Skip to content

Commit e62bcb2

Browse files
TechWithSheylaTechWithSheyla
authored
Update build_and_scan_image.yml
1 parent c8b8d23 commit e62bcb2

File tree

1 file changed

+89
-97
lines changed

1 file changed

+89
-97
lines changed

‎.github/workflows/build_and_scan_image.yml‎

Lines changed: 89 additions & 97 deletions
Original file line numberDiff line numberDiff line change
@@ -1,108 +1,100 @@
11
name: Build and Scan artifact with Amazon Inspector
22
on: [push]
33
jobs:
4-
5-
daily_job:
6-
runs-on: ubuntu-latest
7-
8-
# Configura los permisos para habilitar la autenticación con OIDC
9-
permissions:
10-
id-token: write
11-
contents: read
12-
4+
# Configura los permisos para habilitar la autenticación con OIDC
5+
permissions:
6+
id-token: write
7+
contents: read
138

149

15-
steps:
16-
# Clean up AWS credentials cache if any
17-
- name: Clean up old AWS credentials
18-
run: |
10+
build:
11+
name: Build docker image
12+
runs-on: ubuntu-latest
13+
environment:
14+
name: plugin-development
15+
16+
steps:
17+
- name: Checkout this repository
18+
uses: actions/checkout@v4
19+
20+
- name: Set up docker build prereqs (QEMU)
21+
uses: docker/setup-qemu-action@v3
22+
23+
- name: Set up docker build prereqs (Buildx)
24+
uses: docker/setup-buildx-action@v3
25+
26+
- name: Build Docker image
27+
uses: docker/build-push-action@v5
28+
with:
29+
context: .
30+
file: ./Dockerfile
31+
push: true
32+
load: false
33+
# Clean up AWS credentials cache if any
34+
- name: Clean up old AWS credentials
35+
run: |
1936
rm -rf ~/.aws
2037
2138
2239
# modify this block based on how you authenticate to AWS
2340
# make sure you have permission to access the Inspector ScanSbom API
2441
# https://docs.aws.amazon.com/inspector/latest/user/configure-cicd-account.html#cicd-iam-role
25-
- name: Configure AWS credentials
26-
uses: aws-actions/configure-aws-credentials@v4
27-
with:
28-
aws-region: "us-east-1"
29-
role-to-assume: "arn:aws:iam::066849108148:role/InspectorRoleForGithub"
30-
31-
32-
33-
# Check out your repository if needed
34-
- name: Checkout this repository
35-
uses: actions/checkout@v4
36-
37-
38-
39-
# modify this block to scan your intended artifact
40-
- name: Inspector Scan
41-
id: inspector
42-
uses: aws-actions/vulnerability-scan-github-action-for-amazon-inspector@v1
43-
with:
44-
# change artifact_type to either 'repository', 'container', 'binary', or 'archive'.
45-
artifact_type: 'repository'
46-
47-
# change artifact_path to the file path or container image you would like to scan.
48-
# File paths should be relative to your root project directory.
49-
# For containers, this action accepts 'docker pull'-style references to containers,
50-
# such as 'alpine:latest' or a file path to an image exported as TAR using docker save.
51-
artifact_path: './'
52-
53-
# If enabled, this setting will display Inspector's vulnerability scan findings
54-
# as a GitHub actions step summary. See here for an example step summary:
55-
# https://github.com/aws-actions/vulnerability-scan-github-action-for-amazon-inspector/actions/runs/8800085041
56-
display_vulnerability_findings: "enabled"
57-
58-
# Set vulnerability thresholds; if the number of vulnerabilities is
59-
# equal to or greater than any of the specified thresholds, this
60-
# action will set the 'vulnerability_threshold_exceeded'
61-
# output flag to 1.
62-
critical_threshold: 1
63-
high_threshold: 1
64-
medium_threshold: 1
65-
low_threshold: 1
66-
other_threshold: 1
67-
68-
# Additional input arguments are available to control scan behavior.
69-
# See 'action.yml' for additional input/output options.
70-
71-
72-
# The following steps illustrate how to
73-
# display scan results in the GitHub Actions job terminal.
74-
- name: Display CycloneDX SBOM (JSON)
75-
run: cat ${{ steps.inspector.outputs.artifact_sbom }}
