example.yaml

name: Example

on:
  pull_request:
  push:
    branches: main

jobs:
  example:
    # Skip if Dependabot. For now, we'll rely only on the types to ensure
    # dependency updates are safe, rather than share the Wiz secrets so this can
    # run.
    if: ${{ github.actor != 'dependabot[bot]' }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - id: scan
        name: Scan statsd/statsd:v0.9.0 with wiz
        uses: ./
        with:
          wiz-client-id: ${{ secrets.WIZ_CLIENT_ID }}
          wiz-client-secret: ${{ secrets.WIZ_CLIENT_SECRET }}
          wiz-api-endpoint-url: ${{ vars.WIZ_API_ENDPOINT_URL }}
          image: statsd/statsd:v0.9.0 # has many, many CVEs
          custom-policies: tvm_automation_policy
          fail: false
          pull: true

      - name: Verify Scan Id
        run: |
          if [[ -z "${{ steps.scan.outputs.scan-id }}" ]]; then
            echo "Scan step should've set a scan-id, it did not" >&2
            exit 1
          fi

      - name: Verify scan result
        run: |
          result=${{ steps.scan.outputs.scan-result }}

          if [[ "$result" != "failed" ]]; then
            echo "Scan step should've reported scan-result=failed" >&2
            echo "Instead, it reported scan-result=$result" >&2
            exit 1
          fi