Skip to content

Commit 6bef775

Browse files
vipin230vipin230
committed
test wiz cli
Signed-off-by: Vipin Yadav <vipin.yadav@progress.com>
1 parent 0e08907 commit 6bef775

2 files changed

Lines changed: 141 additions & 0 deletions

File tree

‎.github/workflows/ci-main-pull-request.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -161,6 +161,21 @@ on:
161161
required: false
162162
type: boolean
163163
default: false
164+
perform-wiz-scan:
165+
description: 'Perform Wiz CLI scan on Docker image'
166+
required: false
167+
type: boolean
168+
default: false
169+
wiz-fail-build:
170+
description: 'Fail the build on Wiz policy violations'
171+
required: false
172+
type: boolean
173+
default: true
174+
wiz-image-skip-aws:
175+
description: 'Skip AWS ECR login for Wiz image scan'
176+
required: false
177+
type: boolean
178+
default: false
164179
build:
165180
description: 'CI Build (language-specific)'
166181
required: false
@@ -908,6 +923,16 @@ jobs:
908923
fail-grype-on-high: ${{ inputs.grype-image-fail-on-high }}
909924
fail-grype-on-critical: ${{ inputs.grype-image-fail-on-critical }}
910925
grype-image-skip-aws: ${{ inputs.grype-image-skip-aws }}
926+
927+
run-wiz-image:
928+
name: 'Wiz CLI Docker image scan'
929+
if: ${{ inputs.perform-wiz-scan }}
930+
uses: chef/common-github-actions/.github/workflows/wiz.yml@test-pipeline
931+
needs: checkout
932+
secrets: inherit
933+
with:
934+
fail-build: ${{ inputs.wiz-fail-build }}
935+
wiz-image-skip-aws: ${{ inputs.wiz-image-skip-aws }}
911936

912937
# run-srcclr:
913938
# if: ${{ inputs.perform-srcclr-scan == true }}

‎.github/workflows/wiz.yml‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,116 @@
1+
# wiz.yml
2+
# Wiz CLI security scan for Docker image vulnerabilities and policy violations
3+
# Uses the prgs-community/githubactions-reusableworkflows/actions/wizcli composite action
4+
# which handles Wiz CLI install, AKeyless auth, scanning, and job summary automatically.
5+
# https://docs.wiz.io/wiz-docs/docs/wiz-cli-overview
6+
7+
name: Wiz CLI security scan
8+
9+
on:
10+
workflow_call:
11+
inputs:
12+
fail-build:
13+
description: 'Fail the build on Wiz policy violations'
14+
required: false
15+
type: boolean
16+
default: true
17+
wiz-image-skip-aws:
18+
description: 'Skip AWS ECR login (assumes images are scanned elsewhere)'
19+
required: false
20+
type: boolean
21+
default: false
22+
23+
jobs:
24+
wiz-scan:
25+
name: Wiz CLI container image scan
26+
runs-on: ubuntu-latest
27+
permissions:
28+
id-token: write
29+
contents: read
30+
steps:
31+
- name: Checkout code
32+
uses: actions/checkout@v6
33+
with:
34+
fetch-depth: 0
35+
36+
- name: Configure git for private repos
37+
run: git config --global url."https://${{ secrets.GH_TOKEN }}@github.com/".insteadOf "https://github.com/"
38+
39+
# - name: Configure AWS credentials
40+
# uses: aws-actions/configure-aws-credentials@v4
41+
# if: ${{ !inputs.wiz-image-skip-aws }}
42+
# with:
43+
# aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
44+
# aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
45+
# aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }}
46+
# aws-region: us-east-2
47+
48+
# - name: Login to Amazon ECR
49+
# id: login-ecr
50+
# if: ${{ !inputs.wiz-image-skip-aws }}
51+
# uses: aws-actions/amazon-ecr-login@v2
52+
53+
- name: Build Docker image
54+
id: build-image
55+
env:
56+
GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
57+
run: |
58+
REPO_NAME=$(basename $(pwd))
59+
60+
if [ ! -f "Dockerfile" ]; then
61+
echo "❌ No Dockerfile found - this workflow requires a Dockerfile to scan Docker image"
62+
exit 1
63+
fi
64+
65+
echo "Building Docker image..."
66+
67+
# Strategy 1: Check for build-docker.sh script (e.g., dsm-erchef)
68+
if [ -f "build-docker.sh" ]; then
69+
echo "Found build-docker.sh script - using it to build images"
70+
chmod +x build-docker.sh
71+
GITHUB_TOKEN="${{ secrets.GH_TOKEN }}" ./build-docker.sh
72+
73+
IMAGE=$(docker images --format "{{.Repository}}:{{.Tag}}" | grep -E "^${REPO_NAME}" | grep -v "^<none>" | head -1)
74+
75+
if [ -z "$IMAGE" ]; then
76+
echo "⚠️ No image found with prefix ${REPO_NAME} after build-docker.sh"
77+
echo "Checking for any recently built images..."
78+
IMAGE=$(docker images --format "{{.CreatedAt}}\t{{.Repository}}:{{.Tag}}" | sort -r | head -1 | cut -f2)
79+
fi
80+
# Strategy 2: Check for Makefile with compose-build target
81+
elif [ -f "Makefile" ] && grep -q "^compose-build:" Makefile; then
82+
echo "Using Makefile compose-build target with GITHUB_TOKEN"
83+
export GITHUB_TOKEN="${{ secrets.GH_TOKEN }}"
84+
make compose-build
85+
86+
echo "Detecting built image..."
87+
docker compose images
88+
89+
IMAGE=$(docker images --format "{{.Repository}}:{{.Tag}}" | grep "^${REPO_NAME}" | grep -v "^<none>" | head -1)
90+
91+
if [ -z "$IMAGE" ]; then
92+
echo "No image found with prefix ${REPO_NAME}, using most recent image"
93+
IMAGE=$(docker images --format "{{.Repository}}:{{.Tag}}" | grep -v "^<none>" | head -1)
94+
fi
95+
# Strategy 3: Fallback to standard docker build
96+
else
97+
echo "Using standard docker build with GITHUB_TOKEN build arg"
98+
docker build --build-arg GITHUB_TOKEN="${{ secrets.GH_TOKEN }}" -t "${REPO_NAME}:latest" .
99+
IMAGE="${REPO_NAME}:latest"
100+
fi
101+
102+
if [ -z "$IMAGE" ]; then
103+
echo "❌ No Docker image found after build"
104+
exit 1
105+
fi
106+
107+
echo "Image to scan: $IMAGE"
108+
echo "IMAGE=$IMAGE" >> "$GITHUB_OUTPUT"
109+
110+
- name: Wiz CLI container image scan
111+
id: wiz-scan
112+
uses: prgs-community/githubactions-reusableworkflows/actions/wizcli@latest
113+
with:
114+
scan-type: 'container-image'
115+
scan-target: ${{ steps.build-image.outputs.IMAGE }}
116+
fail-build: ${{ inputs.fail-build }}

0 commit comments

Comments
 (0)