action.yaml

name: "Mondoo Github Repository Action"
description: "Scan Github repository for misconfigurations with Mondoo"
branding:
  icon: "shield"
  color: "purple"
inputs:
  repository:
    description: GitHub Repository
    required: true
  token:
    description: GitHub Authentication Token
    required: true
  args:
    description: >-
      Additional arguments to pass to Mondoo Client.
    required: false
  log-level:
    description: >-
      Sets the log level: error, warn, info, debug, trace (default "info")
    default: info
    required: false
  output:
    description: >-
      Set the output format for scan results: compact, yaml, json, junit, csv, summary, full, report (default "compact")
    default: compact
    required: false
  score-threshold:
    description: >-
      Sets the score threshold for scans. Scores that fall below the threshold will exit 1. (default "0" - job continues regardless of the score returned by a scan).
    default: "0"
    required: false
  service-account-credentials:
    description: "Base64 encoded service account credentials used to authenticate with Mondoo Platform"
    required: true
  is-cicd:
    description: "Automatically detects the GitHub Action Runs and report results into the CI/CD view"
    default: true
runs:
  using: "composite"
  steps:
    - name: Install Mondoo Client
      shell: bash
      run: |
        echo Installing Mondoo Client...
        echo ${{ inputs.service-account-credentials }} | base64 -d > mondoo.json
        curl -sSL https://mondoo.com/install.sh | bash
    - name: Mondoo status
      shell: bash
      run: mondoo status --config mondoo.json
    - name: Run mondoo scan ${{ inputs.asset-type }}
      shell: bash
      run: >
        mondoo scan github repo ${{ inputs.repository }}  --token "${{ inputs.token }}"
        --log-level "${{ inputs.log-level }}"
        --output "${{ inputs.output }}"
        --score-threshold "${{ inputs.score-threshold }}"
        --detect-cicd="${{ inputs.is-cicd }}"
        --config mondoo.json
        ${{ inputs.args }}