Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Workflow for PR run checks to manage secret usage #71

Merged
merged 13 commits into from
Mar 8, 2024
Merged

Workflow for PR run checks to manage secret usage #71

Show file tree
Hide file tree
Changes from 12 commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
e985a07
Workflow for PR run checks to manage secret usage
withinfocus Mar 1, 2024
87904ee
Use full permission check
withinfocus Mar 4, 2024
4e4b12e
Make check-run only for workflow calls and scan on targets
withinfocus Mar 5, 2024
22beae5
Check target
withinfocus Mar 5, 2024
a0ef2a1
Preliminary needs
withinfocus Mar 5, 2024
ca2da45
Keep target removed
withinfocus Mar 5, 2024
24c4e28
Temporarily open up
withinfocus Mar 5, 2024
65a9560
Revert "Temporarily open up"
withinfocus Mar 5, 2024
b02a21e
Always run check
withinfocus Mar 5, 2024
13efe89
Allow PRs again, and check only on targets
withinfocus Mar 5, 2024
92b5cba
Incremental for both PR events
withinfocus Mar 5, 2024
015e179
Do not skip
withinfocus Mar 5, 2024
f634c62
Removal for final testing post-merge
withinfocus Mar 8, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 29 additions & 0 deletions .github/workflows/check-run.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
name: Check PR run

on:
workflow_call:

permissions: read-all

jobs:
check:
name: Check
runs-on: ubuntu-22.04

steps:
- name: Get user permission
id: get-permission
uses: actions-cool/check-user-permission@956b2e73cdfe3bcb819bb7225e490cb3b18fd76e # v2.2.1
with:
require: write
username: ${{ github.triggering_actor }}
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

- name: Check user permission
if: steps.get-permission.outputs.require-result == 'false'
run: |
echo "User ${{ github.triggering_actor }} does not have the necessary access for this repository."
echo "Current permission level is ${{ steps.get-permission.outputs.user-permission }}."
echo "Job originally triggered by ${{ github.actor }}."
exit 1
13 changes: 12 additions & 1 deletion .github/workflows/scan.yml
View file
Open in desktop
withinfocus marked this conversation as resolved.
Show resolved Hide resolved
Original file line number Diff line number Diff line change
Expand Up @@ -8,24 +8,33 @@ on:
- "rc"
- "hotfix-rc"
pull_request:
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't believe we need pull_request, target should run on both forks and local PRs just in a different context https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Based on my testing it didn't work, but I'll remove that for the moment and we merge to see what really happens.

pull_request_target:
types: [opened, synchronize]

permissions: read-all

jobs:
check-run:
name: Check PR run
uses: ./.github/workflows/check-run.yml

sast:
name: SAST scan
runs-on: ubuntu-22.04
needs: check-run
permissions:
security-events: write

steps:
- name: Check out repo
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
with:
ref: ${{ github.event.pull_request.head.sha }}

- name: Scan with Checkmarx
uses: checkmarx/ast-github-action@749fec53e0db0f6404a97e2e0807c3e80e3583a7 #2.0.23
env:
INCREMENTAL: "${{ github.event_name == 'pull_request' && '--sast-incremental' || '' }}"
INCREMENTAL: "${{ contains(github.event_name, 'pull_request') && '--sast-incremental' || '' }}"
with:
project_name: ${{ github.repository }}
cx_tenant: ${{ secrets.CHECKMARX_TENANT }}
Expand All @@ -42,12 +51,14 @@ jobs:
quality:
name: Quality scan
runs-on: ubuntu-22.04
needs: check-run

steps:
- name: Check out repo
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
with:
fetch-depth: 0
ref: ${{ github.event.pull_request.head.sha }}

- name: Scan with SonarCloud
uses: sonarsource/sonarcloud-github-action@49e6cd3b187936a73b8280d59ffd9da69df63ec9 # v2.1.1
Expand Down