77 branches :
88 - master
99 page_build :
10+ workflow_dispatch :
1011 release :
1112 types :
12- - created
13+ - published
1314
1415jobs :
1516 check_bash_installer :
8283 - name : Dotnet test solution
8384 run : dotnet test AKSKubeAuditReceiverSolution/AKSKubeAuditReceiver.sln
8485
85- sysdig_dockerfile_cis_benchmark :
86- name : Sysdig Dockerfile CIS benchmark
86+ sysdig_dockerfile_cis_benchmark_forwarder :
87+ name : Sysdig Dockerfile CIS benchmark - Forwarder
8788 needs : [check_bash_installer, check_yaml, check_dotnet]
8889 runs-on : ubuntu-16.04
8990 steps :
@@ -114,9 +115,42 @@ jobs:
114115 curl -X POST -s https://app.sysdigcloud.com/api/events -H 'Content-Type: application/json; charset=UTF-8' -H 'Authorization: Bearer '"${SYSDIG_SECURE_TOKEN}"'' -d '{"event":{"name":"CIS Dockerfile Benchmark - PR: '"${PR_TITLE}"' ","description":"'"${reportString}"'","severity":"6"}}' --compressed
115116 echo "###"
116117
118+ sysdig_dockerfile_cis_benchmark_installer :
119+ name : Sysdig Dockerfile CIS benchmark - Installer
120+ needs : [check_bash_installer, check_yaml, check_dotnet]
121+ runs-on : ubuntu-16.04
122+ steps :
123+ - name : Checkout repo
124+ uses : actions/checkout@v2
125+ - name : Sysdig CIS dockerfile benchmark
126+ uses :
sysdiglabs/[email protected] 127+ id : cis_dockerfile_benchmark
128+ with :
129+ directory : ' ./build'
130+ dockerfilePattern : ' Dockerfile'
131+ disallowedPackages : ' netcat'
132+ secretPatterns : ' aws_secret,pass'
133+ - name : Post run Sysdig CIS dockerfile benchmark
134+ env :
135+ SYSDIG_SECURE_TOKEN : ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
136+ PR_TITLE : ${{ github.event.pull_request.title }}
137+ PR_SHA : ${{ github.event.pull_request.head.sha }}
138+ PR_OWNER : ${{ github.event.pull_request.head.user.login }}
139+ run : |
140+ echo "###"
141+ echo "{\"pr_name\": \"${PR_TITLE}\", \"pr_sha\": \"${PR_SHA}\", \"pr_owner\": \"${PR_OWNER}\"}" > /tmp/report.json
142+ echo ${{ toJSON(steps.cis_dockerfile_benchmark.outputs.violation_report) }} > /tmp/report
143+ reportString=$(sed 's/"/\\"/g' /tmp/report)
144+ echo $reportString
145+
146+ # send result to Sysdig monitor
147+ curl -X POST -s https://app.sysdigcloud.com/api/events -H 'Content-Type: application/json; charset=UTF-8' -H 'Authorization: Bearer '"${SYSDIG_SECURE_TOKEN}"'' -d '{"event":{"name":"CIS Dockerfile Benchmark - PR: '"${PR_TITLE}"' ","description":"'"${reportString}"'","severity":"6"}}' --compressed
148+ echo "###"
149+
150+
117151 sysdig_image_scan_forwarder :
118152 name : Sysdig image scan - Forwarder
119- needs : [check_yaml, check_dotnet]
153+ needs : [check_bash_installer, check_yaml, check_dotnet]
120154 runs-on : ubuntu-16.04
121155 steps :
122156 - name : Checkout repo
@@ -129,17 +163,18 @@ jobs:
129163 image-tag : " sysdiglabs/aks-audit-log-forwarder"
130164 sysdig-secure-token : ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
131165
132- sysdig_image_scan_installer :
133- name : Sysdig image scan - Installer
134- needs : [check_bash_installer]
135- runs-on : ubuntu-16.04
136- steps :
137- - name : Checkout repo
138- uses : actions/checkout@v2
139- - name : Build the Docker image
140- run : docker build -f ./build . --tag sysdiglabs/aks-audit-log-installer
141- - name : Sysdig Secure inline image scan
142- uses : sysdiglabs/scan-action@v2
143- with :
144- image-tag : " sysdiglabs/aks-audit-log-forwarder:auto"
145- sysdig-secure-token : ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
166+ sysdig_image_scan_installer :
167+ name : Sysdig image scan - Installer
168+ needs : [check_bash_installer, check_yaml, check_dotnet]
169+ runs-on : ubuntu-16.04
170+ steps :
171+ - name : Checkout repo
172+ uses : actions/checkout@v2
173+ - name : Build the Docker image
174+ run : docker build -f ./build/Dockerfile . --tag sysdiglabs/aks-audit-log-installer
175+ - name : Sysdig Secure inline image scan
176+ uses : sysdiglabs/scan-action@v2
177+ with :
178+ image-tag : " sysdiglabs/aks-audit-log-installer"
179+ sysdig-secure-token : ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
180+
0 commit comments