76-
77-
- name: Display Inspector vulnerability scan results (JSON)
78-
run: cat ${{ steps.inspector.outputs.inspector_scan_results }}
79-
80-
- name: Display Inspector vulnerability scan results (CSV)
81-
run: cat ${{ steps.inspector.outputs.inspector_scan_results_csv }}
82-
83-
- name: Display Inspector vulnerability scan results (Markdown)
84-
run: cat ${{ steps.inspector.outputs.inspector_scan_results_markdown }}
85-
86-
87-
# The following steps illustrate how to
88-
# upload scan results as a GitHub actions job artifact
89-
- name: Upload Scan Results
90-
uses: actions/upload-artifact@v4
91-
with:
92-
name: Inspector Vulnerability Scan Artifacts
93-
path: |
94-
${{ steps.inspector.outputs.inspector_scan_results }}
95-
${{ steps.inspector.outputs.inspector_scan_results_csv }}
96-
${{ steps.inspector.outputs.artifact_sbom }}
97-
${{ steps.inspector.outputs.inspector_scan_results_markdown }}
98-
99-
100-
# This step illustrates how to add custom logic if
101-
# the vulnerability threshold is exceeded. This example
102-
# simply prints the 'vulnerability_threshold_exceeded' value
103-
# to the GitHub actions job terminal.
104-
# Replace 'echo' with 'exit' if you want to fail the job.
105-
- name: On vulnerability threshold exceeded
106-
run: echo ${{ steps.inspector.outputs.vulnerability_threshold_exceeded }}
107-
108-
42+
- name: Configure AWS credentials
43+
uses: aws-actions/configure-aws-credentials@v4
44+
with:
45+
aws-region: "us-east-1"
46+
role-to-assume: "arn:aws:iam::066849108148:role/InspectorRoleForGithub"
47+
48+
- name: Scan built image with Inspector
49+
uses: aws-actions/vulnerability-scan-github-action-for-amazon-inspector@v1
50+
id: inspector
51+
with:
52+
artifact_type: 'container'
53+
artifact_path: 'app:latest'
54+
display_vulnerability_findings: "enabled"
55+
output_sbom_path: 'sbom.json'
56+
output_inspector_scan_path: 'inspector_scan.json'
57+
output_inspector_scan_path_csv: 'inspector_pkg_scan.csv'
58+
output_inspector_dockerfile_scan_path_csv: 'inspector_dockerfile_scan.csv'
59+
output_inspector_dockerfile_scan_path_markdown: 'inspector_dockerfile_scan.md'
60+
critical_threshold: 1
61+
high_threshold: 1
62+
medium_threshold: 1
63+
low_threshold: 1
64+
other_threshold: 1
65+
sbomgen_version: "latest"
66+
67+
- name: Demonstrate SBOM Output (JSON)
68+
run: cat ${{ steps.inspector.outputs.artifact_sbom }}
69+
70+
- name: Demonstrate Inspector Scan Output (JSON)
71+
run: cat ${{ steps.inspector.outputs.inspector_scan_results }}
72+
73+
- name: Demonstrate Inspector Scan Output (CSV)
74+
run: cat ${{ steps.inspector.outputs.inspector_scan_results_csv }}
75+
76+
- name: Display Dockerfile vulns (CSV)
77+
run: cat inspector_dockerfile_scan.csv
78+
79+
- name: Display Dockerfile vulns (MD)
80+
run: cat inspector_dockerfile_scan.md
81+
82+
- name: Debug Dockerfile output variables
83+
run: |
84+
echo ${{ steps.inspector.outputs.inspector_dockerile_scan_results_csv }}
85+
echo ${{ steps.inspector.outputs.inspector_dockerile_scan_results_markdown }}
86+
- name: Demonstrate Upload Scan Results
87+
uses: actions/upload-artifact@v4
88+
with:
89+
name: Inspector Scan SBOM Results
90+
path: |
91+
${{ steps.inspector.outputs.artifact_sbom }}
92+
${{ steps.inspector.outputs.inspector_scan_results }}
93+
${{ steps.inspector.outputs.inspector_scan_results_csv }}
94+
${{ steps.inspector.outputs.inspector_scan_results_markdown }}
95+
${{ steps.inspector.outputs.inspector_dockerile_scan_results_csv }}
96+
${{ steps.inspector.outputs.inspector_dockerile_scan_results_markdown }}
97+
- name: On vulnerability threshold exceeded
98+
99+
# substitute 'exit' for 'echo' if you want to fail the job
100+
run: echo ${{ steps.inspector.outputs.vulnerability_threshold_exceeded }}

0 commit comments

Comments
 (0)