Skip to content

Commit bdb2fff

Browse files
author
Umar Farooq
committed
Uploading basic documentation for Using PHP or Laravel in Your Projects
1 parent 416692d commit bdb2fff

File tree

12 files changed

+1572
-2
lines changed

12 files changed

+1572
-2
lines changed

‎.github/workflows/security.yml‎

Lines changed: 266 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,266 @@
1+
name: Security Checks
2+
3+
on:
4+
push:
5+
branches: [ main, develop ]
6+
pull_request:
7+
branches: [ main, develop ]
8+
schedule:
9+
# Run security checks weekly on Sundays at 3 AM UTC
10+
- cron: '0 3 * * 0'
11+
12+
jobs:
13+
security-scan:
14+
name: Security Scan
15+
runs-on: ubuntu-latest
16+
17+
steps:
18+
- name: Checkout code
19+
uses: actions/checkout@v4
20+
21+
- name: Set up PHP
22+
uses: shivammathur/setup-php@v2
23+
with:
24+
php-version: '8.2'
25+
extensions: mbstring, xml, ctype, iconv, intl, pdo, pdo_mysql, dom, filter, hash, json, libxml, openssl, readline, zlib
26+
tools: composer:v2, phpunit
27+
28+
- name: Cache Composer dependencies
29+
uses: actions/cache@v3
30+
with:
31+
path: vendor
32+
key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
33+
restore-keys: |
34+
${{ runner.os }}-composer-
35+
36+
- name: Install PHP dependencies
37+
run: |
38+
if [ -f composer.json ]; then
39+
composer install --no-progress --prefer-dist --optimize-autoloader
40+
fi
41+
42+
- name: Run PHP Security Checker
43+
uses: symfonycorp/security-checker-action@v5
44+
if: always()
45+
46+
- name: Run PHPStan Security Analysis
47+
run: |
48+
if [ -f vendor/bin/phpstan ]; then
49+
vendor/bin/phpstan analyse --error-format=github
50+
else
51+
echo "PHPStan not configured - skipping security analysis"
52+
fi
53+
54+
- name: Run Psalm Security Analysis
55+
run: |
56+
if [ -f vendor/bin/psalm ]; then
57+
vendor/bin/psalm --output-format=github
58+
else
59+
echo "Psalm not configured - skipping security analysis"
60+
fi
61+
62+
dependency-scan:
63+
name: Dependency Vulnerability Scan
64+
runs-on: ubuntu-latest
65+
66+
steps:
67+
- name: Checkout code
68+
uses: actions/checkout@v4
69+
70+
- name: Run Trivy vulnerability scanner
71+
uses: aquasecurity/trivy-action@master
72+
with:
73+
scan-type: 'fs'
74+
scan-ref: '.'
75+
format: 'sarif'
76+
output: 'trivy-results.sarif'
77+
78+
- name: Upload Trivy scan results to GitHub Security tab
79+
uses: github/codeql-action/upload-sarif@v2
80+
if: always()
81+
with:
82+
sarif_file: 'trivy-results.sarif'
83+
84+
codeql-analysis:
85+
name: CodeQL Analysis
86+
runs-on: ubuntu-latest
87+
88+
strategy:
89+
fail-fast: false
90+
matrix:
91+
language: [ 'javascript', 'php' ]
92+
93+
steps:
94+
- name: Checkout repository
95+
uses: actions/checkout@v4
96+
97+
- name: Initialize CodeQL
98+
uses: github/codeql-action/init@v2
99+
with:
100+
languages: ${{ matrix.language }}
101+
queries: security-and-quality
102+
103+
- name: Autobuild
104+
uses: github/codeql-action/autobuild@v2
105+
106+
- name: Perform CodeQL Analysis
107+
uses: github/codeql-action/analyze@v2
108+
with:
109+
category: "/language:${{matrix.language}}"
110+
111+
secrets-scan:
112+
name: Secret Scanning
113+
runs-on: ubuntu-latest
114+
115+
steps:
116+
- name: Checkout code
117+
uses: actions/checkout@v4
118+
with:
119+
fetch-depth: 0
120+
121+
- name: Run TruffleHog OSS
122+
uses: trufflesecurity/trufflehog@main
123+
with:
124+
path: ./
125+
base: main
126+
head: HEAD
127+
extra_args: --debug --only-verified
128+
129+
lint-and-format:
130+
name: Code Quality Checks
131+
runs-on: ubuntu-latest
132+
133+
steps:
134+
- name: Checkout code
135+
uses: actions/checkout@v4
136+
137+
- name: Set up PHP
138+
uses: shivammathur/setup-php@v2
139+
with:
140+
php-version: '8.2'
141+
extensions: mbstring, xml, ctype, iconv, intl, pdo, pdo_mysql, dom, filter, hash, json, libxml, openssl, readline, zlib
142+
tools: composer:v2, phpunit
143+
144+
- name: Cache Composer dependencies
145+
uses: actions/cache@v3
146+
with:
147+
path: vendor
148+
key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
149+
restore-keys: |
150+
${{ runner.os }}-composer-
151+
152+
- name: Install PHP dependencies
153+
run: composer install --no-progress --prefer-dist --optimize-autoloader
154+
155+
- name: Run PHP CS Fixer
156+
run: |
157+
if [ -f vendor/bin/php-cs-fixer ]; then
158+
vendor/bin/php-cs-fixer fix --dry-run --format=github
159+
else
160+
echo "PHP CS Fixer not configured - skipping code style check"
161+
fi
162+
163+
- name: Run PHP Mess Detector
164+
run: |
165+
if [ -f vendor/bin/phpmd ]; then
166+
vendor/bin/phpmd . github phpmd.xml || true
167+
else
168+
echo "PHP Mess Detector not configured - skipping mess detection"
169+
fi
170+
171+
container-security:
172+
name: Container Security Scan
173+
runs-on: ubuntu-latest
174+
if: github.event_name == 'pull_request'
175+
176+
steps:
177+
- name: Checkout code
178+
uses: actions/checkout@v4
179+
180+
- name: Build Docker image
181+
run: |
182+
if [ -f Dockerfile ]; then
183+
docker build -t security-test .
184+
else
185+
echo "No Dockerfile found - skipping container scan"
186+
exit 0
187+
fi
188+
189+
- name: Run Trivy container scan
190+
uses: aquasecurity/trivy-action@master
191+
if: success()
192+
with:
193+
scan-type: 'image'
194+
scan-ref: 'security-test'
195+
format: 'sarif'
196+
output: 'trivy-container-results.sarif'
197+
198+
- name: Upload container scan results
199+
uses: github/codeql-action/upload-sarif@v2
200+
if: always()
201+
with:
202+
sarif_file: 'trivy-container-results.sarif'
203+
204+
summary:
205+
name: Security Summary
206+
runs-on: ubuntu-latest
207+
needs: [security-scan, dependency-scan, codeql-analysis, secrets-scan, lint-and-format]
208+
if: always()
209+
210+
steps:
211+
- name: Generate Security Report
212+
run: |
213+
echo "# Security Scan Summary" >> security-report.md
214+
echo "" >> security-report.md
215+
echo "## Job Results:" >> security-report.md
216+
echo "- Security Scan: ${{ needs.security-scan.result }}" >> security-report.md
217+
echo "- Dependency Scan: ${{ needs.dependency-scan.result }}" >> security-report.md
218+
echo "- CodeQL Analysis: ${{ needs.codeql-analysis.result }}" >> security-report.md
219+
echo "- Secrets Scan: ${{ needs.secrets-scan.result }}" >> security-report.md
220+
echo "- Code Quality: ${{ needs.lint-and-format.result }}" >> security-report.md
221+
echo "" >> security-report.md
222+
echo "Report generated at: $(date)" >> security-report.md
223+
224+
- name: Upload Security Report
225+
uses: actions/upload-artifact@v3
226+
with:
227+
name: security-report
228+
path: security-report.md
229+
230+
- name: Comment PR with Security Status
231+
if: github.event_name == 'pull_request'
232+
uses: actions/github-script@v6
233+
with:
234+
script: |
235+
const status = {
236+
security: '${{ needs.security-scan.result }}',
237+
dependency: '${{ needs.dependency-scan.result }}',
238+
codeql: '${{ needs.codeql-analysis.result }}',
239+
secrets: '${{ needs.secrets-scan.result }}',
240+
quality: '${{ needs.lint-and-format.result }}'
241+
};
242+
243+
const allPassed = Object.values(status).every(s => s === 'success');
244+
245+
const body = `
246+
## 🔒 Security Scan Results
247+
248+
| Check | Status |
249+
|-------|--------|
250+
| Security Scan | ${status.security === 'success' ? '✅' : '❌'} |
251+
| Dependency Scan | ${status.dependency === 'success' ? '✅' : '❌'} |
252+
| CodeQL Analysis | ${status.codeql === 'success' ? '✅' : '❌'} |
253+
| Secrets Scan | ${status.secrets === 'success' ? '✅' : '❌'} |
254+
| Code Quality | ${status.quality === 'success' ? '✅' : '❌'} |
255+
256+
${allPassed ? '🎉 All security checks passed!' : '⚠️ Some security checks failed. Please review the details above.'}
257+
258+
*This comment was automatically generated by the security workflow.*
259+
`;
260+
261+
github.rest.issues.createComment({
262+
issue_number: context.issue.number,
263+
owner: context.repo.owner,
264+
repo: context.repo.repo,
265+
body: body
266+
});

