add wiz scan on create PR to master and remove lacework(SWG-14342) #191
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build Test PR 3.0 | |
| on: | |
| pull_request: | |
| branches: [ "3.0.0" ] | |
| jobs: | |
| build_pr_30: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| java: [ 11, 17 ] | |
| # expose docker_tag from the “build_with_maven” step | |
| outputs: | |
| docker_tag: ${{ steps.build_with_maven.outputs.tag }} | |
| steps: | |
| # … previous checkout, setup-java, preliminary checks, generators bootstrap … | |
| - name: Build with Maven (and Docker) | |
| id: build_with_maven | |
| if: ${{ matrix.java != 8 }} | |
| run: | | |
| # — your existing Maven logic — | |
| export MY_POM_VERSION=$(mvn -Dswagger-codegen-generators-version=1.0.37 \ | |
| -q -Dexec.executable="echo" -Dexec.args='${projects.version}' \ | |
| --non-recursive org.codehaus.mojo:exec-maven-plugin:1.3.1:exec) | |
| echo "POM VERSION ${MY_POM_VERSION}" | |
| export GENERATORS_VERSION=$(sed -n 's/.*<swagger\-codegen\-generators\-version>\([^<]*\)<\/swagger\-codegen\-generators\-version>.*/\1/p' pom.xml | tr -d '[:space:]') | |
| echo "GENERATORS_VERSION ${GENERATORS_VERSION}" | |
| # … your snapshot‐fallback logic … | |
| echo "GENERATORS_VERSION_PROPERTY=${GENERATORS_VERSION_PROPERTY}" | |
| echo "GENERATORS_VERSION_PROPERTY=${GENERATORS_VERSION_PROPERTY}" >> $GITHUB_ENV | |
| mvn clean verify -U -DJETTY_TEST_HTTP_PORT=8070 \ | |
| -DJETTY_TEST_STOP_PORT=8069 ${GENERATORS_VERSION_PROPERTY} | |
| # — now build the Docker image using the same PR & Java matrix to tag — | |
| TAG="${{ github.repository }}:pr-${{ github.event.pull_request.number }}-java${{ matrix.java }}" | |
| docker build -t "$TAG" . | |
| # export tag both as step-output and env | |
| echo "::set-output name=tag::$TAG" | |
| echo "IMAGE_TAG=$TAG" >> $GITHUB_ENV | |
| # make sure Docker is available (login done in preliminary checks) | |
| shell: bash | |
| scan-with-wiz: | |
| needs: build_pr_30 | |
| runs-on: ubuntu-latest | |
| if: needs.build_pr_30.result == 'success' | |
| env: | |
| TAG: ${{ needs.build_pr_30.outputs.docker_tag }} | |
| POLICY: "SmartBear default vulnerabilities policy" | |
| steps: | |
| - name: Authenticate to Wiz | |
| run: ./wizcli auth --id "$WIZ_CLIENT_ID" --secret "$WIZ_CLIENT_SECRET" | |
| env: | |
| WIZ_CLIENT_ID: ${{ secrets.WIZ_CLIENT_ID }} | |
| WIZ_CLIENT_SECRET: ${{ secrets.WIZ_CLIENT_SECRET }} | |
| - name: Run wiz-cli docker image scan | |
| run: | | |
| ./wizcli docker scan --image "$TAG" --policy "$POLICY" | |
| ./wizcli docker tag --image "$TAG" |