CHEF-21894: Add Gemfile.lock and comprehensive CI workflow for BlackDuck SCA #811
+421
−45
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…uck SCA - Added Gemfile.lock for accurate dependency scanning - Replaced minimal trufflehog-only workflow with comprehensive CI pipeline - Enabled BlackDuck SCA scanning with HIGH accuracy threshold - Enabled BlackDuck SAST (Polaris) scanning for security vulnerabilities - Added Trivy container scanning - Enabled SBOM generation (GitHub SPDX + BlackDuck formats) - Configured build step required for dependency analysis - Force-added Gemfile.lock despite .gitignore for SBOM accuracy This change aligns Train repository with InSpec 5.x CI/CD standards, enabling comprehensive security scanning and dependency analysis. BlackDuck SCA requires Gemfile.lock to accurately identify all Ruby gem dependencies and their versions for vulnerability scanning. Changes: - New: .github/workflows/ci-main-pull-request-stub.yml (comprehensive CI) - Removed: .github/workflows/ci-main-pull-request-stub-trufflehog-only.yml - Added: Gemfile.lock (121 gems) Signed-off-by: Samir Anand <[email protected]>
sa-progress
added
the
ai-assisted
Contributor
|
@sa-progress hold on merging this |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds Gemfile.lock and replaces the minimal trufflehog-only workflow with a comprehensive CI/CD pipeline aligned with InSpec 5.x standards, enabling full BlackDuck SCA and SAST scanning for the Train repository.
Changes
.github/workflows/ci-main-pull-request-stub.yml.github/workflows/ci-main-pull-request-stub-trufflehog-only.ymlWhy This Change?
BlackDuck SCA requires Gemfile.lock to accurately identify all Ruby gem dependencies and their specific versions for comprehensive vulnerability scanning. The previous trufflehog-only workflow provided minimal security scanning. This update brings Train's CI/CD pipeline to parity with InSpec 5.x standards.
CI/CD Enhancements
AI Compliance
🤖 This PR was created with AI assistance (GitHub Copilot)
Testing
bundle install(121 gems)JIRA
CHEF-21894
Configuration Details