As a PHP developer, you’ve likely encountered the jarring experience of discovering a security vulnerability in your application’s dependencies. Maybe it was during a code review, or worse, after an attacker had already exploited the issue. You may have spent hours digging through stack traces and online forums to identify the root cause, only to realize that the fix requires a painful manual update process.
You’ll build on this experience by learning how to automate security checks and updates for your Laravel application using GitHub Actions and Dependabot. By the end of this tutorial, you’ll have set up a workflow that integrates OWASP’s ZAP tool to scan your code for vulnerabilities, and will be able to automatically update dependencies with critical patches – freeing yourself from the drudgery of manual dependency management.
Prerequisites: Setting Up a Laravel Project with GitHub
Before we dive into securing your PHP application using GitHub Actions and Dependabot, you’ll need to set up a new Laravel project on GitHub. This will allow us to configure Dependabot and create a workflow for automated security checks.
First, create a new directory for your project and navigate to it in your terminal:
mkdir my-laravel-project
cd my-laravel-projectNext, run the following command to create a new Laravel project using Composer:
composer create-project --prefer-dist laravel/laravel .This will install Laravel in the current directory.
Now that we have our Laravel project set up, let’s create a new Git repository on GitHub. Create a new account or sign in if you already have one, then click the “+” button to create a new repository:
- Name your repository something like
my-laravel-project - Set the repository visibility to “Public”
- Click “Create repository”
Once the repository is created, navigate back to your terminal and link your local project with the GitHub repository:
git add .
git commit -m "Initial commit"
git branch -M main
git remote add origin https://github.com/your-username/my-laravel-project.git
git push -u origin mainReplace https://github.com/your-username/my-laravel-project.git with the actual URL of your repository.
Configuring Dependabot for Vulnerability Scanning and Alerts
To take advantage of Dependabot’s vulnerability scanning and alert features, we need to configure it in our GitHub repository.
First, navigate to your repository settings on GitHub and go to the “Security & analysis” tab. Click on “Dependabot” from the left-hand menu. If you haven’t already, enable Dependabot by toggling the switch.
Once enabled, click on “Configure Dependabot security updates”. Here, we can select which package managers and languages we want Dependabot to support. For this example, let’s choose composer for Laravel projects. We’ll also set up a .dependabot.yml configuration file in our repository root directory.
version: 2
updates:
vendor-locked: false
schedule:
interval: dailyThis configuration tells Dependabot to run daily and include all dependencies (not just the ones locked by Composer). Next, we’ll need to add a dependabot key to our repository’s .github/dependabot.yml file.
version: 2
updates:
package-ecosystem: composerThis configuration tells Dependabot which package manager to use (in this case, Composer). With these settings in place, Dependabot will start scanning our dependencies for vulnerabilities and alerting us when necessary.
Setting Up GitHub Actions to Run Security Checks on Pull Requests
Now that Dependabot is configured and vulnerability scanning is enabled, it’s time to integrate our Laravel project with GitHub Actions. This will allow us to run security checks automatically whenever a new pull request is submitted.
First, let’s navigate to our repository in the browser and click on “Actions” from the left-hand menu. Then, we’ll create a new workflow by clicking the “New workflow” button.
# .github/workflows/dependabot.yml
name: Dependabot
on:
pull_request:
branches:
- main
jobs:
dependabot-scan:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v3
- name: Install dependencies
run: composer install --prefer-dist
- name: Run security checks
env:
COMPOSER_HOME: ~/.composer
run: |
composer validate
composer show --platform=securityIn this example workflow, we’re specifying that the job should run on pull requests targeting our main branch. The dependabot-scan job consists of three steps: checking out the code, installing dependencies with Composer, and running security checks using composer validate and composer show --platform=security.
Once saved, GitHub Actions will automatically trigger a new workflow whenever a new pull request is submitted, ensuring our project’s dependencies are up-to-date and secure. This concludes our setup of Dependabot and GitHub Actions for vulnerability scanning and automated dependency updates.
Integrating OWASP’s ZAP Tool into Your GitHub Actions Workflow
In this section, we’ll explore how to integrate OWASP’s ZAP (Zed Attack Proxy) tool into our GitHub Actions workflow. ZAP is a popular open-source web application security scanner that can help identify vulnerabilities in our Laravel application.
First, let’s add the ZAP Docker image to our github/actions.yml file:
name: Security Scan
on:
pull_request:
jobs:
scan:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v3
- name: Setup ZAP
run: |
docker run -d \
--name zap \
owasp/zap2docker-weekly:latest zap.sh -daemon -port=8090
- name: Run security scan
run: |
docker exec -i zap zap-baseline.py http://localhost:8000This workflow will spin up a ZAP container, configure it to listen on port 8090, and then run the baseline vulnerability scanner against our Laravel application.
To view the results of the scan, navigate to your GitHub repository’s Actions page. Click on the most recent workflow run and look for the “Security Scan” job. In the logs, you should see a detailed report highlighting any potential vulnerabilities found by ZAP.
With this integration in place, we’ll be able to catch security issues early in our development cycle and ensure our application is safer for users.
Automating Dependency Updates with Dependabot’s Auto-Patch Feature
In our previous sections, we’ve set up GitHub Actions to run security checks on pull requests and integrated OWASP’s ZAP tool into our workflow. However, vulnerabilities can still arise from outdated dependencies. To mitigate this risk, we’ll enable Dependabot’s auto-patch feature.
To configure auto-patching, navigate to your repository’s settings in the GitHub web interface, then click on “Actions” and select “General”. From there, toggle the switch for “Dependabot” to enable it. Next, create a new file named .github/dependabot.yml with the following contents:
version: 2
updates:
dependency:
package-ecosystem: composerThis configuration tells Dependabot to use Composer as our package manager and enables auto-patching for all dependencies.
Once configured, Dependabot will automatically create pull requests to update vulnerable dependencies. If you want to restrict auto-patching to specific packages or versions, you can modify the .github/dependabot.yml file accordingly. For instance:
version: 2
updates:
dependency:
package-ecosystem: composer
ignore:
- monolog/monolog@^2.xThis example excludes Monolog version 2.x from auto-patching.
By automating dependency updates, you ensure your application stays secure and up-to-date with the latest dependencies. With this final step, our GitHub Actions workflow is now fully integrated with Dependabot’s security features.
Frequently Asked Questions
How do I set up Dependabot for my Laravel project on GitHub?
To configure Dependabot, navigate to your repository settings on GitHub and go to the ‘Security & analysis’ tab. Click on ‘Dependabot’ from the left-hand menu and toggle the switch to enable it.
What is the difference between using Dependabot and manually updating dependencies?
Using Dependabot automates security checks and updates for your dependencies, freeing you from manual dependency management. It also provides alerts for potential vulnerabilities and allows for automated patching of critical issues.
How do I configure a workflow in GitHub Actions to integrate OWASP’s ZAP tool?
To set up a workflow that integrates OWASP’s ZAP tool, navigate to your repository settings on GitHub and go to the ‘Actions’ tab. Click on ‘New workflow’ and choose a template for Laravel projects.
What is the purpose of the .dependabot.yml configuration file in my repository root directory?
The .dependabot.yml configuration file specifies which package managers and languages Dependabot should support. For this example, we set it up to use composer for Laravel projects.
What happens if I forget to update a dependency with a critical patch using Dependabot?
If you forget to update a dependency with a critical patch using Dependabot, the workflow will alert you of the vulnerability. You can then manually update the dependency or allow Dependabot to automate the patching process.