feat: scan for vuln #17
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Scan for vulnerabilities | |
| on: | |
| pull_request: | |
| branches: [main] | |
| types: [milestoned, opened, synchronize] | |
| schedule: | |
| - cron: '0 1 * * *' | |
| workflow_dispatch: {} | |
| jobs: | |
| # cannot scan registry1 and upstream at the same time because the sarif upload have a file limit of 20 files | |
| scan-upstream: | |
| runs-on: ubuntu-latest | |
| name: Scan for vulnerabilities - Upstream | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 | |
| with: | |
| fetch-depth: 0 | |
| - name: Environment setup | |
| uses: defenseunicorns/uds-common/.github/actions/setup@264ec430c4079129870820e70c4439f3f3d57cbc # v0.3.9 | |
| with: | |
| username: ${{ secrets.IRON_BANK_ROBOT_USERNAME }} | |
| password: ${{ secrets.IRON_BANK_ROBOT_PASSWORD }} | |
| - name: Scan the repository for vulnerabilities - Upstream | |
| run: | | |
| uds run grype:install | |
| uds run scan:upstream | |
| - name: Upload SARIF files - Upstream | |
| uses: github/codeql-action/upload-sarif@1b1aada464948af03b950897e5eb522f92603cc2 | |
| with: | |
| sarif_file: ./sarif | |
| scan-registry1: | |
| runs-on: ubuntu-latest | |
| name: Scan for vulnerabilities - Registry1 | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 | |
| with: | |
| fetch-depth: 0 | |
| - name: Environment setup | |
| uses: defenseunicorns/uds-common/.github/actions/setup@264ec430c4079129870820e70c4439f3f3d57cbc # v0.3.9 | |
| with: | |
| username: ${{ secrets.IRON_BANK_ROBOT_USERNAME }} | |
| password: ${{ secrets.IRON_BANK_ROBOT_PASSWORD }} | |
| - name: Iron Bank Login | |
| env: | |
| REGISTRY_USERNAME: ${{ secrets.IRON_BANK_ROBOT_USERNAME }} | |
| REGISTRY_PASSWORD: ${{ secrets.IRON_BANK_ROBOT_PASSWORD }} | |
| run: echo "${{ env.REGISTRY_PASSWORD }}" | uds zarf tools registry login -u "${{ env.REGISTRY_USERNAME }}" --password-stdin registry1.dso.mil | |
| shell: bash | |
| - name: Scan the repository for vulnerabilities - Registry1 | |
| run: | | |
| uds run grype:install | |
| uds run grype:create-grype-config | |
| uds run scan:registry1 | |
| env: | |
| GRYPE_USERNAME: ${{ secrets.IRON_BANK_ROBOT_USERNAME }} | |
| GRYPE_PASSWORD: ${{ secrets.IRON_BANK_ROBOT_PASSWORD }} | |
| - name: Upload SARIF files - Registry1 | |
| if: steps.check_sarif.outputs.exists == 'true' | |
| uses: github/codeql-action/upload-sarif@1b1aada464948af03b950897e5eb522f92603cc2 | |
| with: | |
| sarif_file: ./sarif |