Repository navigation
build(deps): bump anchore/sbom-action from 0.24.2 to 0.24.3 in the actions group #68
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ci | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| test-build-scan: | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 30 | |
| steps: | |
| - name: Checkout without persisted credentials | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Python | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.12" | |
| cache: pip | |
| cache-dependency-path: | | |
| services/requirements.lock | |
| tests/requirements.lock | |
| - name: Install test dependencies | |
| run: python -m pip install --disable-pip-version-check --require-hashes -r services/requirements.lock -r tests/requirements.lock | |
| - name: Run deterministic validation | |
| run: bash scripts/test-local.sh | |
| - name: Validate Compose contract | |
| run: | | |
| python deploy/init_secrets.py | |
| docker compose config --quiet | |
| rm -f .env | |
| - name: Scan repository dependencies, secrets and misconfiguration | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| scan-type: fs | |
| scan-ref: . | |
| scanners: vuln,secret,misconfig | |
| severity: CRITICAL,HIGH | |
| ignore-unfixed: true | |
| exit-code: "1" | |
| - name: Build gateway image | |
| run: docker build --pull --file services/security-tool-gateway/Dockerfile --tag cyberguard/security-tool-gateway:ci . | |
| - name: Build executor image | |
| run: docker build --pull --file services/response-executor/Dockerfile --tag cyberguard/response-executor:ci . | |
| - name: Build and run isolated account lab | |
| env: | |
| CYBERGUARD_SOURCE_COMMIT: ${{ github.sha }} | |
| run: | | |
| docker compose -f compose.lab.yaml up --build --abort-on-container-exit --exit-code-from lab | |
| mkdir -p artifacts/lab | |
| docker compose -f compose.lab.yaml cp lab:/artifacts/. artifacts/lab/ | |
| docker run --rm --network none --read-only --cap-drop ALL --security-opt no-new-privileges --tmpfs /tmp:rw,noexec,nosuid,size=128m cyberguard/lab:local python tests/test_lab_execution.py | |
| - name: Run isolated process recurrence lab | |
| env: | |
| CYBERGUARD_SOURCE_COMMIT: ${{ github.sha }} | |
| run: | | |
| docker compose -f compose.host-lab.yaml up --build --abort-on-container-exit --exit-code-from host-lab | |
| mkdir -p artifacts/host-lab | |
| docker compose -f compose.host-lab.yaml cp host-lab:/artifacts/. artifacts/host-lab/ | |
| docker run --rm --network none --read-only --cap-drop ALL --security-opt no-new-privileges --tmpfs /tmp:rw,noexec,nosuid,size=128m cyberguard/host-lab:local python tests/test_host_lab.py | |
| - name: Run isolated investigation pipeline | |
| env: | |
| CYBERGUARD_SOURCE_COMMIT: ${{ github.sha }} | |
| run: | | |
| docker compose -f compose.investigation.yaml up --build --abort-on-container-exit --exit-code-from investigation | |
| mkdir -p artifacts/investigation | |
| docker compose -f compose.investigation.yaml cp investigation:/artifacts/. artifacts/investigation/ | |
| docker run --rm --network none --read-only --cap-drop ALL --security-opt no-new-privileges --tmpfs /tmp:rw,noexec,nosuid,size=128m cyberguard/investigation:local python tests/test_investigation_gateway.py | |
| - name: Upload lab evidence | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: cyberguard-lab-${{ github.sha }} | |
| path: | | |
| artifacts/lab/ | |
| artifacts/host-lab/ | |
| artifacts/investigation/ | |
| if-no-files-found: error | |
| retention-days: 30 | |
| - name: Scan gateway image | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| image-ref: cyberguard/security-tool-gateway:ci | |
| vuln-type: os,library | |
| severity: CRITICAL,HIGH | |
| ignore-unfixed: true | |
| exit-code: "1" | |
| - name: Scan executor image | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| image-ref: cyberguard/response-executor:ci | |
| vuln-type: os,library | |
| severity: CRITICAL,HIGH | |
| ignore-unfixed: true | |
| exit-code: "1" | |
| - name: Prepare SBOM output directory | |
| run: mkdir -p artifacts/sbom | |
| - name: Generate gateway SBOM | |
| uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3 | |
| with: | |
| image: cyberguard/security-tool-gateway:ci | |
| format: spdx-json | |
| output-file: artifacts/sbom/gateway.spdx.json | |
| upload-artifact: false | |
| upload-release-assets: false | |
| - name: Generate executor SBOM | |
| uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3 | |
| with: | |
| image: cyberguard/response-executor:ci | |
| format: spdx-json | |
| output-file: artifacts/sbom/executor.spdx.json | |
| upload-artifact: false | |
| upload-release-assets: false | |
| - name: Generate deterministic source SBOM | |
| run: python scripts/generate-source-sbom.py --output artifacts/sbom/source.spdx.json | |
| - name: Upload SBOM evidence | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: cyberguard-sbom-${{ github.sha }} | |
| path: artifacts/sbom/*.spdx.json | |
| if-no-files-found: error | |
| retention-days: 30 |