Fix to GH actions container push, Docker Hub description update, and CodeQL paths

Author: vicenteherrera

.github/workflows/build.yaml

@@ -85,7 +85,7 @@ jobs:
 
   sysdig_dockerfile_cis_benchmark_forwarder:
     name: Sysdig Dockerfile CIS benchmark - Forwarder
-    needs: [check_bash_installer, check_yaml, check_dotnet]
+    needs: [check_yaml, check_dotnet]
     runs-on: ubuntu-16.04
     steps:
       - name: Checkout repo
@@ -117,7 +117,7 @@ jobs:
 
   sysdig_dockerfile_cis_benchmark_installer:
     name: Sysdig Dockerfile CIS benchmark - Installer
-    needs: [check_bash_installer, check_yaml, check_dotnet]
+    needs: [check_bash_installer]
     runs-on: ubuntu-16.04
     steps:
       - name: Checkout repo
@@ -150,7 +150,7 @@ jobs:
 
   sysdig_image_scan_forwarder:
     name: Sysdig image scan - Forwarder
-    needs: [check_bash_installer, check_yaml, check_dotnet]
+    needs: [check_yaml, check_dotnet]
     runs-on: ubuntu-16.04
     steps:
       - name: Checkout repo
@@ -165,61 +165,76 @@ jobs:
 
   sysdig_image_scan_installer:
     name: Sysdig image scan - Installer
-    needs: [check_bash_installer, check_yaml, check_dotnet]
+    needs: [check_bash_installer]
     runs-on: ubuntu-16.04
     steps:
       - name: Checkout repo
         uses: actions/checkout@v2      
       - name: Build the Docker image
         run: docker build -f ./build/Dockerfile . --tag sysdiglabs/aks-audit-log-installer
-      - name: Sysdig Secure inline image scan
-        uses: sysdiglabs/scan-action@v2
-        with:
-          image-tag: "sysdiglabs/aks-audit-log-installer"
-          sysdig-secure-token: ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
+      - name: Pull Sysdig inline scan
+        run: docker pull sysdiglabs/secure-inline-scan:2
+      - name: Run Sysdig inline image scan
+        id: run_sysdig_inline_scan
+        env:
+          SYSDIG_SECURE_TOKEN: ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
+        run: |
+          docker run sysdiglabs/secure-inline-scan:2 -s https://secure.sysdig.com -k $SYSDIG_SECURE_TOKEN sysdiglabs/aks-audit-log-installer \
+            | tee sysdig_image_scan_installer_result.txt
+          SCAN_RESULT=${PIPESTATUS[0]}
+          echo "::set-output name=SCAN_RESULT::$SCAN_RESULT"
+          echo "Scan finished with result: $SCAN_RESULT"
+      - name: Scan result
+        env:
+          SCAN_RESULT: ${{ steps.run_sysdig_inline_scan.outputs.SCAN_RESULT }}
+        run: |
+          cat sysdig_image_scan_installer_result.txt
+          echo "Scan result: $SCAN_RESULT"
+          # exit $SCAN_RESULT
+
 
   publish_images:
-      name: Publish container images to registries
-      needs: [check_bash_installer, check_yaml, check_dotnet, sysdig_image_scan, sysdig_image_scan_forwared, sysdig_image_scan_installer]
-      if: github.event_name == 'release'
-      steps:
-        - name: Checkout
-          uses: actions/checkout@v2
-        - name: Set up QEMU
-          uses: docker/setup-qemu-action@v1
-        - name: Set up Docker Buildx
-          uses: docker/setup-buildx-action@v1
-        - name: Login to DockerHub
-          uses: docker/login-action@v1 
-          with:
-            username: ${{ secrets.SYSDIGLABS_DOCKERHUB_USER }}
-            password: ${{ secrets.SYSDIGLABS_DOCKERHUB_TOKEN }}
-        # - name: Login to GitHub Container Registry
-        #   uses: docker/login-action@v1 
-        #   with:
-        #     registry: ghcr.io
-        #     username: ${{ github.repository_owner }}
-        #     password: ${{ secrets.CR_PAT }}
-        - name: Prepare version major
-          id: prepare_version_major
-          env:
-            VERSION_FULL: ${{ github.event.release.tag_name }}
-          run: |
-            echo "Version full: $VERSION_FULL"
-            VERSION_MAJOR=$(echo $VERSION_FULL | sed 's/[^0-9]*\([0-9]\+\).*/\1/')
-            echo "Version major: $VERSION_MAJOR"
-            echo "::set-output name=VERSION_MAJOR::$VERSION_MAJOR"
-            
-        - name: Build and push - Installer
-          uses: docker/build-push-action@v2
-          with:
-            context: .
-            file: ./build/Dockerfile
-            platforms: linux/amd64
-            push: true
-            tags: |
-              sysdiglabs/aks-audit-log-installer:latest
-              sysdiglabs/aks-audit-log-installer:${{ github.event.release.tag_name }}
-              sysdiglabs/aks-audit-log-installer:${{ steps.prepare_version_major.outputs.VERSION_MAJOR }}
-        # ghcr.io/user/app:latest
-        # ghcr.io/user/app:1.0.0
+    name: Publish container images to registries
+    needs: [sysdig_image_scan_forwarder, sysdig_image_scan_installer]
+    runs-on: ubuntu-16.04    
+    if: github.event_name == 'release'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      - name: Login to DockerHub
+        uses: docker/login-action@v1 
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_PASSWORD }}
+      # - name: Login to GitHub Container Registry
+      #   uses: docker/login-action@v1 
+      #   with:
+      #     registry: ghcr.io
+      #     username: ${{ github.repository_owner }}
+      #     password: ${{ secrets.CR_PAT }}
+      - name: Prepare version major
+        id: prepare_version_major
+        env:
+          VERSION_FULL: ${{ github.event.release.tag_name }}
+        run: |
+          echo "Version full: $VERSION_FULL"
+          VERSION_MAJOR=$(echo $VERSION_FULL | sed 's/[^0-9]*\([0-9]\+\).*/\1/')
+          echo "Version major: $VERSION_MAJOR"
+          echo "::set-output name=VERSION_MAJOR::$VERSION_MAJOR"
+      - name: Build and push - Installer
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          file: ./build/Dockerfile
+          platforms: linux/amd64
+          push: true
+          tags: |
+            sysdiglabs/aks-audit-log-installer:latest
+            sysdiglabs/aks-audit-log-installer:${{ github.event.release.tag_name }}
+            sysdiglabs/aks-audit-log-installer:${{ steps.prepare_version_major.outputs.VERSION_MAJOR }}
+
+        # ghcr.io/sysdiglabs/aks-audit-log-installer:latest

.github/workflows/codeql-analysis.yml

@@ -8,9 +8,13 @@ name: "CodeQL"
 on:
   push:
     branches: [master]
+    paths: 
+      - ./AKSKubeAuditReceiverSolution
   pull_request:
     # The branches below must be a subset of the branches above
     branches: [master]
+    paths: 
+      - ./AKSKubeAuditReceiverSolution
   schedule:
     - cron: '0 1 * * 0'
 

.github/workflows/dockerhub-description-forwarder copy.yaml renamed to .github/workflows/dockerhub-description-forwarder.yaml

@@ -4,7 +4,7 @@ on:
     branches:
       - master
     paths:
-      - build/README.md
+      - AKSKubeAuditReceiverSolution/AKSKubeAuditReceiver/README.md
       - .github/workflows/dockerhub-description-forwarder.yml
 jobs:
   dockerHubDescription: