Skip to content
Scan Image on PR

fix: use curl instead of wget and add agent docs #89

Sign in to view logs

fix: use curl instead of wget and add agent docs

fix: use curl instead of wget and add agent docs #89

Workflow file for this run

.github/workflows/ci-scan.yaml at 523599d
name: Scan Image on PR
on:
pull_request:
jobs:
scan-from-registry:
runs-on: ubuntu-latest
steps:
# This step checks out a copy of your repository.
- name: Check out repository
uses: actions/checkout@v4
- name: Scan dummy-vuln-app from registry
id: scan
uses: ./
continue-on-error: true
with:
# Tag of the image to analyse
image-tag: sysdiglabs/dummy-vuln-app:latest
# API token for Sysdig Scanning auth
sysdig-secure-token: ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
stop-on-failed-policy-eval: true
stop-on-processing-error: true
severity-at-least: medium
- name: Upload SARIF file
if: success() || failure() # Upload results regardless previous step fails
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: ${{ github.workspace }}/sarif.json
- name: Check that the scan has failed
run: |
if [ "${{ steps.scan.outcome }}" == "success" ]; then
echo "Scan succeeded but the step should fail."
exit 1
else
echo "Scan failed as expected."
fi
filtered-scan-from-registry:
runs-on: ubuntu-latest
steps:
# This step checks out a copy of your repository.
- name: Check out repository
uses: actions/checkout@v4
- name: Scan dummy-vuln-app from registry
id: scan
uses: ./
continue-on-error: true
with:
# Tag of the image to analyse
image-tag: sysdiglabs/dummy-vuln-app:latest
# API token for Sysdig Scanning auth
sysdig-secure-token: ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
stop-on-failed-policy-eval: true
stop-on-processing-error: true
severity-at-least: medium
group-by-package: true
- name: Upload SARIF file
if: success() || failure() # Upload results regardless previous step fails
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: ${{ github.workspace }}/sarif.json
- name: Check that the scan has failed
run: |
if [ "${{ steps.scan.outcome }}" == "success" ]; then
echo "Scan succeeded but the step should fail."
exit 1
else
echo "Scan failed as expected."
fi
scan-with-old-scanner-version:
runs-on: ubuntu-latest
steps:
# This step checks out a copy of your repository.
- name: Check out repository
uses: actions/checkout@v4
- name: Scan dummy-vuln-app from registry
id: scan
uses: ./
continue-on-error: true
with:
# Old scanner version
cli-scanner-version: 1.18.0
# Tag of the image to analyse
image-tag: sysdiglabs/dummy-vuln-app:latest
# API token for Sysdig Scanning auth
sysdig-secure-token: ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
stop-on-failed-policy-eval: true
stop-on-processing-error: true
severity-at-least: medium
- name: Upload SARIF file
if: success() || failure() # Upload results regardless previous step fails
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: ${{ github.workspace }}/sarif.json
- name: Check that the scan has failed
run: |
if [ "${{ steps.scan.outcome }}" == "success" ]; then
echo "Scan succeeded but the step should fail."
exit 1
else
echo "Scan failed as expected."
fi
standalone-scan-from-registry:
runs-on: ubuntu-latest
steps:
# This step checks out a copy of your repository.
- name: Check out repository
uses: actions/checkout@v4
- name: Donate MainDB from scan
id: donnor-scan
uses: ./
with:
# Tag of the image to analyse
image-tag: sysdiglabs/dummy-vuln-app:latest
# API token for Sysdig Scanning auth
sysdig-secure-token: ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
stop-on-failed-policy-eval: false
stop-on-processing-error: true
skip-summary: true
- name: Scan dummy-vuln-app from registry
id: scan
uses: ./
with:
# Tag of the image to analyse
image-tag: sysdiglabs/dummy-vuln-app:latest
# API token for Sysdig Scanning auth
#sysdig-secure-token: ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
stop-on-failed-policy-eval: true
stop-on-processing-error: true
standalone: true
- name: Upload SARIF file
if: success() || failure() # Upload results regardless previous step fails
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: ${{ github.workspace }}/sarif.json
scan-with-multiple-policies:
runs-on: ubuntu-latest
steps:
# This step checks out a copy of your repository.
- name: Check out repository
uses: actions/checkout@v4
- name: Scan repository with multiple IaC policies
id: scan
uses: ./
continue-on-error: true
with:
sysdig-secure-token: ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
mode: iac
iac-scan-path: ./tests/fixtures/iac/
# Note: This test assumes these policies exist in the target Sysdig Secure account.
use-policies: '"All Posture Findings", "MITRE DEFEND"'
- name: Check that the scan has succeeded
run: |
if [ "${{ steps.scan.outcome }}" == "success" ]; then
echo "Scan succeeded as expected."
else
echo "Scan failed but it should have succeeded."
exit 1
fi
scan-with-correct-checksum:
runs-on: ubuntu-latest
steps:
- name: Check out repository
uses: actions/checkout@v4
- name: Scan with correct checksum
id: scan
uses: ./
with:
cli-scanner-version: '1.22.6'
cli-scanner-sha256sum: '68ec2fc48c6ad61eba60a2469c5548153700fedab40ac79e34b7baa5f2e86e42'
image-tag: sysdiglabs/dummy-vuln-app:latest
sysdig-secure-token: ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
stop-on-failed-policy-eval: false
- name: Check that the scan has succeeded
run: |
if [ "${{ steps.scan.outcome }}" == "success" ]; then
echo "Scan succeeded as expected."
else
echo "Scan failed but it should have succeeded."
exit 1
fi
scan-with-incorrect-checksum:
runs-on: ubuntu-latest
steps:
- name: Check out repository
uses: actions/checkout@v4
- name: Scan with incorrect checksum
id: scan
uses: ./
continue-on-error: true
with:
cli-scanner-version: '1.22.6'
cli-scanner-sha256sum: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'
image-tag: sysdiglabs/dummy-vuln-app:latest
sysdig-secure-token: ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
- name: Check that the scan has failed
run: |
if [ "${{ steps.scan.outcome }}" == "failure" ]; then
echo "Scan failed as expected."
else
echo "Scan succeeded but it should have failed due to incorrect checksum."
exit 1
fi