Skip to content

Commit a193c2d

Browse files
baltoiteodorbaltoiteodor
committed
test new docker image for git integrations
1 parent f93d6c2 commit a193c2d

File tree

2 files changed

+154
-90
lines changed

2 files changed

+154
-90
lines changed

‎action.yaml‎

Lines changed: 55 additions & 90 deletions
Original file line numberDiff line numberDiff line change
@@ -1,99 +1,64 @@
11
name: 'lacework-code-security'
22
description: "Scan code with Lacework's Code Security offering"
33
author: 'Lacework'
4+
45
inputs:
5-
sources:
6-
description: 'Sources directory to analyze'
7-
required: false
8-
default: '.'
9-
target:
10-
description: 'One of push, old or new to represent which is being analyzed'
11-
required: false
12-
debug:
13-
description: 'Set to true to enable debug logging'
14-
required: false
15-
default: false
16-
token:
17-
description: 'Set to a GitHub token for the repository with write permissions for PRs to enable PR comments'
18-
required: false
19-
footer:
20-
description: 'A block of Markdown that will be appended to any PR comments posted'
21-
required: false
22-
eval-indirect-dependencies:
23-
description: 'Show vulnerabilities found in transitive dependencies'
24-
required: false
25-
default: false
26-
artifact-prefix:
27-
description: 'Prefix for the artifact name'
28-
required: false
29-
default: ''
30-
outputs:
31-
old-completed:
32-
description: 'If running a target called old, whether the analysis for this was completed'
33-
value: ${{ steps.run-analysis.outputs.old-completed }}
34-
new-completed:
35-
description: 'If running a target called new, whether the analysis for this was completed'
36-
value: ${{ steps.run-analysis.outputs.new-completed }}
37-
push-completed:
38-
description: 'If running a target called push, whether the analysis for this was completed'
39-
value: ${{ steps.run-analysis.outputs.push-completed }}
40-
display-completed:
41-
description: 'If displaying results, whether this was completed'
42-
value: ${{ steps.run-analysis.outputs.display-completed }}
43-
comment-posted:
44-
description: 'If a comment was posted, a link to this comment'
45-
value: ${{ steps.run-analysis.outputs.comment-posted }}
6+
account:
7+
description: 'Lacework account'
8+
required: true
9+
api-key:
10+
description: 'Lacework API key'
11+
required: true
12+
secret:
13+
description: 'Lacework secret'
14+
required: true
15+
run-sca:
16+
description: 'Enable sca scanning'
17+
default: 'false'
18+
run-iac:
19+
description: 'Enable iac scanning'
20+
default: 'false'
21+
# github-token:
22+
# description: 'GitHub token for PR comments'
23+
# required: true
24+
4625
runs:
4726
using: 'composite'
4827
steps:
49-
- if: runner.os == 'Linux'
50-
shell: bash
51-
run: echo "LACEWORK_START_TIME=$(date --rfc-3339=seconds)" >> $GITHUB_ENV
52-
- if: runner.os == 'macOS'
53-
shell: bash
54-
run: |
55-
brew install coreutils
56-
echo "LACEWORK_START_TIME=$(gdate --rfc-3339=seconds)" >> $GITHUB_ENV
