add wiz scan on create PR to master and remove lacework(SWG-14342) #189
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build Test PR 3.0 | |
| on: | |
| pull_request: | |
| branches: [ "3.0.0" ] | |
| jobs: | |
| build_pr_30: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| java: [ 11, 17 ] | |
| outputs: | |
| docker_tag: ${{ steps.build_image.outputs.tag }} | |
| env: | |
| GENERATORS_VERSION_PROPERTY: "" | |
| MAVEN_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }} | |
| MAVEN_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| name: Checkout swagger-codegen (3.0.0) | |
| with: | |
| ref: 3.0.0 | |
| - name: Set up Java | |
| uses: actions/setup-java@v4 | |
| with: | |
| java-version: ${{ matrix.java }} | |
| distribution: temurin | |
| cache: maven | |
| overwrite-settings: false | |
| - name: Add Central-Portal snapshot repo to settings.xml | |
| uses: s4u/[email protected] | |
| with: | |
| repositories: | | |
| [ | |
| { | |
| "id": "central-portal-snapshots", | |
| "name": "Sonatype Central Portal snapshots", | |
| "url": "https://central.sonatype.com/repository/maven-snapshots/", | |
| "releases": { "enabled": false }, | |
| "snapshots": { "enabled": true } | |
| } | |
| ] | |
| servers: | | |
| [ | |
| { | |
| "id": "central", | |
| "username": "${{ secrets.MAVEN_CENTRAL_USERNAME }}", | |
| "password": "${{ secrets.MAVEN_CENTRAL_PASSWORD }}" | |
| } | |
| ] | |
| - name: preliminary checks | |
| run: | | |
| docker login --username=${{ secrets.DOCKERHUB_SB_USERNAME }} --password=${{ secrets.DOCKERHUB_SB_PASSWORD }} | |
| set -e | |
| /bin/bash ./bin/utils/detect_carriage_return.sh | |
| /bin/bash ./bin/utils/detect_merge_conflict.sh | |
| /bin/bash ./bin/utils/detect_tab_in_java_class.sh | |
| # ── NEW: clone & build generators before codegen ──────────────────────────── | |
| - name: Resolve generators version | |
| id: gen_version | |
| run: | | |
| # extract version from codegen pom.xml | |
| VER=$(sed -n 's/.*<swagger-codegen-generators-version>\([^<]*\)<\/swagger-codegen-generators-version>.*/\1/p' pom.xml | tr -d '[:space:]') | |
| echo "GEN_VER=$VER" >> $GITHUB_OUTPUT | |
| - name: Checkout swagger-codegen-generators | |
| uses: actions/checkout@v4 | |
| with: | |
| repository: swagger-api/swagger-codegen-generators | |
| path: generators | |
| # assume tags are named like “v1.0.58-SNAPSHOT” or “1.0.58-SNAPSHOT” | |
| ref: ${{ steps.gen_version.outputs.GEN_VER }} | |
| - name: Build & install swagger-codegen-generators | |
| run: | | |
| pushd generators | |
| mvn clean install -DskipTests -B | |
| popd | |
| # ── end generators bootstrap ─────────────────────────────────────────────── | |
| - name: Build with Maven | |
| if: ${{ matrix.java != 8 }} | |
| run: | | |
| # your existing logic to resolve snapshot vs release remains unchanged: | |
| export MY_POM_VERSION=$(mvn -Dswagger-codegen-generators-version=1.0.37 \ | |
| -q -Dexec.executable="echo" -Dexec.args='${projects.version}' \ | |
| --non-recursive org.codehaus.mojo:exec-maven-plugin:1.3.1:exec) | |
| echo "POM VERSION ${MY_POM_VERSION}" | |
| export GENERATORS_VERSION=$(sed -n 's/.*<swagger\-codegen\-generators\-version>\([^<]*\)<\/swagger\-codegen\-generators\-version>.*/\1/p' pom.xml | tr -d '[:space:]') | |
| echo "GENERATORS_VERSION ${GENERATORS_VERSION}" | |
| # existing snapshot-fallback logic… | |
| export GENERATORS_VERSION_PROPERTY="" | |
| if [[ ! $MY_POM_VERSION =~ SNAPSHOT ]]; then | |
| if [[ ! $GENERATORS_VERSION =~ SNAPSHOT ]]; then | |
| result=$(curl -s --max-time 60 --retry 15 \ | |
| "https://search.maven.org/solrsearch/select?q=g:io.swagger.codegen.v3%20AND%20a:swagger-codegen-generators%20AND%20v:${GENERATORS_VERSION}%20AND%20p:jar") | |
| if [[ $(echo "$result" | jq '.response.numFound') -eq 0 ]]; then | |
| SNAP_API="https://central.sonatype.com/repository/maven-snapshots" | |
| ARTIFACT_PATH="io/swagger/codegen/v3/swagger-codegen-generators" | |
| LAST_SNAP=$(curl -s "$SNAP_API/$ARTIFACT_PATH/maven-metadata.xml" \ | |
| | grep -oP '(?<=<version>)[^<]+' | sort -V | tail -1) | |
| export GENERATORS_VERSION_PROPERTY="-Dswagger-codegen-generators-version=$LAST_SNAP" | |
| fi | |
| fi | |
| fi | |
| echo "GENERATORS_VERSION_PROPERTY=${GENERATORS_VERSION_PROPERTY}" | |
| echo "GENERATORS_VERSION_PROPERTY=${GENERATORS_VERSION_PROPERTY}" >> $GITHUB_ENV | |
| mvn clean verify -U -DJETTY_TEST_HTTP_PORT=8070 \ | |
| -DJETTY_TEST_STOP_PORT=8069 ${GENERATORS_VERSION_PROPERTY} | |
| - name: Build Docker image | |
| id: build_image | |
| run: | | |
| TAG="${{ github.repository }}:pr-${{ github.event.pull_request.number }}-java${{ matrix.java }}" | |
| docker build -t "$TAG" . | |
| echo "::set-output name=tag::$TAG" | |
| echo "IMAGE_TAG=$TAG" >> $GITHUB_ENV | |
| scan-with-wiz: | |
| name: Trigger Wiz Scanning | |
| runs-on: ubuntu-latest | |
| needs: build_pr_30 | |
| if: needs.build_pr_30.result == 'success' | |
| env: | |
| TAG: ${{ needs.build_pr_30.outputs.docker_tag }} | |
| POLICY: "SmartBear default vulnerabilities policy" | |
| steps: | |
| - name: Authenticate to Wiz | |
| run: ./wizcli auth --id "$WIZ_CLIENT_ID" --secret "$WIZ_CLIENT_SECRET" | |
| env: | |
| WIZ_CLIENT_ID: ${{ secrets.WIZ_CLIENT_ID }} | |
| WIZ_CLIENT_SECRET: ${{ secrets.WIZ_CLIENT_SECRET }} | |
| - name: Run wiz-cli docker image scan | |
| run: | | |
| ./wizcli docker scan --image "$TAG" --policy "$POLICY" | |
| ./wizcli docker tag --image "$TAG" |