endorlabs.yml

name: Endor Labs Scan
on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  workflow_dispatch:
    inputs:
      api:
        description: "Enter the API for Endor Labs"
        required: true
        type: choice
        default: https://api.endorlabs.com
        options:
        - https://api.staging.endorlabs.com
        - https://api.endorlabs.com
      tenant_name:
        description: "Enter your Endor Labs namespace?"
        required: true
        type: string
jobs:
  scan-repo:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
        - name: Setup namespace Environment Variables
          run: | 
            NAMESPACE=$(jq -r '.inputs.tenant_name' $GITHUB_EVENT_PATH)
            echo "::add-mask::$NAMESPACE" 
            echo NAMESPACE=$NAMESPACE >> $GITHUB_ENV

        - name: Use Caches
          uses: actions/cache@v1
          with:
            path: ~/.m2
            key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
            restore-keys: |
              ${{ runner.os }}-maven-
        
        - name: Checkout Repository
          uses: actions/checkout@v3
          
        - name: Setup Java
          uses: actions/setup-java@v3
          with:
            distribution: microsoft
            java-version: "17"

        - name: Compile Package
          run: mvn clean install
            
        - name: Endor Labs Workflow Dispatch
          if: ${{ github.event_name == 'workflow_dispatch' }}
          uses: endorlabs/github-action@736c93ea52b002f2ac229aaeb273b102cbf6fe12
          with:
            namespace: ${{ github.event.inputs.tenant_name }}
            scan_summary_output_type: "table"
            pr: "false"
            enable_github_action_token: "true"
            scan_dependencies: "true"
            scan_secrets: "true"
            scan_git_logs: "true"
            additional_args: "--as-default-branch --api=${{ github.event.inputs.api }}"