57-
- id: init
58-
shell: bash
59-
env:
60-
LACEWORK_ACTION_REF: '${{ github.action_ref }}'
28+
- name: Login to Docker
29+
uses: docker/login-action@v3
30+
with:
31+
username: ${{ secrets.DOCKERHUB_USERNAME }} # should be lwdevops
32+
password: ${{ secrets.DOCKERHUB_PASSWORD }}
33+
34+
- name: Run Lacework Scan
6135
run: |
62-
LACEWORK_CONTEXT_ID=`echo $RANDOM | md5sum | head -c 32`
63-
echo "Lacework context ID: $LACEWORK_CONTEXT_ID"
64-
echo "LACEWORK_CONTEXT_ID=$(echo $LACEWORK_CONTEXT_ID)" >> $GITHUB_ENV
65-
echo "LACEWORK_ACTION_REF=$(echo $LACEWORK_ACTION_REF)" >> $GITHUB_ENV
66-
curl https://raw.githubusercontent.com/lacework/go-sdk/main/cli/install.sh | bash
67-
- name: Sets LW_LOG var for debug
36+
docker run --rm \
37+
-v /var/run/docker.sock:/var/run/docker.sock \
38+
-v ${{ github.workspace }}:/workspace \
39+
-e HOST_REPO_PATH=${{ github.workspace }} \
40+
-e LW_ACCOUNT=${{ inputs.account }} \
41+
-e LW_API_KEY=${{ inputs.api-key }} \
42+
-e LW_SECRET=${{ inputs.secret }} \
43+
-e RUN_SCA=${{ inputs.run-sca }} \
44+
-e RUN_IAC=${{ inputs.run-iac }} \
45+
-e GITHUB_EVENT_NAME=${{ github.event_name }} \
46+
lacework/codesec-integrations:test
6847
shell: bash
69-
if: ${{ inputs.debug == 'true' }}
70-
run: |
71-
echo "LW_LOG=debug" >> $GITHUB_ENV
72-
- name: Install Lacework CLI component
73-
shell: bash
74-
run: |
75-
lacework --noninteractive -a "${LW_ACCOUNT_NAME}" -k "${LW_API_KEY}" -s "${LW_API_SECRET}" component install sca
76-
lacework --noninteractive -a "${LW_ACCOUNT_NAME}" -k "${LW_API_KEY}" -s "${LW_API_SECRET}" version
77-
env:
78-
CDK_DOWNLOAD_TIMEOUT_MINUTES: 2
79-
- uses: actions/setup-node@v4
80-
with:
81-
node-version: 18
82-
- shell: bash
83-
run: |
84-
rm -rf ../lacework-code-security
85-
cp -r "${{ github.action_path }}" ../lacework-code-security
86-
cd ../lacework-code-security
87-
HUSKY=0 npm install
88-
npm run compile
89-
yq -i -o yaml 'del(.runs.steps) | del(.outputs) | .runs.using="node16" | .runs.main="dist/src/index.js" | .runs.post="dist/src/post.js"' action.yaml
90-
- id: run-analysis
91-
uses: './../lacework-code-security'
92-
with:
93-
sources: '${{ inputs.sources }}'
94-
target: '${{ inputs.target }}'
95-
debug: '${{ inputs.debug }}'
96-
token: '${{ inputs.token || github.token }}'
97-
footer: '${{ inputs.footer }}'
98-
eval-indirect-dependencies: '${{ inputs.eval-indirect-dependencies }}'
99-
artifact-prefix: '${{ inputs.artifact-prefix }}'
48+
49+
# - name: Comment on PR
50+
# if: github.event_name == 'pull_request'
51+
# uses: actions/github-script@v7
52+
# with:
53+
# github-token: ${{ inputs.github-token }}
54+
# script: |
55+
# const fs = require('fs');
56+
# if (fs.existsSync('output_markdown.md')) {
57+
# const comment = fs.readFileSync('output_markdown.md', 'utf8');
58+
# github.rest.issues.createComment({
59+
# owner: context.repo.owner,
60+
# repo: context.repo.repo,
61+
# issue_number: context.issue.number,
62+
# body: comment
63+
# });
64+
# }

