Merge pull request #54 from supernovae/feat/openshift-ai-3.4 #270
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Security and Quality Checks | |
| # Runs on all PRs and pushes to main | |
| name: Security Checks | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| security-events: write | |
| jobs: | |
| #---------------------------------------------------------------------------- | |
| # Shell Script Security | |
| #---------------------------------------------------------------------------- | |
| shellcheck: | |
| name: ShellCheck | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Run ShellCheck | |
| uses: ludeeus/action-shellcheck@master | |
| with: | |
| scandir: "." | |
| severity: warning | |
| format: gcc | |
| env: | |
| SHELLCHECK_OPTS: -x -e SC1091 | |
| #---------------------------------------------------------------------------- | |
| # Terraform Security Scanning | |
| # tfsec + Checkov provide comprehensive IaC coverage. | |
| #---------------------------------------------------------------------------- | |
| tfsec: | |
| name: tfsec Security Scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Install tfsec | |
| run: | | |
| curl -sLo tfsec https://github.com/aquasecurity/tfsec/releases/latest/download/tfsec-linux-amd64 | |
| chmod +x tfsec | |
| sudo mv tfsec /usr/local/bin/ | |
| - name: Run tfsec | |
| run: | | |
| tfsec . --format sarif --out tfsec-results.sarif --soft-fail || true | |
| if [ ! -s tfsec-results.sarif ]; then | |
| echo '{"version":"2.1.0","$schema":"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/Schemata/sarif-schema-2.1.0.json","runs":[{"tool":{"driver":{"name":"tfsec","rules":[]}},"results":[]}]}' > tfsec-results.sarif | |
| fi | |
| - name: Upload tfsec results | |
| uses: github/codeql-action/upload-sarif@v4 | |
| if: always() | |
| with: | |
| sarif_file: tfsec-results.sarif | |
| #---------------------------------------------------------------------------- | |
| # Vulnerability Scanning | |
| #---------------------------------------------------------------------------- | |
| grype: | |
| name: Grype Vulnerability Scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Run Grype filesystem scan | |
| uses: anchore/scan-action@v7 | |
| id: grype | |
| with: | |
| path: "." | |
| fail-build: false | |
| severity-cutoff: high | |
| output-format: sarif | |
| output-file: grype-results.sarif | |
| - name: Upload Grype results | |
| uses: github/codeql-action/upload-sarif@v4 | |
| if: always() | |
| with: | |
| sarif_file: grype-results.sarif | |
| checkov: | |
| name: Checkov | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Run Checkov | |
| uses: bridgecrewio/checkov-action@v12 | |
| with: | |
| directory: . | |
| framework: terraform | |
| soft_fail: true | |
| output_format: sarif | |
| output_file_path: checkov-results.sarif | |
| config_file: .checkov.yml | |
| - name: Upload Checkov results | |
| uses: github/codeql-action/upload-sarif@v4 | |
| if: always() | |
| with: | |
| sarif_file: checkov-results.sarif | |
| #---------------------------------------------------------------------------- | |
| # Secrets Detection | |
| #---------------------------------------------------------------------------- | |
| gitleaks: | |
| name: Gitleaks Secret Scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Run Gitleaks | |
| uses: gitleaks/gitleaks-action@v2.3.9 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| trufflehog: | |
| name: TruffleHog Secret Scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Run TruffleHog | |
| uses: trufflesecurity/trufflehog@main | |
| with: | |
| extra_args: --only-verified | |
| #---------------------------------------------------------------------------- | |
| # Terraform Validation | |
| #---------------------------------------------------------------------------- | |
| terraform-validate: | |
| name: Terraform Validate | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: | |
| environment: | |
| - commercial-classic | |
| - commercial-hcp | |
| - govcloud-classic | |
| - govcloud-hcp | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Setup Terraform | |
| uses: hashicorp/setup-terraform@v4 | |
| with: | |
| terraform_version: "~> 1.6" | |
| - name: Terraform Format Check | |
| run: terraform fmt -check -recursive | |
| - name: Terraform Init | |
| working-directory: environments/${{ matrix.environment }} | |
| run: terraform init -backend=false | |
| - name: Terraform Validate | |
| working-directory: environments/${{ matrix.environment }} | |
| run: terraform validate | |
| #---------------------------------------------------------------------------- | |
| # YAML Linting | |
| #---------------------------------------------------------------------------- | |
| yaml-lint: | |
| name: YAML Lint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Run yamllint | |
| uses: ibiqlik/action-yamllint@v3 | |
| with: | |
| file_or_dir: "." | |
| config_file: .yamllint.yml | |
| continue-on-error: true |