add wiz scan on create PR to master and remove lacework(SWG-14342) #190
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build Test PR 3.0 | ||
| on: | ||
| pull_request: | ||
| branches: [ "3.0.0" ] | ||
| jobs: | ||
| build_pr_30: | ||
| runs-on: ubuntu-latest | ||
| strategy: | ||
| matrix: | ||
| java: [ 11, 17 ] | ||
| outputs: | ||
| docker_tag: ${{ steps.build_image.outputs.tag }} | ||
| env: | ||
| GENERATORS_VERSION_PROPERTY: "" | ||
| MAVEN_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }} | ||
| MAVEN_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }} | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| name: Checkout swagger-codegen (3.0.0) | ||
| with: | ||
| ref: 3.0.0 | ||
| - name: Set up Java | ||
| uses: actions/setup-java@v4 | ||
| with: | ||
| java-version: ${{ matrix.java }} | ||
| distribution: temurin | ||
| cache: maven | ||
| - name: Add Central-Portal snapshot repo | ||
| uses: s4u/[email protected] | ||
| with: | ||
| repositories: | | ||
| [ | ||
| { | ||
| "id":"central-portal-snapshots", | ||
| "name":"Sonatype Central Portal snapshots", | ||
| "url":"https://central.sonatype.com/repository/maven-snapshots/", | ||
| "releases":{ "enabled":false }, | ||
| "snapshots":{ "enabled":true } | ||
| } | ||
| ] | ||
| servers: | | ||
| [ | ||
| { | ||
| "id":"central", | ||
| "username":"${{ secrets.MAVEN_CENTRAL_USERNAME }}", | ||
| "password":"${{ secrets.MAVEN_CENTRAL_PASSWORD }}" | ||
| } | ||
| ] | ||
| - name: preliminary checks | ||
| run: | | ||
| docker login --username=${{ secrets.DOCKERHUB_SB_USERNAME }} \ | ||
| --password=${{ secrets.DOCKERHUB_SB_PASSWORD }} | ||
| set -e | ||
| ./bin/utils/detect_carriage_return.sh | ||
| ./bin/utils/detect_merge_conflict.sh | ||
| ./bin/utils/detect_tab_in_java_class.sh | ||
| - name: Resolve generators version | ||
| id: gen_version | ||
| run: | | ||
| VER=$(sed -n 's/.*<swagger-codegen-generators-version>\([^<]*\)<\/swagger-codegen-generators-version>.*/\1/p' pom.xml | tr -d '[:space:]') | ||
| echo "GEN_VER=$VER" >> $GITHUB_OUTPUT | ||
| # If it's a SNAPSHOT, just clone default branch | ||
| - name: Checkout swagger-codegen-generators (SNAPSHOT) | ||
| if: endsWith( steps.gen_version.outputs.GEN_VER, 'SNAPSHOT' ) | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| repository: swagger-api/swagger-codegen-generators | ||
| path: generators | ||
| token: ${{ secrets.GITHUB_TOKEN }} | ||
| # Otherwise checkout the exact tag/branch | ||
| - name: Checkout swagger-codegen-generators (release) | ||
| if: not( endsWith( steps.gen_version.outputs.GEN_VER, 'SNAPSHOT' ) ) | ||
|
Check failure on line 83 in .github/workflows/maven-pr-3.0.yml
|
||
| uses: actions/checkout@v4 | ||
| with: | ||
| repository: swagger-api/swagger-codegen-generators | ||
| path: generators | ||
| ref: ${{ steps.gen_version.outputs.GEN_VER }} | ||
| token: ${{ secrets.GITHUB_TOKEN }} | ||
| - name: Build & install swagger-codegen-generators | ||
| run: | | ||
| pushd generators | ||
| mvn clean install -DskipTests -B | ||
| popd | ||
| - name: Build with Maven | ||
| if: ${{ matrix.java != 8 }} | ||
| run: | | ||
| # (Your existing logic to pick RELEASE vs SNAPSHOT lives here unchanged…) | ||
| mvn clean verify -U -DJETTY_TEST_HTTP_PORT=8070 \ | ||
| -DJETTY_TEST_STOP_PORT=8069 ${GENERATORS_VERSION_PROPERTY} | ||
| - name: Build Docker image | ||
| id: build_image | ||
| run: | | ||
| TAG="${{ github.repository }}:pr-${{ github.event.pull_request.number }}-java${{ matrix.java }}" | ||
| docker build -t "$TAG" . | ||
| echo "::set-output name=tag::$TAG" | ||
| echo "IMAGE_TAG=$TAG" >> $GITHUB_ENV | ||
| scan-with-wiz: | ||
| name: Trigger Wiz Scanning | ||
| runs-on: ubuntu-latest | ||
| needs: build_pr_30 | ||
| if: needs.build_pr_30.result == 'success' | ||
| env: | ||
| TAG: ${{ needs.build_pr_30.outputs.docker_tag }} | ||
| POLICY: "SmartBear default vulnerabilities policy" | ||
| steps: | ||
| - name: Authenticate to Wiz | ||
| run: ./wizcli auth --id "$WIZ_CLIENT_ID" --secret "$WIZ_CLIENT_SECRET" | ||
| env: | ||
| WIZ_CLIENT_ID: ${{ secrets.WIZ_CLIENT_ID }} | ||
| WIZ_CLIENT_SECRET: ${{ secrets.WIZ_CLIENT_SECRET }} | ||
| - name: Run wiz-cli docker image scan | ||
| run: | | ||
| ./wizcli docker scan --image "$TAG" --policy "$POLICY" | ||
| ./wizcli docker tag --image "$TAG" | ||
