Skip to content

Commit d283b6c

Browse files
vipin230vipin230
committed
test
Signed-off-by: Vipin Yadav <vipin.yadav@progress.com>
1 parent a8092f8 commit d283b6c

File tree

3 files changed

+223
-173
lines changed

3 files changed

+223
-173
lines changed

‎.github/workflows/ci-main-pull-request.yml‎

Lines changed: 41 additions & 140 deletions
Original file line numberDiff line numberDiff line change
@@ -541,6 +541,36 @@ on:
541541
# required: false
542542
# default: 'https://polaris.blackduck.com'
543543
# type: string
544+
perform-wiz-scan:
545+
description: 'Perform Wiz CLI security scan on Docker image'
546+
required: false
547+
type: boolean
548+
default: false
549+
wiz-fail-build:
550+
description: 'Fail the build on Wiz policy violations'
551+
required: false
552+
type: boolean
553+
default: true
554+
wiz-fail-on-critical:
555+
description: 'Fail the pipeline if Wiz finds CRITICAL vulnerabilities'
556+
required: false
557+
type: boolean
558+
default: false
559+
wiz-fail-on-high:
560+
description: 'Fail the pipeline if Wiz finds HIGH vulnerabilities'
561+
required: false
562+
type: boolean
563+
default: false
564+
wiz-fail-on-medium:
565+
description: 'Fail the pipeline if Wiz finds MEDIUM vulnerabilities'
566+
required: false
567+
type: boolean
568+
default: false
569+
wiz-fail-on-low:
570+
description: 'Fail the pipeline if Wiz finds LOW vulnerabilities'
571+
required: false
572+
type: boolean
573+
default: false
544574

545575
env:
546576
PRIMARY_APPLICATION: ${{ inputs.application }} # was 'default' # Custom repo property [primaryApplication]: chef360, automate, infra-server, habitat, supermarket, licensing, downloads, chef-client, inspec, chef-workstation (or derivatives like habitat-builder)
@@ -979,156 +1009,27 @@ jobs:
9791009
run-grype-image:
9801010
name: 'Grype Docker image scan'
9811011
if: ${{ inputs.perform-grype-image-scan }}
982-
uses: chef/common-github-actions/.github/workflows/grype.yml@main
1012+
uses: chef/common-github-actions/.github/workflows/grype.yml@grype-wiz
9831013
needs: checkout
9841014
secrets: inherit
9851015
with:
9861016
fail-grype-on-high: ${{ inputs.grype-image-fail-on-high }}
9871017
fail-grype-on-critical: ${{ inputs.grype-image-fail-on-critical }}
9881018
grype-image-skip-aws: ${{ inputs.grype-image-skip-aws }}
9891019

