Skip to content

Commit fb6dcc4

Browse files
baltoiteodorbaltoiteodor
committed
moved
1 parent a193c2d commit fb6dcc4

File tree

3 files changed

+154
-154
lines changed

3 files changed

+154
-154
lines changed

‎action.yaml‎

Lines changed: 90 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -1,64 +1,99 @@
11
name: 'lacework-code-security'
22
description: "Scan code with Lacework's Code Security offering"
33
author: 'Lacework'
4-
54
inputs:
6-
account:
7-
description: 'Lacework account'
8-
required: true
9-
api-key:
10-
description: 'Lacework API key'
11-
required: true
12-
secret:
13-
description: 'Lacework secret'
14-
required: true
15-
run-sca:
16-
description: 'Enable sca scanning'
17-
default: 'false'
18-
run-iac:
19-
description: 'Enable iac scanning'
20-
default: 'false'
21-
# github-token:
22-
# description: 'GitHub token for PR comments'
23-
# required: true
24-
5+
sources:
6+
description: 'Sources directory to analyze'
7+
required: false
8+
default: '.'
9+
target:
10+
description: 'One of push, old or new to represent which is being analyzed'
11+
required: false
12+
debug:
13+
description: 'Set to true to enable debug logging'
14+
required: false
15+
default: false
16+
token:
17+
description: 'Set to a GitHub token for the repository with write permissions for PRs to enable PR comments'
18+
required: false
19+
footer:
20+
description: 'A block of Markdown that will be appended to any PR comments posted'
21+
required: false
22+
eval-indirect-dependencies:
23+
description: 'Show vulnerabilities found in transitive dependencies'
24+
required: false
25+
default: false
26+
artifact-prefix:
27+
description: 'Prefix for the artifact name'
28+
required: false
29+
default: ''
30+
outputs:
31+
old-completed:
32+
description: 'If running a target called old, whether the analysis for this was completed'
33+
value: ${{ steps.run-analysis.outputs.old-completed }}
34+
new-completed:
35+
description: 'If running a target called new, whether the analysis for this was completed'
36+
value: ${{ steps.run-analysis.outputs.new-completed }}
37+
push-completed:
38+
description: 'If running a target called push, whether the analysis for this was completed'
39+
value: ${{ steps.run-analysis.outputs.push-completed }}
40+
display-completed:
41+
description: 'If displaying results, whether this was completed'
42+
value: ${{ steps.run-analysis.outputs.display-completed }}
43+
comment-posted:
44+
description: 'If a comment was posted, a link to this comment'
45+
value: ${{ steps.run-analysis.outputs.comment-posted }}
2546
runs:
2647
using: 'composite'
2748
steps:
28-
- name: Login to Docker
29-
uses: docker/login-action@v3
30-
with:
31-
username: ${{ secrets.DOCKERHUB_USERNAME }} # should be lwdevops
32-
password: ${{ secrets.DOCKERHUB_PASSWORD }}
33-
34-
- name: Run Lacework Scan
49+
- if: runner.os == 'Linux'
50+
shell: bash
51+
run: echo "LACEWORK_START_TIME=$(date --rfc-3339=seconds)" >> $GITHUB_ENV
52+
- if: runner.os == 'macOS'
53+
shell: bash
54+
run: |
55+
brew install coreutils
56+
echo "LACEWORK_START_TIME=$(gdate --rfc-3339=seconds)" >> $GITHUB_ENV
57+
- id: init
58+
shell: bash
59+
env:
60+
LACEWORK_ACTION_REF: '${{ github.action_ref }}'
3561
run: |
36-
docker run --rm \
37-
-v /var/run/docker.sock:/var/run/docker.sock \
38-
-v ${{ github.workspace }}:/workspace \
39-
-e HOST_REPO_PATH=${{ github.workspace }} \
40-
-e LW_ACCOUNT=${{ inputs.account }} \
41-
-e LW_API_KEY=${{ inputs.api-key }} \
42-
-e LW_SECRET=${{ inputs.secret }} \
43-
-e RUN_SCA=${{ inputs.run-sca }} \
44-
-e RUN_IAC=${{ inputs.run-iac }} \
45-
-e GITHUB_EVENT_NAME=${{ github.event_name }} \
46-
lacework/codesec-integrations:test
62+
LACEWORK_CONTEXT_ID=`echo $RANDOM | md5sum | head -c 32`
63+
echo "Lacework context ID: $LACEWORK_CONTEXT_ID"
64+
echo "LACEWORK_CONTEXT_ID=$(echo $LACEWORK_CONTEXT_ID)" >> $GITHUB_ENV
65+
echo "LACEWORK_ACTION_REF=$(echo $LACEWORK_ACTION_REF)" >> $GITHUB_ENV
66+
curl https://raw.githubusercontent.com/lacework/go-sdk/main/cli/install.sh | bash
67+
- name: Sets LW_LOG var for debug
4768
shell: bash
48-
49-
# - name: Comment on PR
50-
# if: github.event_name == 'pull_request'
51-
# uses: actions/github-script@v7
52-
# with:
53-
# github-token: ${{ inputs.github-token }}
54-
# script: |
55-
# const fs = require('fs');
56-
# if (fs.existsSync('output_markdown.md')) {
57-
# const comment = fs.readFileSync('output_markdown.md', 'utf8');
58-
# github.rest.issues.createComment({
59-
# owner: context.repo.owner,
60-
# repo: context.repo.repo,
61-
# issue_number: context.issue.number,
62-
# body: comment
63-
# });
64-
# }
69+
if: ${{ inputs.debug == 'true' }}
70+
run: |
71+
echo "LW_LOG=debug" >> $GITHUB_ENV
72+
- name: Install Lacework CLI component
73+
shell: bash
74+
run: |
75+
lacework --noninteractive -a "${LW_ACCOUNT_NAME}" -k "${LW_API_KEY}" -s "${LW_API_SECRET}" component install sca
76+
lacework --noninteractive -a "${LW_ACCOUNT_NAME}" -k "${LW_API_KEY}" -s "${LW_API_SECRET}" version
77+
env:
78+
CDK_DOWNLOAD_TIMEOUT_MINUTES: 2
79+
- uses: actions/setup-node@v4
80+
with:
81+
node-version: 18
82+
- shell: bash
83+
run: |
84+
rm -rf ../lacework-code-security
85+
cp -r "${{ github.action_path }}" ../lacework-code-security
86+
cd ../lacework-code-security
87+
HUSKY=0 npm install
88+
npm run compile
89+
yq -i -o yaml 'del(.runs.steps) | del(.outputs) | .runs.using="node16" | .runs.main="dist/src/index.js" | .runs.post="dist/src/post.js"' action.yaml
90+
- id: run-analysis
91+
uses: './../lacework-code-security'
92+
with:
93+
sources: '${{ inputs.sources }}'
94+
target: '${{ inputs.target }}'
95+
debug: '${{ inputs.debug }}'
96+
token: '${{ inputs.token || github.token }}'
97+
footer: '${{ inputs.footer }}'
98+
eval-indirect-dependencies: '${{ inputs.eval-indirect-dependencies }}'
99+
artifact-prefix: '${{ inputs.artifact-prefix }}'

