example-voting-app/.github/workflows/sysdig-scan.yml at e2d8b7c3eeb2955fa971f911eceefaaec0b03e4f · dockersamples/example-voting-app · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
name: Sysdig Secure Scanning

on:
  push:
    branches: [main, ci/sysdig-integration]
  pull_request:
    branches: [main, ci/sysdig-integration]

jobs:
  scan:
    runs-on: ubuntu-latest
    name: Scan vote / worker / result + IaC (stable, no version pin)

    steps:
      - name: Checkout source
        uses: actions/checkout@v3

      # Build Docker images
      - name: Build vote image
        run: docker build ./vote -t vote-app:${{ github.sha }}

      - name: Build worker image
        run: docker build ./worker -t worker-app:${{ github.sha }}

      - name: Build result image
        run: docker build ./result -t result-app:${{ github.sha }}

      # Scan vote
      - name: Scan vote image with Sysdig
        uses: sysdiglabs/scan-action@v6
        with:
          image-tag: vote-app:${{ github.sha }}
          sysdig-secure-token: ${{ secrets.SYSDIG_SECURE_TOKEN }}
          sysdig-secure-url: ${{ secrets.SYSDIG_API_URL }}
          stop-on-processing-error: true

      # Scan worker
      - name: Scan worker image with Sysdig
        uses: sysdiglabs/scan-action@v6
        with:
          image-tag: worker-app:${{ github.sha }}
          sysdig-secure-token: ${{ secrets.SYSDIG_SECURE_TOKEN }}
          sysdig-secure-url: ${{ secrets.SYSDIG_API_URL }}
          stop-on-processing-error: true

      # Scan result
      - name: Scan result image with Sysdig
        uses: sysdiglabs/scan-action@v6
        with:
          image-tag: result-app:${{ github.sha }}
          sysdig-secure-token: ${{ secrets.SYSDIG_SECURE_TOKEN }}
          sysdig-secure-url: ${{ secrets.SYSDIG_API_URL }}
          stop-on-processing-error: true

      # Scan IaC (k8s-specifications)
      - name: Scan Kubernetes IaC manifests
        uses: sysdiglabs/scan-action@v6
        continue-on-error: true
        with:
          mode: iac
          iac-scan-path: k8s-specifications
          sysdig-secure-token: ${{ secrets.SYSDIG_SECURE_TOKEN }}
          sysdig-secure-url: ${{ secrets.SYSDIG_API_URL }}
          stop-on-processing-error: true