990-
run-grype-hab-package-scan:
991-
name: 'Grype scan Habitat packages from bldr.habitat.sh'
992-
if: ${{ inputs.perform-grype-hab-scan == true }}
993-
uses: chef/common-github-actions/.github/workflows/grype-hab-package-scan.yml@main
1020+
run-wiz-scan:
1021+
name: 'Wiz CLI security scan'
1022+
if: ${{ inputs.perform-wiz-scan == true }}
1023+
uses: chef/common-github-actions/.github/workflows/wiz.yml@grype-wiz
9941024
needs: checkout
995-
secrets: inherit
9961025
with:
997-
build_package: ${{ inputs.grype-hab-build-package }}
998-
hab_origin: ${{ inputs.grype-hab-origin }}
999-
hab_package: ${{ inputs.grype-hab-package }}
1000-
hab_version: ${{ inputs.grype-hab-version }}
1001-
hab_release: ${{ inputs.grype-hab-release }}
1002-
hab_channel: ${{ inputs.grype-hab-channel }}
1003-
hab_path: ${{ inputs.grype-hab-path }}
1004-
scan-linux: ${{ inputs.grype-hab-scan-linux }}
1005-
scan-windows: ${{ inputs.grype-hab-scan-windows }}
1006-
scan-macos: ${{ inputs.grype-hab-scan-macos }}
1007-
fail-grype-on-high: ${{ inputs.grype-fail-on-high }}
1008-
fail-grype-on-critical: ${{ inputs.grype-fail-on-critical }}
1009-
1010-
# run-srcclr:
1011-
# if: ${{ inputs.perform-srcclr-scan == true }}
1012-
# uses: chef/common-github-actions/.github/workflows/srcclr.yml@main
1013-
# needs: run-scc
1014-
1015-
# run-veracode-sca:
1016-
# if: ${{ inputs.perform-veracode-sca-scan == true }}
1017-
# uses: chef/common-github-actions/.github/workflows/veracode-sca.yml@main
1018-
# needs: run-scc
1019-
# secrets: inherit
1020-
1021-
ci-build:
1022-
name: 'Build/compilation and unit tests (CI)'
1023-
if : ${{ inputs.build == true }}
1024-
needs: checkout
1025-
timeout-minutes: 40 # Maximum allowed minutes for GitHub-hosted runners (6 hours = 360 minutes)
1026-
runs-on: ubuntu-latest
1027-
# TODO: make this matrix strategy, and allow language compiler version overrides
1028-
steps:
1029-
- name: 'Build language: ${{ inputs.language }}'
1030-
run: |
1031-
echo "Building application in language ${{ env.GA_BUILD_LANGUAGE }}"
1032-
echo " passed in with ${{ inputs.language }}"
1033-
- name: Checkout repository
1034-
uses: actions/checkout@v6
1035-
with:
1036-
fetch-depth: 0
1037-
- name: Configure git for private Go modules
1038-
if: inputs.language == 'go'
1039-
env:
1040-
GOPRIVATE: ${{ inputs.go-private-modules }}
1041-
run: git config --global url."https://${{ secrets.GH_TOKEN || secrets.GITHUB_TOKEN }}@github.com/".insteadOf "https://github.com/"
1042-
- name: 'Go build'
1043-
if: ${{ inputs.language == 'go' && env.GA_BUILD_PROFILE == 'cli' }}
1044-
continue-on-error: true
1045-
# TODO: make this a matrix on WIndows/Mac/Linux
1046-
# TODO: parameterize build output path
1047-
run: |
1048-
ls
1049-
pwd
1050-
go mod tidy
1051-
go build -o ./bin/${{ env.REPO_NAME }} .
1052-
- name: 'Go unit tests'
1053-
if: ${{ inputs.language == 'go' && inputs.unit-tests == true && inputs.build-profile == 'cli' }}
1054-
continue-on-error: true
1055-
run: |
1056-
go test -v ./... > ${{ inputs.unit-test-output-path }}
1057-
1058-
# TODO: add unit-test-command-override if go test is not desired
1059-
1060-
- name: Upload test coverage artifact
1061-
if: ${{ inputs.language == 'go' && inputs.unit-tests == true && inputs.build-profile == 'cli' }}
1062-
uses: actions/upload-artifact@v4
1063-
# TODO: parameterize the unit test and coverage report names
1064-
with:
1065-
# Name of the artifact to upload.
1066-
name: test-coverage.out
1067-
# A file, directory or wildcard pattern that describes what to upload
1068-
path: ${{ inputs.unit-test-output-path }}
1069-
# run: go test -v -coverprofile="coverage.out" ./... and upload artifact!
1070-
# - name: Build for Rust binary
1071-
# if: ${{ env.GA_BUILD_LANGUAGE == 'rust' }}
1072-
# run: echo 'hello world'
1073-
# # cargo build --release --target-dir ./bin
1074-
1075-
# - name: Build for Ruby binary
1076-
# simple bundle install to generate gemlock(puts them in directory vendor/bundle, and uses actual gemspec for deployment to get multi-architecture ), then build gem
1077-
# https://bundler.io/man/bundle-install.1.html
1078-
- name: Set up Ruby # Fixed: Ruby setup was missing, causing "bundle: command not found" errors
1079-
if: ${{ inputs.language == 'ruby' && inputs.build-profile == 'cli' }}
1080-
uses: ruby/setup-ruby@v1
1081-
with:
1082-
ruby-version: '3.4'
1083-
bundler-cache: false
1084-
1085-
- name: Configure Bundler for private Ruby gems
1086-
if: ${{ inputs.language == 'ruby' && inputs.build-profile == 'cli' }}
1087-
run: |
1088-
if [ -z "${{ secrets.PRIVATE_ACCESS_KITCHEN_CHEF_ENTERPRISE }}" ]; then
1089-
echo "Skipping: PRIVATE_ACCESS_KITCHEN_CHEF_ENTERPRISE secret not configured or not in scope"
1090-
exit 0
1091-
fi
1092-
bundle config set --local github.com "x-access-token:${{ secrets.PRIVATE_ACCESS_KITCHEN_CHEF_ENTERPRISE }}"
1093-
1094-
- name: 'Ruby build'
1095-
if: ${{ inputs.language == 'ruby' && inputs.build-profile == 'cli' }}
1096-
continue-on-error: true
1097-
run: |
1098-
mkdir -p vendor
1099-
if [ -f "Gemfile.lock" ]; then
1100-
bundle install --deployment
1101-
else
1102-
echo "No Gemfile.lock found, creating it now"
1103-
bundle install --path vendor/bundle # Fixed: Removed --deployment flag when lockfile doesn't exist
1104-
fi
1105-
bundle exec rake build
1106-
# this does not work on all repos - chef-telemetry needs bundle install to generate gemfile.lock, but chef-cli does not commit gemfile.lock and needs bundle install to generate it at runtime - add flag to control whether bundle install is run in ci-build or language-specific checks
1107-
# TODO: detect if rakefile exists, else do bundler default
1108-
- name: 'Ruby unit tests'
1109-
if: ${{ inputs.language == 'ruby' && inputs.unit-tests == true && inputs.build-profile == 'cli' }}
1110-
continue-on-error: true
1111-
run: |
1112-
echo "Running Ruby unit tests with output to ${{ inputs.unit-test-output-path }}"
1113-
# bundle exec rake spec --trace > ${{ inputs.unit-test-output-path }}
1026+
fail-build: ${{ inputs.wiz-fail-build }}
1027+
fail-on-critical: ${{ inputs.wiz-fail-on-critical }}
1028+
fail-on-high: ${{ inputs.wiz-fail-on-high }}
1029+
fail-on-medium: ${{ inputs.wiz-fail-on-medium }}
1030+
fail-on-low: ${{ inputs.wiz-fail-on-low }}
1031+
secrets: inherit
11141032

