diff --git a/.github/workflows/codacy.yml b/.github/workflows/codacy.yml index 10dd8e442..f4048e485 100644 --- a/.github/workflows/codacy.yml +++ b/.github/workflows/codacy.yml @@ -15,10 +15,10 @@ name: Codacy Security Scan on: push: - branches: [ "master" ] + branches: ["master"] pull_request: # The branches below must be a subset of the branches above - branches: [ "master" ] + branches: ["master"] permissions: contents: read diff --git a/.github/workflows/devskim.yml b/.github/workflows/devskim.yml index 51de776b9..24086f8d7 100644 --- a/.github/workflows/devskim.yml +++ b/.github/workflows/devskim.yml @@ -7,9 +7,9 @@ name: DevSkim on: push: - branches: [ "master" ] + branches: ["master"] pull_request: - branches: [ "master" ] + branches: ["master"] jobs: lint: diff --git a/.github/workflows/snyk-infrastructure.yml b/.github/workflows/snyk-infrastructure.yml index 39769ed6f..6f05b13ab 100644 --- a/.github/workflows/snyk-infrastructure.yml +++ b/.github/workflows/snyk-infrastructure.yml @@ -10,16 +10,14 @@ # For more examples, including how to limit scans to only high-severity issues # and fail PR checks, see https://github.com/snyk/actions/ -name: Snyk Infrastructure as Code +name: Snyk on: push: - branches: [ "master" ] + branches: ["master"] pull_request: # The branches below must be a subset of the branches above - branches: [ "master" ] - schedule: - - cron: '39 18 * * 4' + branches: ["master"] permissions: contents: read diff --git a/.github/workflows/sysdig-scan.yml b/.github/workflows/sysdig-scan.yml index 6cfa6150c..eecfd7998 100644 --- a/.github/workflows/sysdig-scan.yml +++ b/.github/workflows/sysdig-scan.yml @@ -3,21 +3,19 @@ # separate terms of service, privacy policy, and support # documentation. -name: Sysdig - Build, scan, push and upload sarif report +name: Sysdig on: push: - branches: [ "master" ] + branches: ["master"] pull_request: - branches: [ "master" ] + branches: ["master"] permissions: contents: read jobs: - build: - permissions: checks: write # for sysdiglabs/scan-action to publish the checks contents: read # for actions/checkout to fetch code @@ -26,35 +24,35 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 - - - name: Build the Docker image - # Tag image to be built - # Change ${{ github.repository }} variable by another image name if you want but don't forget changing also image-tag below - run: docker build . --file Dockerfile --tag ${{ github.repository }}:latest - - - name: Sysdig Secure Inline Scan - id: scan - uses: sysdiglabs/scan-action@768d7626a14897e0948ea89c8437dd46a814b163 - with: - # Tag of the image to analyse. - # Change ${{ github.repository }} variable by another image name if you want but don't forget changing also image-tag above - image-tag: ${{ github.repository }}:latest - # API token for Sysdig Scanning auth - sysdig-secure-token: ${{ secrets.SYSDIG_SECURE_TOKEN}} - # Sysdig secure endpoint. Please read: https://docs.sysdig.com/en/docs/administration/saas-regions-and-ip-ranges/ - # US-East https://secure.sysdig.com - # US-West https://us2.app.sysdig.com - # EU https://eu1.app.sysdig.com - sysdig-secure-url: https://us2.app.sysdig.com - dockerfile-path: ./Dockerfile - input-type: docker-daemon - ignore-failed-scan: true - # Sysdig inline scanner requires privileged rights - run-as-user: root - - - uses: github/codeql-action/upload-sarif@v2 - #Upload SARIF file - if: always() - with: - sarif_file: ${{ steps.scan.outputs.sarifReport }} + - uses: actions/checkout@v3 + + - name: Build the Docker image + # Tag image to be built + # Change ${{ github.repository }} variable by another image name if you want but don't forget changing also image-tag below + run: docker build . --file Dockerfile --tag ${{ github.repository }}:latest + + - name: Sysdig Secure Inline Scan + id: scan + uses: sysdiglabs/scan-action@768d7626a14897e0948ea89c8437dd46a814b163 + with: + # Tag of the image to analyse. + # Change ${{ github.repository }} variable by another image name if you want but don't forget changing also image-tag above + image-tag: ${{ github.repository }}:latest + # API token for Sysdig Scanning auth + sysdig-secure-token: ${{ secrets.SYSDIG_SECURE_TOKEN}} + # Sysdig secure endpoint. Please read: https://docs.sysdig.com/en/docs/administration/saas-regions-and-ip-ranges/ + # US-East https://secure.sysdig.com + # US-West https://us2.app.sysdig.com + # EU https://eu1.app.sysdig.com + sysdig-secure-url: https://us2.app.sysdig.com + dockerfile-path: ./Dockerfile + input-type: docker-daemon + ignore-failed-scan: true + # Sysdig inline scanner requires privileged rights + run-as-user: root + + - uses: github/codeql-action/upload-sarif@v2 + #Upload SARIF file + if: always() + with: + sarif_file: ${{ steps.scan.outputs.sarifReport }}