_ecr-scanning.yml

name: "[AWS] ECR scanning results"

defaults:
  run:
    shell: bash

on:
  workflow_call:
    inputs:
      tag:
        description: 'Tag for which to check scanning results'
        required: true
        type: string
jobs:
  ecr-scan-results:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@85e6279cec87321a52edac9c87bce653a07cf6c2 # pin@v3

      - name: configure AWS credentials ECR scan results
        uses: aws-actions/configure-aws-credentials@f171d5c895855a39c1ef93ab625499424407e172 # pin@v1.7.0
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID_ACTIONS }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY_ACTIONS }}
          aws-region: eu-west-1
          role-duration-seconds: 1800
          role-session-name: OPGUseAnLPAECRScanGithubAction

      - name: install python
        uses: actions/setup-python@b8cf3eb1ebc9c7f906e4ca96fcdf2e289e25d230 # pin@v4.2.0
        with:
          python-version: '3.10'
          cache: 'pip'

      - name: install requirements
        run: pip install -r ./scripts/pipeline/check_ecr_scan_results/requirements.txt

      - name: Check ECR scan results
        env:
          TAG: ${{ inputs.tag }}
        run: python ./scripts/pipeline/check_ecr_scan_results/aws_ecr_scan_results.py --search use_an_lpa --tag ${TAG} --print_to_terminal --fail_pipe

      - name: Check ECR scan results
        run: python ./scripts/pipeline/check_ecr_scan_results/aws_ecr_scan_results.py --search pdf_service --print_to_terminal