1115-
# - name: Configure git for private modules
1116-
# env:
1117-
# GOPRIVATE: github.com/progress-platform-services/*
1118-
# run: git config --global url."https://${{ secrets.GH_TOKEN }}@github.com/".insteadOf "https://github.com/"
1119-
1120-
# TODO: dynamic version detection stepswith new flags ${{ detect-version-source-type: 'none' # options include "none" (do not detect), "file", "github-tag" or "github-release"
1121-
# AND ${{ detect-version-source-parameter: '' # use for file name}}
1122-
# version: ${{ github.workflow.env.APP_VERSION }}
1123-
# version: ${{ needs.set-app-version.outputs.app-version }}
1124-
1125-
# if you have a version file, you can read it in to an environment variable with
1126-
# - name: Set variables
1127-
# run: |
1128-
# VER=$(cat VERSION)
1129-
# echo "VERSION=$VER" >> $GITHUB_ENV
1130-
# then ${{ env.VERSION }}
1131-
11321033
set-application-version:
11331034
runs-on: ubuntu-latest
11341035
name: 'Detect SBOM version for application'

‎.github/workflows/grype.yml‎

Lines changed: 5 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -37,8 +37,6 @@ jobs:
3737
fetch-depth: 0
3838

3939
- name: Configure git for private
40-
env:
41-
GOPRIVATE: ${{ inputs.go-private-modules }}
4240
run: git config --global url."https://${{ secrets.GH_TOKEN }}@github.com/".insteadOf "https://github.com/"
4341

4442
- name: Install Grype
@@ -73,7 +71,7 @@ jobs:
7371
SCAN_NAME="${{ github.repository }}"
7472
7573
if [ ! -f "Dockerfile" ]; then
76-
echo "❌ No Dockerfile found - this workflow requires a Dockerfile to scan Docker image"
74+
echo "❌ No Dockerfile found - cannot scan"
7775
exit 1
7876
fi
7977
@@ -98,28 +96,15 @@ jobs:
9896
elif [ -f "Makefile" ] && grep -q "^compose-build:" Makefile; then
9997
echo "Using Makefile compose-build target with GITHUB_TOKEN"
10098
export GITHUB_TOKEN="${{ secrets.GH_TOKEN }}"
101-
102-
# Record image IDs before build to detect newly built images
103-
BEFORE_IDS=$(docker images -q --no-trunc | sort)
104-
10599
make compose-build
106100
107101
echo "Detecting built images..."
108-
# Find newly created images by comparing before/after image IDs
109-
AFTER_IDS=$(docker images -q --no-trunc | sort)
110-
NEW_IDS=$(comm -13 <(echo "$BEFORE_IDS") <(echo "$AFTER_IDS"))
102+
docker compose images
103+
104+
IMAGES=$(docker images --format "{{.Repository}}:{{.Tag}}" | grep "^${REPO_NAME}" | grep -v "^<none>")
111105
112-
if [ -n "$NEW_IDS" ]; then
113-
IMAGES=""
114-
for id in $NEW_IDS; do
115-
img=$(docker images --format "{{.Repository}}:{{.Tag}}" --filter "id=${id}" | grep -v "<none>" | head -1)
116-
[ -n "$img" ] && IMAGES="${IMAGES}${img}"$'\n'
117-
done
118-
IMAGES=$(echo "$IMAGES" | grep -v '^$' | sort -u)
119-
fi
120-
121106
if [ -z "$IMAGES" ]; then
122-
echo "No new images detected, scanning all recent images"
107+
echo "No images found with prefix ${REPO_NAME}, scanning all recent images"
123108
IMAGES=$(docker images --format "{{.Repository}}:{{.Tag}}" | grep -v "^<none>" | head -5)
124109
fi
125110
# Strategy 3: Fallback to standard docker build

0 commit comments

Comments
 (0)