‎action_main.yaml‎

Lines changed: 0 additions & 99 deletions
This file was deleted.

‎test-image/action.yaml‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
name: 'lacework-code-security'
2+
description: "Scan code with Lacework's Code Security offering"
3+
author: 'Lacework'
4+
5+
inputs:
6+
account:
7+
description: 'Lacework account'
8+
required: true
9+
api-key:
10+
description: 'Lacework API key'
11+
required: true
12+
secret:
13+
description: 'Lacework secret'
14+
required: true
15+
run-sca:
16+
description: 'Enable sca scanning'
17+
default: 'false'
18+
run-iac:
19+
description: 'Enable iac scanning'
20+
default: 'false'
21+
# github-token:
22+
# description: 'GitHub token for PR comments'
23+
# required: true
24+
25+
runs:
26+
using: 'composite'
27+
steps:
28+
- name: Login to Docker
29+
uses: docker/login-action@v3
30+
with:
31+
username: ${{ secrets.DOCKERHUB_USERNAME }} # should be lwdevops
32+
password: ${{ secrets.DOCKERHUB_PASSWORD }}
33+
34+
- name: Run Lacework Scan
35+
run: |
36+
docker run --rm \
37+
-v /var/run/docker.sock:/var/run/docker.sock \
38+
-v ${{ github.workspace }}:/workspace \
39+
-e HOST_REPO_PATH=${{ github.workspace }} \
40+
-e LW_ACCOUNT=${{ inputs.account }} \
41+
-e LW_API_KEY=${{ inputs.api-key }} \
42+
-e LW_SECRET=${{ inputs.secret }} \
43+
-e RUN_SCA=${{ inputs.run-sca }} \
44+
-e RUN_IAC=${{ inputs.run-iac }} \
45+
-e GITHUB_EVENT_NAME=${{ github.event_name }} \
46+
lacework/codesec-integrations:test
47+
shell: bash
48+
49+
# - name: Comment on PR
50+
# if: github.event_name == 'pull_request'
51+
# uses: actions/github-script@v7
52+
# with:
53+
# github-token: ${{ inputs.github-token }}
54+
# script: |
55+
# const fs = require('fs');
56+
# if (fs.existsSync('output_markdown.md')) {
57+
# const comment = fs.readFileSync('output_markdown.md', 'utf8');
58+
# github.rest.issues.createComment({
59+
# owner: context.repo.owner,
60+
# repo: context.repo.repo,
61+
# issue_number: context.issue.number,
62+
# body: comment
63+
# });
64+
# }

0 commit comments

Comments
 (0)