Skip to content

feat: P4ADEV-1101 p4pa-auth - create an api that given a client id returns the client secret #27

feat: P4ADEV-1101 p4pa-auth - create an api that given a client id returns the client secret

feat: P4ADEV-1101 p4pa-auth - create an api that given a client id returns the client secret #27

Workflow file for this run

# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.
# This workflow checks out code, builds an image, performs a container image
# vulnerability scan with Trivy tool, and integrates the results with GitHub Advanced Security
# code scanning feature.
name: Container Scan
on:
pull_request:
# The branches below must be a subset of the branches above
branches: [ "develop", "uat", "main" ]
workflow_dispatch:
schedule:
- cron: '00 07 * * *'
permissions:
contents: read
jobs:
BuildAndScan:
permissions:
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
runs-on: ubuntu-latest
outputs:
CVE_CRITICAL: ${{env.CVE_CRITICAL}}
CVE_HIGH: ${{env.CVE_HIGH}}
CVE_MEDIUM: ${{env.CVE_MEDIUM}}
steps:
- name: Checkout the code
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
- name: Build the Docker image
run: docker build . --file Dockerfile --tag localbuild/testimage:latest
- name: Run the Trivy scan action itself with GitHub Advanced Security code scanning integration enabled
id: scan
uses: aquasecurity/[email protected] #v0.24.0
with:
trivy-config: 'config/trivy.yaml'
image-ref: "localbuild/testimage:latest"
format: 'sarif'
output: 'results.sarif'
- name: Upload Anchore Scan Report
uses: github/codeql-action/upload-sarif@99c9897648dded3fe63d6f328c46089dd57735ca #codeql bundle v2.17.0
with:
sarif_file: 'results.sarif'
- name: CVE Description escaped extraction and print
run: |
SCAN_RESULTS=$(jq -r 'try .runs[0].tool.driver.rules | map(.help.text) | join("\\n")' results.sarif)
echo "CVE_CRITICAL=$(echo $SCAN_RESULTS | grep -o CRITICAL | wc -l)" >> $GITHUB_ENV
echo "CVE_HIGH=$(echo $SCAN_RESULTS | grep -o HIGH | wc -l)" >> $GITHUB_ENV
echo "CVE_MEDIUM=$(echo $SCAN_RESULTS | grep -o MEDIUM | wc -l)" >> $GITHUB_ENV
echo $SCAN_RESULTS
- name: Fails if CVE HIGH or CRITICAL are detected
id: cve-threshold
if: env.CVE_HIGH > 0 || env.CVE_CRITICAL > 0
run: exit 1
SendSlackNotification:
needs: BuildAndScan
uses: ./.github/workflows/send-notification.yml
if: always() && needs.BuildAndScan.result == 'failure'
with:
CVE_CRITICAL: ${{needs.BuildAndScan.outputs.CVE_CRITICAL}}
CVE_HIGH: ${{needs.BuildAndScan.outputs.CVE_HIGH}}
CVE_MEDIUM: ${{needs.BuildAndScan.outputs.CVE_MEDIUM}}
secrets: inherit