Skip to content

Commit 4b04450

Browse files
temblekingtembleking
committed
Merge branch 'master' into v5
2 parents 1f1eb8a + 55113c7 commit 4b04450

26 files changed

+12366
-7839
lines changed

‎.envrc

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
has nix && use flake
2+
dotenv_if_exists .env # You can create a .env file with your env vars for this project. You can also use .secrets if you are using act. See the line below.
3+
dotenv_if_exists .secrets # Used by [act](https://nektosact.com/) to load secrets into the pipelines
4+
5+
export GITHUB_STEP_SUMMARY=/tmp/github_summary.html

‎.github/workflows/ci-scan.yaml

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
name: Scan Image on PR
2+
3+
on:
4+
pull_request:
5+
6+
jobs:
7+
scan-from-registry:
8+
runs-on: ubuntu-latest
9+
10+
steps:
11+
# This step checks out a copy of your repository.
12+
- name: Check out repository
13+
uses: actions/checkout@v4
14+
15+
- name: Scan dummy-vuln-app from registry
16+
id: scan
17+
uses: ./
18+
continue-on-error: true
19+
with:
20+
# Tag of the image to analyse
21+
image-tag: sysdiglabs/dummy-vuln-app:latest
22+
# API token for Sysdig Scanning auth
23+
sysdig-secure-token: ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
24+
stop-on-failed-policy-eval: true
25+
stop-on-processing-error: true
26+
severity-at-least: medium
27+
28+
- name: Upload SARIF file
29+
if: success() || failure() # Upload results regardless previous step fails
30+
uses: github/codeql-action/upload-sarif@v3
31+
with:
32+
sarif_file: ${{ github.workspace }}/sarif.json
33+
34+
- name: Check that the scan has failed
35+
run: |
36+
if [ "${{ steps.scan.outcome }}" == "success" ]; then
37+
echo "Scan succeeded but the step should fail."
38+
exit 1
39+
else
40+
echo "Scan failed as expected."
41+
fi
42+
43+
filtered-scan-from-registry:
44+
runs-on: ubuntu-latest
45+
46+
steps:
47+
# This step checks out a copy of your repository.
48+
- name: Check out repository
49+
uses: actions/checkout@v4
50+
51+
- name: Scan dummy-vuln-app from registry
52+
id: scan
53+
uses: ./
54+
continue-on-error: true
55+
with:
56+
# Tag of the image to analyse
57+
image-tag: sysdiglabs/dummy-vuln-app:latest
58+
# API token for Sysdig Scanning auth
59+
sysdig-secure-token: ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
60+
stop-on-failed-policy-eval: true
61+
stop-on-processing-error: true
62+
severity-at-least: medium
63+
group-by-package: true
64+
65+
- name: Upload SARIF file
66+
if: success() || failure() # Upload results regardless previous step fails
67+
uses: github/codeql-action/upload-sarif@v3
68+
with:
69+
sarif_file: ${{ github.workspace }}/sarif.json
70+
71+
- name: Check that the scan has failed
72+
run: |
73+
if [ "${{ steps.scan.outcome }}" == "success" ]; then
74+
echo "Scan succeeded but the step should fail."
75+
exit 1
76+
else
77+
echo "Scan failed as expected."
78+
fi
79+
80+
scan-with-old-scanner-version:
81+
runs-on: ubuntu-latest
82+
83+
steps:
84+
# This step checks out a copy of your repository.
85+
- name: Check out repository
86+
uses: actions/checkout@v4
87+
88+
- name: Scan dummy-vuln-app from registry
89+
id: scan
90+
uses: ./
91+
continue-on-error: true
92+
with:
93+
# Old scanner version
94+
cli-scanner-version: 1.8.1
95+
# Tag of the image to analyse
96+
image-tag: sysdiglabs/dummy-vuln-app:latest
97+
# API token for Sysdig Scanning auth
98+
sysdig-secure-token: ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
99+
stop-on-failed-policy-eval: true
100+
stop-on-processing-error: true
101+
severity-at-least: medium
102+
103+
- name: Upload SARIF file
104+
if: success() || failure() # Upload results regardless previous step fails
105+
uses: github/codeql-action/upload-sarif@v3
106+
with:
107+
sarif_file: ${{ github.workspace }}/sarif.json
108+
109+
- name: Check that the scan has failed
110+
run: |
111+
if [ "${{ steps.scan.outcome }}" == "success" ]; then
112+
echo "Scan succeeded but the step should fail."
113+
exit 1
114+
else
115+
echo "Scan failed as expected."
116+
fi
117+
118+
standalone-scan-from-registry:
119+
runs-on: ubuntu-latest
120+
121+
steps:
122+
# This step checks out a copy of your repository.
123+
- name: Check out repository
124+
uses: actions/checkout@v4
125+
126+
- name: Donate MainDB from scan
127+
id: donnor-scan
128+
uses: ./
129+
with:
130+
# Tag of the image to analyse
131+
image-tag: sysdiglabs/dummy-vuln-app:latest
132+
# API token for Sysdig Scanning auth
133+
sysdig-secure-token: ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
134+
stop-on-failed-policy-eval: false
135+
stop-on-processing-error: true
136+
skip-summary: true
137+
138+
- name: Scan dummy-vuln-app from registry
139+
id: scan
140+
uses: ./
141+
with:
142+
# Tag of the image to analyse
143+
image-tag: sysdiglabs/dummy-vuln-app:latest
144+
# API token for Sysdig Scanning auth
145+
#sysdig-secure-token: ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
146+
stop-on-failed-policy-eval: true
147+
stop-on-processing-error: true
148+
standalone: true
149+
150+
- name: Upload SARIF file
151+
if: success() || failure() # Upload results regardless previous step fails
152+
uses: github/codeql-action/upload-sarif@v3
153+
with:
154+
sarif_file: ${{ github.workspace }}/sarif.json
155+

‎.github/workflows/scan.yaml

Lines changed: 1 addition & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -57,32 +57,6 @@ jobs:
5757
with:
5858
sarif_file: ${{ github.workspace }}/sarif.json
5959

60-
macos-scan-from-registry:
61-
runs-on: macos-latest
62-
63-
steps:
64-
# This step checks out a copy of your repository.
65-
- name: Check out repository
66-
uses: actions/checkout@v4
67-
68-
- name: Scan dummy-vuln-app from registry
69-
id: scan
70-
uses: ./
71-
with:
72-
# Tag of the image to analyse
73-
image-tag: sysdiglabs/dummy-vuln-app:latest
74-
# API token for Sysdig Scanning auth
75-
sysdig-secure-token: ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
76-
stop-on-failed-policy-eval: true
77-
stop-on-processing-error: true
78-
79-
- name: Upload SARIF file
80-
if: success() || failure() # Upload results regardless previous step fails
81-
uses: github/codeql-action/upload-sarif@v3
82-
with:
83-
sarif_file: ${{ github.workspace }}/sarif.json
84-
85-
8660
standalone-scan-from-registry:
8761
runs-on: ubuntu-latest
8862

@@ -119,4 +93,4 @@ jobs:
11993
if: success() || failure() # Upload results regardless previous step fails
12094
uses: github/codeql-action/upload-sarif@v3
12195
with:
122-
sarif_file: ${{ github.workspace }}/sarif.json
96+
sarif_file: ${{ github.workspace }}/sarif.json

0 commit comments

Comments
 (0)