mirror of
https://github.com/kubescape/kubescape.git
synced 2026-04-15 06:58:11 +00:00
Amir MalkaandGitHub
0a0ef10d50
* control parallelism of opa rule processing by env var Signed-off-by: Amir Malka <amirm@armosec.io> * go 1.20 Signed-off-by: Amir Malka <amirm@armosec.io> * update go.mod go.sum Signed-off-by: Amir Malka <amirm@armosec.io> --------- Signed-off-by: Amir Malka <amirm@armosec.io>
102 lines
3.7 KiB
YAML
102 lines
3.7 KiB
YAML
name: a-pr-scanner
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
RELEASE:
|
|
description: 'release'
|
|
required: true
|
|
type: string
|
|
CLIENT:
|
|
description: 'Client name'
|
|
required: true
|
|
type: string
|
|
UNIT_TESTS_PATH:
|
|
required: false
|
|
type: string
|
|
default: "./..."
|
|
jobs:
|
|
scanners:
|
|
env:
|
|
GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
|
|
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
|
|
name: PR Scanner
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # ratchet:actions/checkout@v3
|
|
with:
|
|
fetch-depth: 0
|
|
submodules: recursive
|
|
- uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # Install go because go-licenses use it ratchet:actions/setup-go@v3
|
|
name: Installing go
|
|
with:
|
|
go-version: '1.20'
|
|
cache: true
|
|
- name: Scanning - Forbidden Licenses (go-licenses)
|
|
id: licenses-scan
|
|
continue-on-error: true
|
|
run: |
|
|
echo "## Installing go-licenses tool"
|
|
go install github.com/google/go-licenses@latest
|
|
echo "## Scanning for forbiden licenses ##"
|
|
go-licenses check .
|
|
- name: Scanning - Credentials (GitGuardian)
|
|
if: ${{ env.GITGUARDIAN_API_KEY }}
|
|
continue-on-error: true
|
|
id: credentials-scan
|
|
uses: GitGuardian/ggshield-action@4ab2994172fadab959240525e6b833d9ae3aca61 # ratchet:GitGuardian/ggshield-action@master
|
|
with:
|
|
args: -v --all-policies
|
|
env:
|
|
GITHUB_PUSH_BEFORE_SHA: ${{ github.event.before }}
|
|
GITHUB_PUSH_BASE_SHA: ${{ github.event.base }}
|
|
GITHUB_PULL_BASE_SHA: ${{ github.event.pull_request.base.sha }}
|
|
GITHUB_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
|
|
GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
|
|
- name: Scanning - Vulnerabilities (Snyk)
|
|
if: ${{ env.SNYK_TOKEN }}
|
|
id: vulnerabilities-scan
|
|
continue-on-error: true
|
|
uses: snyk/actions/golang@806182742461562b67788a64410098c9d9b96adb # ratchet:snyk/actions/golang@master
|
|
with:
|
|
command: test --all-projects
|
|
env:
|
|
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
|
|
|
|
- name: Test coverage
|
|
id: unit-test
|
|
run: go test -v ${{ inputs.UNIT_TESTS_PATH }} -covermode=count -coverprofile=coverage.out
|
|
|
|
- name: Convert coverage count to lcov format
|
|
uses: jandelgado/gcov2lcov-action@v1
|
|
|
|
- name: Submit coverage tests to Coveralls
|
|
continue-on-error: true
|
|
uses: coverallsapp/github-action@v1
|
|
with:
|
|
github-token: ${{ secrets.GITHUB_TOKEN }}
|
|
path-to-lcov: coverage.lcov
|
|
|
|
- name: Comment results to PR
|
|
continue-on-error: true # Warning: This might break opening PRs from forks
|
|
uses: peter-evans/create-or-update-comment@5adcb0bb0f9fb3f95ef05400558bdb3f329ee808 # ratchet:peter-evans/create-or-update-comment@v2.1.0
|
|
with:
|
|
issue-number: ${{ github.event.pull_request.number }}
|
|
body: |
|
|
Scan results:
|
|
- License scan: ${{ steps.licenses-scan.outcome }}
|
|
- Credentials scan: ${{ steps.credentials-scan.outcome }}
|
|
- Vulnerabilities scan: ${{ steps.vulnerabilities-scan.outcome }}
|
|
reactions: 'eyes'
|
|
basic-tests:
|
|
needs: scanners
|
|
uses: ./.github/workflows/b-binary-build-and-e2e-tests.yaml
|
|
with:
|
|
COMPONENT_NAME: kubescape
|
|
CGO_ENABLED: 1
|
|
GO111MODULE: ""
|
|
GO_VERSION: "1.20"
|
|
RELEASE: ${{ inputs.RELEASE }}
|
|
CLIENT: ${{ inputs.CLIENT }}
|
|
CHECKOUT_REPO: ${{ github.repository }}
|
|
secrets: inherit
|