‎action_main.yaml‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
name: 'lacework-code-security'
2+
description: "Scan code with Lacework's Code Security offering"
3+
author: 'Lacework'
4+
inputs:
5+
sources:
6+
description: 'Sources directory to analyze'
7+
required: false
8+
default: '.'
9+
target:
10+
description: 'One of push, old or new to represent which is being analyzed'
11+
required: false
12+
debug:
13+
description: 'Set to true to enable debug logging'
14+
required: false
15+
default: false
16+
token:
17+
description: 'Set to a GitHub token for the repository with write permissions for PRs to enable PR comments'
18+
required: false
19+
footer:
20+
description: 'A block of Markdown that will be appended to any PR comments posted'
21+
required: false
22+
eval-indirect-dependencies:
23+
description: 'Show vulnerabilities found in transitive dependencies'
24+
required: false
25+
default: false
26+
artifact-prefix:
27+
description: 'Prefix for the artifact name'
28+
required: false
29+
default: ''
30+
outputs:
31+
old-completed:
32+
description: 'If running a target called old, whether the analysis for this was completed'
33+
value: ${{ steps.run-analysis.outputs.old-completed }}
34+
new-completed:
35+
description: 'If running a target called new, whether the analysis for this was completed'
36+
value: ${{ steps.run-analysis.outputs.new-completed }}
37+
push-completed:
38+
description: 'If running a target called push, whether the analysis for this was completed'
39+
value: ${{ steps.run-analysis.outputs.push-completed }}
40+
display-completed:
41+
description: 'If displaying results, whether this was completed'
42+
value: ${{ steps.run-analysis.outputs.display-completed }}
43+
comment-posted:
44+
description: 'If a comment was posted, a link to this comment'
45+
value: ${{ steps.run-analysis.outputs.comment-posted }}
46+
runs:
47+
using: 'composite'
48+
steps:
49+
- if: runner.os == 'Linux'
50+
shell: bash
51+
run: echo "LACEWORK_START_TIME=$(date --rfc-3339=seconds)" >> $GITHUB_ENV
52+
- if: runner.os == 'macOS'
53+
shell: bash
54+
run: |
55+
brew install coreutils
56+
echo "LACEWORK_START_TIME=$(gdate --rfc-3339=seconds)" >> $GITHUB_ENV
57+
- id: init
58+
shell: bash
59+
env:
60+
LACEWORK_ACTION_REF: '${{ github.action_ref }}'
61+
run: |
62+
LACEWORK_CONTEXT_ID=`echo $RANDOM | md5sum | head -c 32`
63+
echo "Lacework context ID: $LACEWORK_CONTEXT_ID"
64+
echo "LACEWORK_CONTEXT_ID=$(echo $LACEWORK_CONTEXT_ID)" >> $GITHUB_ENV
65+
echo "LACEWORK_ACTION_REF=$(echo $LACEWORK_ACTION_REF)" >> $GITHUB_ENV
66+
curl https://raw.githubusercontent.com/lacework/go-sdk/main/cli/install.sh | bash
67+
- name: Sets LW_LOG var for debug
68+
shell: bash
69+
if: ${{ inputs.debug == 'true' }}
70+
run: |
71+
echo "LW_LOG=debug" >> $GITHUB_ENV
72+
- name: Install Lacework CLI component
73+
shell: bash
74+
run: |
75+
lacework --noninteractive -a "${LW_ACCOUNT_NAME}" -k "${LW_API_KEY}" -s "${LW_API_SECRET}" component install sca
76+
lacework --noninteractive -a "${LW_ACCOUNT_NAME}" -k "${LW_API_KEY}" -s "${LW_API_SECRET}" version
77+
env:
78+
CDK_DOWNLOAD_TIMEOUT_MINUTES: 2
79+
- uses: actions/setup-node@v4
80+
with:
81+
node-version: 18
82+
- shell: bash
83+
run: |
84+
rm -rf ../lacework-code-security
85+
cp -r "${{ github.action_path }}" ../lacework-code-security
86+
cd ../lacework-code-security
87+
HUSKY=0 npm install
88+
npm run compile
89+
yq -i -o yaml 'del(.runs.steps) | del(.outputs) | .runs.using="node16" | .runs.main="dist/src/index.js" | .runs.post="dist/src/post.js"' action.yaml
90+
- id: run-analysis
91+
uses: './../lacework-code-security'
92+
with:
93+
sources: '${{ inputs.sources }}'
94+
target: '${{ inputs.target }}'
95+
debug: '${{ inputs.debug }}'
96+
token: '${{ inputs.token || github.token }}'
97+
footer: '${{ inputs.footer }}'
98+
eval-indirect-dependencies: '${{ inputs.eval-indirect-dependencies }}'
99+
artifact-prefix: '${{ inputs.artifact-prefix }}'

0 commit comments

Comments
 (0)