Skip to content

Update asset name and artifact suffix in devguard-scanner workflow #923

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
timbastin merged 7 commits into from
Jul 24, 2025
Merged

Update asset name and artifact suffix in devguard-scanner workflow #923

Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
1b7a467
Update asset name and artifact suffix in devguard-scanner workflow
refoo0 Jul 18, 2025
4545266
Remove redundant scanning jobs from DevGuard workflow
refoo0 Jul 18, 2025
8af89e6
Remove unnecessary job dependencies from deploy, sign, and attest ste…
refoo0 Jul 18, 2025
3226abc
Fix syntax for should-deploy condition
refoo0 Jul 18, 2025
00e1b43
Update workflow references to use 'add-artifact-name' for build, scan…
refoo0 Jul 18, 2025
1b01649
Update workflow references to use 'main' for build, scan, sign, and a…
refoo0 Jul 18, 2025
54905cb
changed artifact name
timbastin Jul 24, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
155 changes: 21 additions & 134 deletions .github/workflows/devguard-scanner.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,42 +8,6 @@ on:


jobs:
# Secret scanning job to detect secrets in codebase
secret-scanning:
uses: l3montree-dev/devguard-action/.github/workflows/secret-scanning.yml@main
with:
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard
api-url: https://api.main.devguard.org
secrets:
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}

# Secret scanning job to detect secrets in codebase
iac:
uses: l3montree-dev/devguard-action/.github/workflows/iac.yml@main
with:
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard
api-url: https://api.main.devguard.org
secrets:
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}

sast:
uses: l3montree-dev/devguard-action/.github/workflows/sast.yml@main
with:
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard
api-url: https://api.main.devguard.org
secrets:
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}

sca:
uses: l3montree-dev/devguard-action/.github/workflows/software-composition-analysis.yml@main
with:
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard
api-url: https://api.main.devguard.org
fail-on-risk: high
fail-on-cvss: high
secrets:
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}

golangci:
name: lint
runs-on: ubuntu-latest
Expand Down Expand Up @@ -83,158 +47,81 @@ jobs:
name: code-coverage
path: coverage.out

# Docker image build job
build-image:
uses: l3montree-dev/devguard-action/.github/workflows/build-image.yml@main

devguard:
uses: l3montree-dev/devguard-action/.github/workflows/full.yml@main
with:
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard
api-url: https://api.main.devguard.org
fail-on-risk: high
fail-on-cvss: high
should-deploy: ${{ github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/') }}
secrets:
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}
build-args: "--context=. --dockerfile=Dockerfile --build-arg GITHUB_REF_NAME=$GITHUB_REF_NAME"
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}
build-args: "--context=. --dockerfile=Dockerfile --build-arg GITHUB_REF_NAME=$GITHUB_REF_NAME"


build-scanner-image:
uses: l3montree-dev/devguard-action/.github/workflows/build-image.yml@main
with:
image-suffix: "-scanner"
artifact-suffix: "-scanner"
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard-scanner
artifact-name: "scanner"
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard
api-url: https://api.main.devguard.org
secrets:
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}
build-args: "--context=. --dockerfile=Dockerfile.scanner"

# Image scanning job to detect vulnerabilities in the built Docker image
container-scanning:
uses: l3montree-dev/devguard-action/.github/workflows/container-scanning.yml@main
needs:
- build-image
with:
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard
api-url: https://api.main.devguard.org
fail-on-risk: high
fail-on-cvss: high
secrets:
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}

# Image scanning job to detect vulnerabilities in the built Docker image
scanner-container-scanning:
uses: l3montree-dev/devguard-action/.github/workflows/container-scanning.yml@main
needs:
- build-scanner-image
with:
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard-scanner
api-url: https://api.main.devguard.org
artifact-suffix: "-scanner"
secrets:
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}

deploy:
needs:
- build-image
- container-scanning
- secret-scanning
- sca
- sast
- golangci
- tests
- iac
uses: l3montree-dev/devguard-action/.github/workflows/deploy.yml@main
if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')
with:
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard
api-url: https://api.main.devguard.org
artifact-name: "scanner"
secrets:
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}

deploy-scanner:
needs:
- build-scanner-image
- scanner-container-scanning
- secret-scanning
- sca
- sast
- golangci
- tests
- iac
- devguard
uses: l3montree-dev/devguard-action/.github/workflows/deploy.yml@main
with:
artifact-suffix: "-scanner"
image-suffix: "-scanner"
artifact-name: "scanner"
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard
api-url: https://api.main.devguard.org
secrets:
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}
if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/') || github.ref == 'refs/heads/troubleshooting-sast'

sign:
needs:
- build-image
- container-scanning
- secret-scanning
- sca
- sast
- golangci
- tests
- iac
uses: l3montree-dev/devguard-action/.github/workflows/sign.yml@main
with:
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard
api-url: https://api.main.devguard.org
secrets:
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}
if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')

sign-scanner:
needs:
- build-scanner-image
- scanner-container-scanning
- secret-scanning
- sca
- sast
- golangci
- tests
- iac
- devguard
uses: l3montree-dev/devguard-action/.github/workflows/sign.yml@main
with:
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard-scanner
api-url: https://api.main.devguard.org
artifact-suffix: "-scanner"
secrets:
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}
if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')

attest:
needs:
- build-image
- container-scanning
- secret-scanning
- sca
- sast
- golangci
- tests
- iac
uses: l3montree-dev/devguard-action/.github/workflows/attest.yml@main
with:
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard
api-url: https://api.main.devguard.org
artifact-name: "scanner"
secrets:
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}
if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/')

attest-scanner:
needs:
- build-scanner-image
- scanner-container-scanning
- secret-scanning
- sca
- sast
- golangci
- tests
- iac
- devguard
uses: l3montree-dev/devguard-action/.github/workflows/attest.yml@main
with:
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard-scanner
asset-name: l3montree-cybersecurity/projects/devguard/assets/devguard
api-url: https://api.main.devguard.org
artifact-suffix: "-scanner"
artifact-name: "scanner"
secrets:
devguard-token: ${{ secrets.DEVGUARD_TOKEN }}
Loading