Skip to content

Commit a6211d8

Browse files
temblekingtembleking
committed
ci: run scan on pr
1 parent 1338596 commit a6211d8

File tree

1 file changed

+161
-0
lines changed

1 file changed

+161
-0
lines changed

‎.github/workflows/ci-scan.yaml

Lines changed: 161 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,161 @@
1+
name: Scan Image on PR
2+
3+
on:
4+
pull_request:
5+
6+
jobs:
7+
scan-from-registry:
8+
runs-on: ubuntu-latest
9+
10+
steps:
11+
# This step checks out a copy of your repository.
12+
- name: Check out repository
13+
uses: actions/checkout@v5
14+
15+
- name: Scan dummy-vuln-app from registry
16+
id: scan
17+
uses: ./
18+
continue-on-error: true
19+
with:
20+
# Tag of the image to analyse
21+
image-tag: sysdiglabs/dummy-vuln-app:latest
22+
# API token for Sysdig Scanning auth
23+
sysdig-secure-token: ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
24+
stop-on-failed-policy-eval: true
25+
stop-on-processing-error: true
26+
severity-at-least: medium
27+
28+
- name: Upload SARIF file
29+
if: success() || failure() # Upload results regardless previous step fails
30+
uses: github/codeql-action/upload-sarif@v3
31+
with:
32+
sarif_file: ${{ github.workspace }}/sarif.json
33+
34+
- name: Check that the scan has failed
35+
run: |
36+
if [ "${{ steps.scan.outcome }}" == "success" ]; then
37+
echo "Scan succeeded but the step should fail."
38+
exit 1
39+
else
40+
echo "Scan failed as expected."
41+
fi
42+
43+
filtered-scan-from-registry:
44+
runs-on: ubuntu-latest
45+
46+
steps:
47+
# This step checks out a copy of your repository.
48+
- name: Check out repository
49+
uses: actions/checkout@v4
50+
51+
- name: Scan dummy-vuln-app from registry
52+
id: scan
53+
uses: ./
54+
continue-on-error: true
55+
with:
56+
# Tag of the image to analyse
57+
image-tag: sysdiglabs/dummy-vuln-app:latest
58+
# API token for Sysdig Scanning auth
59+
sysdig-secure-token: ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
60+
stop-on-failed-policy-eval: true
61+
stop-on-processing-error: true
62+
severity-at-least: medium
63+
group-by-package: true
64+
65+
- name: Upload SARIF file
66+
if: success() || failure() # Upload results regardless previous step fails
67+
uses: github/codeql-action/upload-sarif@v3
68+
with:
69+
sarif_file: ${{ github.workspace }}/sarif.json
70+
71+
- name: Check that the scan has failed
72+
run: |
73+
if [ "${{ steps.scan.outcome }}" == "success" ]; then
74+
echo "Scan succeeded but the step should fail."
75+
exit 1
76+
else
77+
echo "Scan failed as expected."
78+
fi
79+
80+
macos-scan-from-registry:
81+
runs-on: macos-latest
82+
83+
steps:
84+
# This step checks out a copy of your repository.
85+
- name: Check out repository
86+
uses: actions/checkout@v4
87+
88+
- name: Scan dummy-vuln-app from registry
89+
id: scan
90+
uses: ./
91+
continue-on-error: true
92+
with:
93+
# Tag of the image to analyse
94+
image-tag: sysdiglabs/dummy-vuln-app:latest
95+
# API token for Sysdig Scanning auth
96+
sysdig-secure-token: ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
97+
stop-on-failed-policy-eval: true
98+
stop-on-processing-error: true
99+
100+
- name: Upload SARIF file
101+
if: success() || failure() # Upload results regardless previous step fails
102+
uses: github/codeql-action/upload-sarif@v3
103+
with:
104+
sarif_file: ${{ github.workspace }}/sarif.json
105+
106+
- name: Check that the scan has failed
107+
run: |
108+
if [ "${{ steps.scan.outcome }}" == "success" ]; then
109+
echo "Scan succeeded but the step should fail."
110+
exit 1
111+
else
112+
echo "Scan failed as expected."
113+
fi
114+
115+
standalone-scan-from-registry:
116+
runs-on: ubuntu-latest
117+
118+
steps:
119+
# This step checks out a copy of your repository.
120+
- name: Check out repository
121+
uses: actions/checkout@v4
122+
123+
- name: Donate MainDB from scan
124+
id: donnor-scan
125+
uses: ./
126+
with:
127+
# Tag of the image to analyse
128+
image-tag: sysdiglabs/dummy-vuln-app:latest
129+
# API token for Sysdig Scanning auth
130+
sysdig-secure-token: ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
131+
stop-on-failed-policy-eval: false
132+
stop-on-processing-error: true
133+
skip-summary: true
134+
135+
- name: Scan dummy-vuln-app from registry
136+
id: scan
137+
continue-on-error: true
138+
uses: ./
139+
with:
140+
# Tag of the image to analyse
141+
image-tag: sysdiglabs/dummy-vuln-app:latest
142+
# API token for Sysdig Scanning auth
143+
#sysdig-secure-token: ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
144+
stop-on-failed-policy-eval: true
145+
stop-on-processing-error: true
146+
standalone: true
147+
148+
- name: Upload SARIF file
149+
if: success() || failure() # Upload results regardless previous step fails
150+
uses: github/codeql-action/upload-sarif@v3
151+
with:
152+
sarif_file: ${{ github.workspace }}/sarif.json
153+
154+
- name: Check that the scan has failed
155+
run: |
156+
if [ "${{ steps.scan.outcome }}" == "success" ]; then
157+
echo "Scan succeeded but the step should fail."
158+
exit 1
159+
else
160+
echo "Scan failed as expected."
161+
fi

0 commit comments

Comments
 (0)