Add aqua Workflow
This commit is contained in:
parent
c962aabb31
commit
7a6eada3fe
100
.github/workflows/main.yml
vendored
Normal file
100
.github/workflows/main.yml
vendored
Normal file
|
@ -0,0 +1,100 @@
|
||||||
|
name: build
|
||||||
|
on:
|
||||||
|
push:
|
||||||
|
branches:
|
||||||
|
- main
|
||||||
|
- master
|
||||||
|
- poggenpower*
|
||||||
|
pull_request:
|
||||||
|
branches:
|
||||||
|
- main
|
||||||
|
# comment
|
||||||
|
env:
|
||||||
|
# Use docker.io for Docker Hub if empty
|
||||||
|
REGISTRY: ghcr.io
|
||||||
|
# github.repository as <account>/<repo>
|
||||||
|
IMAGE_NAME: ${{ github.repository }}
|
||||||
|
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
checkout:
|
||||||
|
name: Checkout
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
permissions:
|
||||||
|
contents: read
|
||||||
|
packages: write
|
||||||
|
id-token: write
|
||||||
|
|
||||||
|
steps:
|
||||||
|
- name: Checkout code
|
||||||
|
uses: actions/checkout@v3
|
||||||
|
- name: Setup pipeline enforcer
|
||||||
|
uses: aquasecurity/pipeline-enforcer-action@v1.0.0
|
||||||
|
with:
|
||||||
|
aqua-key: ${{ secrets.AQUA_KEY }}
|
||||||
|
aqua-secret: ${{ secrets.AQUA_SECRET }}
|
||||||
|
- name: Set up Docker Buildx
|
||||||
|
uses: docker/setup-buildx-action@v2
|
||||||
|
|
||||||
|
- name: Log into registry ${{ env.REGISTRY }}
|
||||||
|
uses: docker/login-action@v2.1.0
|
||||||
|
with:
|
||||||
|
registry: ${{ env.REGISTRY }}
|
||||||
|
username: ${{ github.actor }}
|
||||||
|
password: ${{ secrets.GITHUB_TOKEN }}
|
||||||
|
#- name: Run Aqua scanner
|
||||||
|
# uses: docker://aquasec/aqua-scanner
|
||||||
|
# with:
|
||||||
|
# args: trivy fs -d --scanners config,vuln,secret --sast .
|
||||||
|
# # To customize which severities to scan for, add the following flag: --severity UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
|
||||||
|
# # To enable SAST scanning, add: --sast
|
||||||
|
# # To enable npm/dotnet non-lock file scanning, add: --package-json / --dotnet-proj
|
||||||
|
# env:
|
||||||
|
# AQUA_KEY: ${{ secrets.AQUA_KEY }}
|
||||||
|
# AQUA_SECRET: ${{ secrets.AQUA_SECRET }}
|
||||||
|
# GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||||
|
# TRIVY_RUN_AS_PLUGIN: 'aqua'
|
||||||
|
# # For http/https proxy configuration add env vars: HTTP_PROXY/HTTPS_PROXY, CA-CRET (path to CA certificate)
|
||||||
|
# Extract metadata (tags, labels) for Docker
|
||||||
|
# https://github.com/docker/metadata-action
|
||||||
|
- name: Extract Docker metadata
|
||||||
|
id: meta
|
||||||
|
uses: docker/metadata-action@v2.1.0
|
||||||
|
with:
|
||||||
|
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
|
||||||
|
|
||||||
|
# Build and push Docker image with Buildx (don't push on PR)
|
||||||
|
# https://github.com/docker/build-push-action
|
||||||
|
- name: Build and push Docker image
|
||||||
|
id: build-and-push
|
||||||
|
uses: docker/build-push-action@v3
|
||||||
|
with:
|
||||||
|
context: .
|
||||||
|
push: true
|
||||||
|
tags: ${{ steps.meta.outputs.tags }}
|
||||||
|
labels: ${{ steps.meta.outputs.labels }}
|
||||||
|
cache-from: type=gha
|
||||||
|
cache-to: type=gha,mode=max
|
||||||
|
- name: Run Aqua scanner
|
||||||
|
uses: docker://aquasec/aqua-scanner
|
||||||
|
with:
|
||||||
|
args: trivy image -d --scanners config,vuln,secret "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.tags }}"
|
||||||
|
# To customize which severities to scan for, add the following flag: --severity UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
|
||||||
|
# To enable SAST scanning, add: --sast
|
||||||
|
# To enable npm/dotnet non-lock file scanning, add: --package-json / --dotnet-proj
|
||||||
|
env:
|
||||||
|
AQUA_KEY: ${{ secrets.AQUA_KEY }}
|
||||||
|
AQUA_SECRET: ${{ secrets.AQUA_SECRET }}
|
||||||
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||||
|
TRIVY_RUN_AS_PLUGIN: 'aqua'
|
||||||
|
# For http/https proxy configuration add env vars: HTTP_PROXY/HTTPS_PROXY, CA-CRET (path to CA certificate)
|
||||||
|
- name: Manifest Generation
|
||||||
|
run: |
|
||||||
|
docker image ls
|
||||||
|
echo ${{ secrets.GITHUB_TOKEN }} | wc
|
||||||
|
curl -L download.codesec.aquasec.com/billy/install.sh | sh
|
||||||
|
billy generate \
|
||||||
|
--access-token "${{ secrets.PERSONAL_GH_TOKEN }}" \
|
||||||
|
--aqua-key "${{ secrets.AQUA_KEY }}" \
|
||||||
|
--aqua-secret "${{ secrets.AQUA_SECRET }}" \
|
||||||
|
--artifact-path "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.meta.outputs.tags }}"
|
Loading…
Reference in New Issue
Block a user