Skip to content

Commit f9727e9

Browse files
temblekingtembleking
authored
ci: run scan on pr (#55)
* ci: run scan on pr * ci: remove job execution on macos We don't expect people running the GH Action on MacOS machines. Even the concept of creating an OCI image exclusively for MacOS doesn't make so much sense, the OCI images running on the Apple's OS are mostly Linux images.
1 parent 1338596 commit f9727e9

File tree

2 files changed

+118
-27
lines changed

2 files changed

+118
-27
lines changed

‎.github/workflows/ci-scan.yaml

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
name: Scan Image on PR
2+
3+
on:
4+
pull_request:
5+
6+
jobs:
7+
scan-from-registry:
8+
runs-on: ubuntu-latest
9+
10+
steps:
11+
# This step checks out a copy of your repository.
12+
- name: Check out repository
13+
uses: actions/checkout@v4
14+
15+
- name: Scan dummy-vuln-app from registry
16+
id: scan
17+
uses: ./
18+
continue-on-error: true
19+
with:
20+
# Tag of the image to analyse
21+
image-tag: sysdiglabs/dummy-vuln-app:latest
22+
# API token for Sysdig Scanning auth
23+
sysdig-secure-token: ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
24+
stop-on-failed-policy-eval: true
25+
stop-on-processing-error: true
26+
severity-at-least: medium
27+
28+
- name: Upload SARIF file
29+
if: success() || failure() # Upload results regardless previous step fails
30+
uses: github/codeql-action/upload-sarif@v3
31+
with:
32+
sarif_file: ${{ github.workspace }}/sarif.json
33+
34+
- name: Check that the scan has failed
35+
run: |
36+
if [ "${{ steps.scan.outcome }}" == "success" ]; then
37+
echo "Scan succeeded but the step should fail."
38+
exit 1
39+
else
40+
echo "Scan failed as expected."
41+
fi
42+
43+
filtered-scan-from-registry:
44+
runs-on: ubuntu-latest
45+
46+
steps:
47+
# This step checks out a copy of your repository.
48+
- name: Check out repository
49+
uses: actions/checkout@v4
50+
51+
- name: Scan dummy-vuln-app from registry
52+
id: scan
53+
uses: ./
54+
continue-on-error: true
55+
with:
56+
# Tag of the image to analyse
57+
image-tag: sysdiglabs/dummy-vuln-app:latest
58+
# API token for Sysdig Scanning auth
59+
sysdig-secure-token: ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
60+
stop-on-failed-policy-eval: true
61+
stop-on-processing-error: true
62+
severity-at-least: medium
63+
group-by-package: true
64+
65+
- name: Upload SARIF file
66+
if: success() || failure() # Upload results regardless previous step fails
67+
uses: github/codeql-action/upload-sarif@v3
68+
with:
69+
sarif_file: ${{ github.workspace }}/sarif.json
70+
71+
- name: Check that the scan has failed
72+
run: |
73+
if [ "${{ steps.scan.outcome }}" == "success" ]; then
74+
echo "Scan succeeded but the step should fail."
75+
exit 1
76+
else
77+
echo "Scan failed as expected."
78+
fi
79+
80+
standalone-scan-from-registry:
81+
runs-on: ubuntu-latest
82+
83+
steps:
84+
# This step checks out a copy of your repository.
85+
- name: Check out repository
86+
uses: actions/checkout@v4
87+
88+
- name: Donate MainDB from scan
89+
id: donnor-scan
90+
uses: ./
91+
with:
92+
# Tag of the image to analyse
93+
image-tag: sysdiglabs/dummy-vuln-app:latest
94+
# API token for Sysdig Scanning auth
95+
sysdig-secure-token: ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
96+
stop-on-failed-policy-eval: false
97+
stop-on-processing-error: true
98+
skip-summary: true
99+
100+
- name: Scan dummy-vuln-app from registry
101+
id: scan
102+
uses: ./
103+
with:
104+
# Tag of the image to analyse
105+
image-tag: sysdiglabs/dummy-vuln-app:latest
106+
# API token for Sysdig Scanning auth
107+
#sysdig-secure-token: ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
108+
stop-on-failed-policy-eval: true
109+
stop-on-processing-error: true
110+
standalone: true
111+
112+
- name: Upload SARIF file
113+
if: success() || failure() # Upload results regardless previous step fails
114+
uses: github/codeql-action/upload-sarif@v3
115+
with:
116+
sarif_file: ${{ github.workspace }}/sarif.json
117+

‎.github/workflows/scan.yaml

Lines changed: 1 addition & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -57,32 +57,6 @@ jobs:
5757
with:
5858
sarif_file: ${{ github.workspace }}/sarif.json
5959

60-
macos-scan-from-registry:
61-
runs-on: macos-latest
62-
63-
steps:
64-
# This step checks out a copy of your repository.
65-
- name: Check out repository
66-
uses: actions/checkout@v4
67-
68-
- name: Scan dummy-vuln-app from registry
69-
id: scan
70-
uses: ./
71-
with:
72-
# Tag of the image to analyse
73-
image-tag: sysdiglabs/dummy-vuln-app:latest
74-
# API token for Sysdig Scanning auth
75-
sysdig-secure-token: ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
76-
stop-on-failed-policy-eval: true
77-
stop-on-processing-error: true
78-
79-
- name: Upload SARIF file
80-
if: success() || failure() # Upload results regardless previous step fails
81-
uses: github/codeql-action/upload-sarif@v3
82-
with:
83-
sarif_file: ${{ github.workspace }}/sarif.json
84-
85-
8660
standalone-scan-from-registry:
8761
runs-on: ubuntu-latest
8862

@@ -119,4 +93,4 @@ jobs:
11993
if: success() || failure() # Upload results regardless previous step fails
12094
uses: github/codeql-action/upload-sarif@v3
12195
with:
122-
sarif_file: ${{ github.workspace }}/sarif.json
96+
sarif_file: ${{ github.workspace }}/sarif.json

0 commit comments

Comments
 (0)