‎README.md‎

Lines changed: 21 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,21 @@
1-
# PHP-Laravel-Security-Best-Practices-for-Web-Applications
2-
One-stop repo for developers to learn and apply secure practices during development in PHP Laravel Web Application or any Code written must follow things in this repo.
1+
# PHP & Laravel Security Best Practices for Web Applications
2+
3+
This repository provides comprehensive security best practices and examples for PHP and Laravel web applications.
4+
5+
## Structure
6+
7+
- `docs/` - Detailed documentation on security practices
8+
- `examples/` - Code examples demonstrating secure implementations
9+
- `SECURITY.md` - Security policy and vulnerability reporting
10+
11+
## Topics Covered
12+
13+
- PHP Security Fundamentals
14+
- Laravel Security Features
15+
- Secure Deployment Practices
16+
- Common Vulnerabilities & Mitigations
17+
- Security Checklist
18+
19+
## Getting Started
20+
21+
See the documentation in the `docs/` directory for detailed guides and best practices.

‎SECURITY.md‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Security Policy
2+
3+
## Supported Versions
4+
5+
We actively support security updates for the following versions:
6+
7+
| Version | Supported |
8+
| ------- | ------------------ |
9+
| Latest | :white_check_mark: |
10+
11+
## Reporting a Vulnerability
12+
13+
If you discover a security vulnerability, please report it to us as follows:
14+
15+
1. **DO NOT** create a public GitHub issue
16+
2. Email security@yourdomain.com with details
17+
3. Include reproduction steps and potential impact
18+
4. We will acknowledge receipt within 48 hours
19+
5. We will provide regular updates on our progress
20+
21+
## Security Best Practices
22+
23+
This repository contains examples and documentation for implementing security best practices in PHP and Laravel applications.

0 commit comments

Comments
 (0)