|
1 | 1 | name: Arm AL2023 Smoke Test WorkFlow |
2 | 2 | on: |
3 | | - push: |
4 | | - branches: |
5 | | - - develop |
6 | | - - main |
| 3 | + workflow_dispatch: |
7 | 4 | jobs: |
8 | 5 | check-formating: |
9 | 6 | runs-on: ubuntu-latest |
@@ -104,60 +101,8 @@ jobs: |
104 | 101 | env: |
105 | 102 | COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }} |
106 | 103 | COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }} |
107 | | - vulnerability-scan: |
108 | | - permissions: |
109 | | - actions: read |
110 | | - contents: read |
111 | | - security-events: write |
112 | | - runs-on: ubuntu-latest |
113 | | - needs: build-operator-image-arm-al2023 |
114 | | - env: |
115 | | - SPLUNK_ENTERPRISE_IMAGE: ${{ secrets.SPLUNK_ENTERPRISE_IMAGE }} |
116 | | - SPLUNK_OPERATOR_IMAGE_NAME: splunk/splunk-operator |
117 | | - ECR_REPOSITORY: ${{ secrets.ECR_REPOSITORY }} |
118 | | - S3_REGION: ${{ secrets.AWS_DEFAULT_REGION }} |
119 | | - IMAGE_NAME: ${{ secrets.ECR_REPOSITORY }}/splunk/splunk-operator:${{ github.sha }} |
120 | | - steps: |
121 | | - - name: Set up cosign |
122 | | - uses: sigstore/cosign-installer@main |
123 | | - - uses: actions/checkout@v2 |
124 | | - - name: Dotenv Action |
125 | | - id: dotenv |
126 | | - uses: falti/dotenv-action@d4d12eaa0e1dd06d5bdc3d7af3bf4c8c93cb5359 |
127 | | - - name: Set up Docker Buildx |
128 | | - |
129 | | - - name: Configure AWS credentials |
130 | | - uses: aws-actions/configure-aws-credentials@v1 |
131 | | - with: |
132 | | - aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} |
133 | | - aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} |
134 | | - aws-region: ${{ secrets.AWS_DEFAULT_REGION }} |
135 | | - |
136 | | - - name: Login to Amazon ECR |
137 | | - uses: aws-actions/amazon-ecr-login@v1 |
138 | | - - name: Pull Splunk Operator Image Locally |
139 | | - run: | |
140 | | - docker pull ${{ env.IMAGE_NAME }} |
141 | | - - name: Verify Signed Splunk Operator image |
142 | | - run: | |
143 | | - cosign verify --key env://COSIGN_PUBLIC_KEY ${{ env.IMAGE_NAME }} |
144 | | - env: |
145 | | - COSIGN_PUBLIC_KEY: ${{ secrets.COSIGN_PUBLIC_KEY }} |
146 | | - - name: Run Trivy vulnerability scanner |
147 | | - uses: aquasecurity/trivy-action@master |
148 | | - with: |
149 | | - image-ref: '${{ env.IMAGE_NAME }}' |
150 | | - format: sarif |
151 | | - #exit-code: 1 |
152 | | - severity: 'CRITICAL' |
153 | | - ignore-unfixed: true |
154 | | - output: 'trivy-results.sarif' |
155 | | - - name: Upload Trivy scan results to GitHub Security tab |
156 | | - uses: github/codeql-action/upload-sarif@v3 |
157 | | - with: |
158 | | - sarif_file: 'trivy-results.sarif' |
159 | 104 | smoke-tests-arm-al2023: |
160 | | - needs: vulnerability-scan |
| 105 | + needs: build-operator-image-arm-al2023 |
161 | 106 | strategy: |
162 | 107 | fail-fast: false |
163 | 108 | matrix: |
|
0 commit comments