orca-alerts/review-orca-alerts-2-light.png#only-light) +![Review Orca Security Alerts](/automations/integrations/orca/review-orca-alerts/review-orca-alerts-1-dark.png#only-dark) +![Review Orca Security Alerts](/automations/integrations/orca/review-orca-alerts/review-orca-alerts-2-dark.png#only-dark) + +
+
+!!! info "Configuration Description" + Conditions (all must be true): + + * The PR contains a vulnerability, IAC problem, or secret that is flagged as High or Medium. + + Automation Actions: + + * Require review from your organization's security team. + * Post a comment explaining the requirement. + +
+
+!!! example "Review Orca Security Alerts" + ```yaml+jinja + --8<-- "docs/downloads/automation-library/integrations/orca/review_orca_alerts.cm" + ``` +
+ + [:octicons-download-24: Download this example as a CM file.](/downloads/automation-library/integrations/orca/review_orca_alerts.cm){ .md-button } + +
+
+ + +## Additional Resources + +--8<-- "docs/snippets/general.md" + +--8<-- "docs/snippets/automation-footer.md" \ No newline at end of file diff --git a/docs/automations/integrations/orca/review-orca-alerts/review-orca-alerts-1-dark.png b/docs/automations/integrations/orca/review-orca-alerts/review-orca-alerts-1-dark.png new file mode 100644 index 00000000..dfb9da31 Binary files /dev/null and b/docs/automations/integrations/orca/review-orca-alerts/review-orca-alerts-1-dark.png differ diff --git a/docs/automations/integrations/orca/review-orca-alerts/review-orca-alerts-1-light.png b/docs/automations/integrations/orca/review-orca-alerts/review-orca-alerts-1-light.png new file mode 100644 index 00000000..c82e3d76 Binary files /dev/null and b/docs/automations/integrations/orca/review-orca-alerts/review-orca-alerts-1-light.png differ diff --git a/docs/automations/integrations/orca/review-orca-alerts/review-orca-alerts-2-dark.png b/docs/automations/integrations/orca/review-orca-alerts/review-orca-alerts-2-dark.png new file mode 100644 index 00000000..f4efe5f9 Binary files /dev/null and b/docs/automations/integrations/orca/review-orca-alerts/review-orca-alerts-2-dark.png differ diff --git a/docs/automations/integrations/orca/review-orca-alerts/review-orca-alerts-2-light.png b/docs/automations/integrations/orca/review-orca-alerts/review-orca-alerts-2-light.png new file mode 100644 index 00000000..e6b68262 Binary files /dev/null and b/docs/automations/integrations/orca/review-orca-alerts/review-orca-alerts-2-light.png differ diff --git a/docs/downloads/automation-library/integrations/orca/review_orca_alerts.cm b/docs/downloads/automation-library/integrations/orca/review_orca_alerts.cm new file mode 100644 index 00000000..2a2c4c84 --- /dev/null +++ b/docs/downloads/automation-library/integrations/orca/review_orca_alerts.cm @@ -0,0 +1,23 @@ +# -*- mode: yaml -*- + +manifest: + version: 1.0 +automations: + review_orca_alerts: + if: + - {{ has.vulnerability or has.iac_violation or has.secret }} + run: + - action: require-reviewers@v1 + args: + reviewers: [my-organization/security-team] + - action: add-comment@v1 + args: + comment: | + This PR requires additional review because it fails to meet Orca Security safe code standards. + +orca: {{ pr | extractOrcaFindings }} + +has: + vulnerability: {{ orca.vulnerabilities.priority == 'High' or orca.vulnerabilities.priority == 'Medium' }} + iac_violation: {{ orca.infrastructure_as_code.priority == 'High' or orca.infrastructure_as_code.priority == 'Medium' }} + secret: {{ orca.secrets.priority == 'High' or orca.secrets.priority == 'Medium' }} \ No newline at end of file diff --git a/docs/integrations/orca-security.md b/docs/integrations/orca-security.md index 01fb485e..8b851227 100644 --- a/docs/integrations/orca-security.md +++ b/docs/integrations/orca-security.md @@ -4,10 +4,12 @@ description: Implement workflow automations for Orca Security. --- # Integrate gitStream with Orca Security - ## Auto-Label Orca Security Scan Results --8<-- "docs/automations/integrations/orca/label-orca-scan-results/README.md:example" +## Require Security Review for Orca Violations +--8<-- "docs/automations/integrations/orca/review-orca-alerts/README.md:example" + ## Additional Resources