nhs-notify-web-template-management/.github/actions/scan-dependencies/action.yaml at 16fba04b815fb6b0976be96f97e5978f88d89f25 · NHSDigital/nhs-notify-web-template-management · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
name: "Scan dependencies"
description: "Scan dependencies"
inputs:
  build_datetime:
    description: "Build datetime, set by the CI/CD pipeline workflow"
    required: true
  build_timestamp:
    description: "Build timestamp, set by the CI/CD pipeline workflow"
    required: true
  idp_aws_report_upload_account_id:
    description: "IDP AWS report upload account ID to upload the report to"
    required: false
  idp_aws_report_upload_region:
    description: "IDP AWS report upload account region to upload the report to"
    required: false
  idp_aws_report_upload_role_name:
    description: "IDP AWS report upload role name for OIDC authentication"
    required: false
  idp_aws_report_upload_bucket_endpoint:
    description: "IDP AWS report upload endpoint to upload the report to"
    required: false
runs:
  using: "composite"
  steps:
    - name: "Generate SBOM"
      shell: bash
      run: |
        export BUILD_DATETIME=${{ inputs.build_datetime }}
        ./scripts/reports/create-sbom-report.sh
    - name: "Compress SBOM report"
      shell: bash
      run: zip sbom-repository-report.json.zip sbom-repository-report.json
    - name: "Upload SBOM report as an artefact"
      if: ${{ !env.ACT }}
      uses: actions/upload-artifact@v4
      with:
        name: sbom-repository-report.json.zip
        path: ./sbom-repository-report.json.zip
        retention-days: 21
    - name: "Scan vulnerabilities"
      shell: bash
      run: |
        export BUILD_DATETIME=${{ inputs.build_datetime }}
        ./scripts/reports/scan-vulnerabilities.sh
    - name: "Compress vulnerabilities report"
      shell: bash
      run: zip vulnerabilities-repository-report.json.zip vulnerabilities-repository-report.json
    - name: "Upload vulnerabilities report as an artefact"
      if: ${{ !env.ACT }}
      uses: actions/upload-artifact@v4
      with:
        name: vulnerabilities-repository-report.json.zip
        path: ./vulnerabilities-repository-report.json.zip
        retention-days: 21
    - name: "Check prerequisites for sending the reports"
      shell: bash
      id: check
      run: echo "secrets_exist=${{ inputs.idp_aws_report_upload_role_name != '' && inputs.idp_aws_report_upload_bucket_endpoint != '' }}" >> $GITHUB_OUTPUT
    - name: "Authenticate to send the reports"
      if: steps.check.outputs.secrets_exist == 'true'
      uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: arn:aws:iam::${{ inputs.idp_aws_report_upload_account_id }}:role/${{ inputs.idp_aws_report_upload_role_name }}
        aws-region: ${{ inputs.idp_aws_report_upload_region }}
    - name: "Send the SBOM and vulnerabilities reports to the central location"
      shell: bash
      if: steps.check.outputs.secrets_exist == 'true'
      run: |
        aws s3 cp \
          ./sbom-repository-report.json.zip \
          ${{ inputs.idp_aws_report_upload_bucket_endpoint }}/${{ inputs.build_timestamp }}-sbom-repository-report.json.zip
        aws s3 cp \
          ./vulnerabilities-repository-report.json.zip \
          ${{ inputs.idp_aws_report_upload_bucket_endpoint }}/${{ inputs.build_timestamp }}-vulnerabilities-repository-report.json.zip