feat: expiration on security.txt and fix for SBOM step, to ensure the correct files are committed (#91)

* feat: adding a CI step to check expiration on security.txt and a fix for SBOM step, to ensure the correct files are committed

* ensure execution skips for repos that are not targeted

* version increment for the new orb; thanks for feedback

Author: elnyry-sam-k

README.md

@@ -16,7 +16,7 @@ project settings CircleCI. Then include the following in your `.circleci/config.
 version: 2.1
 setup: true
 orbs:
-  build: mojaloop/build@2.1.7
+  build: mojaloop/build@2.1.8
 workflows:
   setup:
     jobs:
@@ -39,6 +39,7 @@ workflows:
           # test_integration_resource_class: medium
           # test_functional_resource_class: medium
           # grype_scan_resource_class: medium
+          # check_security_txt_expiry_resource_class: medium
           # release_resource_class: medium
           # github_release_resource_class: medium
           # github_prerelease_resource_class: medium
@@ -140,6 +141,9 @@ This feature is particularly useful for:
 
 - If a `Dockerfile` is present in the root of the repository, it will be used to
   build and publish an image.
+- If a `.well-known/security.txt` file is present (RFC 9116), its `Expires`
+  field is validated and the build fails once that date has passed. Repos with
+  no security.txt, or one with no `Expires` field, are unaffected.
 - Published Docker images are signed using Cosign with CircleCI OIDC. Docker image
   signing requires a CircleCI environment CLI that supports
   `circleci run oidc get --claims`. The minimum tested CircleCI Build Agent version

src/commands/check_security_txt_expiry.yml

@@ -0,0 +1,51 @@
+description: >
+  Validates the `Expires` field of `.well-known/security.txt` (RFC 9116).
+
+  If no security.txt file exists in the repo, the step halts (passes) so repos
+  that haven't adopted one yet are unaffected. If the file exists but has no
+  `Expires` field, this passes with a warning (the field is recommended, not
+  universally adopted yet). If `Expires` is present and its date is in the
+  past, the step fails the job.
+steps:
+  - run:
+      name: Check security.txt expiration
+      command: |
+        SECURITY_TXT=".well-known/security.txt"
+
+        if [ ! -f "$SECURITY_TXT" ]; then
+          echo "No $SECURITY_TXT found, skipping check."
+          circleci-agent step halt
+          exit 0
+        fi
+
+        node -e '
+          const fs = require("fs");
+          const path = ".well-known/security.txt";
+          const content = fs.readFileSync(path, "utf8");
+          const match = content.match(/^Expires:\s*(.+)$/mi);
+
+          if (!match) {
+            console.warn("WARNING: " + path + " has no Expires field (RFC 9116 requires one). Skipping.");
+            process.exit(0);
+          }
+
+          const raw = match[1].trim();
+          const expires = new Date(raw);
+
+          if (isNaN(expires.getTime())) {
+            console.error("ERROR: could not parse Expires value in " + path + ": \"" + raw + "\"");
+            console.error("Expected an RFC 3339 date-time, e.g. 2027-09-18T00:00:00.000Z");
+            process.exit(1);
+          }
+
+          const now = new Date();
+          const daysDiff = Math.floor((expires.getTime() - now.getTime()) / 86400000);
+
+          if (expires.getTime() < now.getTime()) {
+            console.error("FAIL: " + path + " expired on " + expires.toISOString() + " (" + Math.abs(daysDiff) + " day(s) ago).");
+            console.error("Update the Expires field in " + path + ".");
+            process.exit(1);
+          }
+
+          console.log("OK: " + path + " valid until " + expires.toISOString() + " (" + daysDiff + " day(s) remaining).");
+        '

src/examples/build_and_test.yml

@@ -4,7 +4,7 @@ usage:
   version: 2.1
   setup: true
   orbs:
-    build: mojaloop/build@2.1.7
+    build: mojaloop/build@2.1.8
   workflows:
     setup:
       jobs:

src/jobs/check_security_txt_expiry.yml

@@ -0,0 +1,15 @@
+description: >
+  Validates that .well-known/security.txt (RFC 9116), if present in the repo,
+  has not expired. Passes with no effect for repos that don't have one yet.
+executor:
+  name: docker
+  resource_class: << parameters.resource_class >>
+parameters:
+  resource_class:
+    type: enum
+    enum: ["small", "medium", "medium+", "large", "xlarge", "2xlarge", "2xlarge+"]
+    default: medium
+steps:
+  - docker_dependencies
+  - checkout
+  - check_security_txt_expiry

src/jobs/github_release.yml

@@ -60,7 +60,10 @@ steps:
             echo "Generating SBOM using NPM"
             npx -y --package @mojaloop/ml-depcheck-utility@1.1.3 generate-sbom-npm
           fi
-          git add sbom-*.csv
+          # Quoted pathspec so git (not the shell) resolves the glob — this stages
+          # the removal of any old sbom-*.csv already deleted from disk above,
+          # not just the newly generated file.
+          git add -A -- 'sbom-*.csv'
           git checkout -- . 2>/dev/null || true
           git commit -m "chore(sbom): update sbom [skip ci]" || echo "No changes to commit"
           git push origin "${CIRCLE_BRANCH}" || echo "Git push failed"

src/jobs/workflow.yml

@@ -53,6 +53,10 @@ parameters:
     type: enum
     enum: ["small", "medium", "medium+", "large", "xlarge", "2xlarge", "2xlarge+"]
     default: medium
+  check_security_txt_expiry_resource_class:
+    type: enum
+    enum: ["small", "medium", "medium+", "large", "xlarge", "2xlarge", "2xlarge+"]
+    default: medium
   release_resource_class:
     type: enum
     enum: ["small", "medium", "medium+", "large", "xlarge", "2xlarge", "2xlarge+"]
@@ -112,6 +116,7 @@ steps:
           "test_integration_resource_class":"<< parameters.test_integration_resource_class>>",
           "test_functional_resource_class":"<< parameters.test_functional_resource_class>>",
           "grype_scan_resource_class":"<< parameters.grype_scan_resource_class>>",
+          "check_security_txt_expiry_resource_class":"<< parameters.check_security_txt_expiry_resource_class>>",
           "release_resource_class":"<< parameters.release_resource_class>>",
           "github_release_resource_class":"<< parameters.github_release_resource_class>>",
           "github_prerelease_resource_class":"<< parameters.github_prerelease_resource_class>>",

src/workflows/build_and_test.yml

@@ -1,6 +1,6 @@
 version: 2.1
 orbs:
-  build: mojaloop/build@2.1.7
+  build: mojaloop/build@2.1.8
 parameters:
   git_tag:
     type: string
@@ -69,6 +69,10 @@ parameters:
     type: enum
     enum: ["small", "medium", "medium+", "large", "xlarge", "2xlarge", "2xlarge+"]
     default: medium
+  check_security_txt_expiry_resource_class:
+    type: enum
+    enum: ["small", "medium", "medium+", "large", "xlarge", "2xlarge", "2xlarge+"]
+    default: medium
   release_resource_class:
     type: enum
     enum: ["small", "medium", "medium+", "large", "xlarge", "2xlarge", "2xlarge+"]
@@ -173,6 +177,12 @@ workflows:
           <<: *test-condition
           name: License scan
           resource_class: << pipeline.parameters.license_scan_resource_class >>
+      - build/check_security_txt_expiry:
+          name: Security.txt expiry
+          resource_class: << pipeline.parameters.check_security_txt_expiry_resource_class >>
+          filters: *setup-filter
+          requires:
+            - Setup
       - build/build_local:
           <<: *test-condition
           name: Build
@@ -220,6 +230,7 @@ workflows:
             - Vulnerability check
             - License scan
             - Grype scan
+            - Security.txt expiry
       - build/github_release:
           name: GitHub release
           resource_class: << pipeline.parameters.github_release_resource_class >>
@@ -292,6 +303,7 @@ workflows:
             - Functional tests
             - License scan
             - Grype scan
+            - Security.txt expiry
       - build/publish_docker_prerelease:
           name: Docker prerelease
           resource_class: << pipeline.parameters.publish_docker_prerelease_resource_class >>