forked from port-labs/ocean
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'main' into clickup-integrations
- Loading branch information
Showing
137 changed files
with
5,613 additions
and
780 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -47,18 +47,26 @@ jobs: | |
| contents: read | ||
| needs: [prepare-matrix] | ||
| strategy: | ||
| max-parallel: 5 | ||
| max-parallel: 10 | ||
| matrix: | ||
| integration: ${{fromJson(needs.prepare-matrix.outputs.matrix)}} | ||
| platform: | ||
| - linux/amd64 | ||
| - linux/arm64 | ||
| steps: | ||
| - name: Check out code | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Set up QEMU | ||
| uses: docker/setup-qemu-action@v3 | ||
| with: | ||
| platforms: linux/amd64,linux/arm64 | ||
| platforms: ${{ matrix.platform }} | ||
|
|
||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v3 | ||
| with: | ||
| platforms: ${{ matrix.platform }} | ||
|
|
||
| - name: Prepare Docker images tags | ||
| id: prepare_tags | ||
| run: | | ||
|
|
@@ -74,6 +82,7 @@ jobs: | |
| dockerfile_path=integrations/_infra/Dockerfile | ||
| if test -e $folder/../Dockerfile; then | ||
| echo "Choosing a custom Dockerfile for ${{ matrix.integration }}" | ||
| dockerfile_path=$folder/../Dockerfile | ||
| fi | ||
| echo "dockerfile_path=$dockerfile_path" >> $GITHUB_OUTPUT | ||
|
|
@@ -92,16 +101,31 @@ jobs: | |
| echo "is_dev_version=false" >> $GITHUB_OUTPUT | ||
| fi | ||
| - name: Get used docker base image | ||
| id: get-docker-image | ||
| run: | | ||
| echo "base_image=$(cat ${{ steps.prepare_tags.outputs.dockerfile_path }} | head -n 1 | awk -F '=' '{print $2}' )" >> $GITHUB_OUTPUT | ||
| - name: Cache Docker images | ||
| uses: ScribeMD/[email protected] | ||
| with: | ||
| key: docker-${{ matrix.integration }}-${{ steps.get-docker-image.outputs.base_image }}-${{ matrix.platform }} | ||
|
|
||
| - name: Build | ||
| uses: docker/build-push-action@v6 | ||
| with: | ||
| context: . | ||
| file: ${{ steps.prepare_tags.outputs.dockerfile_path }} | ||
| platforms: linux/amd64,linux/arm64 | ||
| platforms: ${{ matrix.platform }} | ||
| push: false | ||
| load: true | ||
| cache-from: type=gha | ||
| cache-to: type=gha,mode=max | ||
| tags: ${{ steps.prepare_tags.outputs.tags }} | ||
| build-args: | | ||
| BUILD_CONTEXT=${{ steps.prepare_tags.outputs.context_dir }} | ||
| INTEGRATION_VERSION=${{ steps.prepare_tags.outputs.version }} | ||
| - name: Verify Built Image | ||
| run: | | ||
| docker run --platform ${{ matrix.platform }} --rm --entrypoint bash ${{ steps.prepare_tags.outputs.tags }} -c 'ocean version' | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,136 @@ | ||
| name: Scan docker images | ||
| on: | ||
| workflow_dispatch: | ||
| inputs: | ||
| image: | ||
| type: choice | ||
| description: Image/s to scan | ||
| # This is a bit annoying, there's no real way to display the integrations dynamically in a dropdown for the action dispatcher | ||
| options: | ||
| - all | ||
| - aws | ||
| - azure-devops | ||
| - dynatrace | ||
| - fake-integration | ||
| - gcp | ||
| - jenkins | ||
| - kafka | ||
| - launchdarkly | ||
| - newrelic | ||
| - opencost | ||
| - pagerduty | ||
| - servicenow | ||
| - sonarqube | ||
| - terraform-cloud | ||
| - argocd | ||
| - azure | ||
| - datadog | ||
| - firehydrant | ||
| - gitlab | ||
| - jira | ||
| - kubecost | ||
| - linear | ||
| - octopus | ||
| - opsgenie | ||
| - sentry | ||
| - snyk | ||
| - statuspage | ||
| - wiz | ||
|
|
||
| jobs: | ||
| detect-images: | ||
| runs-on: ubuntu-latest | ||
| outputs: | ||
| images: ${{ steps.set-images.outputs.images }} | ||
| steps: | ||
| - name: Checkout Repo | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Determine which image to scan | ||
| id: set-images | ||
| run: | | ||
| PROJECTS=$(ls --color=never ./integrations | grep -Ev '_infra') | ||
| if [[ "${{ inputs.image }}" != "all" ]]; then | ||
| PROJECTS="${{ inputs.image }}" | ||
| fi | ||
| IMAGES_WITH_VERSIONS=() | ||
| for PROJECT in ${PROJECTS}; do | ||
| if [[ ! -f ./integrations/"${PROJECT}"/pyproject.toml ]]; then | ||
| continue | ||
| fi | ||
| VERSION=$(cat ./integrations/"${PROJECT}"/pyproject.toml | grep -E '^version = "(.*)"$' | awk -F ' ' '{print $3};' | sed 's/"//g') | ||
| if [[ -n ${VERSION} ]]; then | ||
| IMAGES_WITH_VERSIONS+=( "${PROJECT}:${VERSION}" ) | ||
| fi | ||
| done | ||
| IMAGES=$(echo "${IMAGES_WITH_VERSIONS[@]}" | jq -R -s -c 'split(" ") | map(select(length > 0))') | ||
| echo "Images to scan: ${IMAGES}" | ||
| echo "images=${IMAGES}" >> $GITHUB_OUTPUT | ||
| scan-images: | ||
| needs: detect-images | ||
| runs-on: ubuntu-latest | ||
| strategy: | ||
| max-parallel: 2 | ||
| matrix: | ||
| image: ${{ fromJson(needs.detect-images.outputs.images) }} | ||
| steps: | ||
| - name: Checkout Repo | ||
| uses: actions/checkout@v4 | ||
|
|
||
| - name: Set up QEMU | ||
| uses: docker/setup-qemu-action@v3 | ||
| with: | ||
| platforms: linux/amd64,linux/arm64 | ||
|
|
||
| - name: Set up Docker Buildx | ||
| uses: docker/setup-buildx-action@v3 | ||
|
|
||
| - name: Extract version and image tag | ||
| id: enrich-version | ||
| run: | | ||
| INTEGRATION=$(echo "${{ matrix.image }}" | awk -F ':' '{print $1};') | ||
| VERSION=$(echo "${{ matrix.image }}" | awk -F ':' '{print $2};') | ||
| IDENTIFIER="${INTEGRATION}-${VERSION}-${{ github.sha }}" | ||
| IMAGE_FULL_TAG="port-ocean-security-tests-${INTEGRATION}:${VERSON}${{ github.sha }}" | ||
| echo "integration=${INTEGRATION}" >> ${GITHUB_OUTPUT} | ||
| echo "version=${VERSION}" >> ${GITHUB_OUTPUT} | ||
| echo "identifier=${IDENTIFIER}" >> ${GITHUB_OUTPUT} | ||
| echo "image_tag=${IMAGE_FULL_TAG}" >> ${GITHUB_OUTPUT} | ||
| - name: Build | ||
| uses: docker/build-push-action@v6 | ||
| with: | ||
| context: . | ||
| file: ./integrations/_infra/Dockerfile | ||
| platforms: linux/amd64 | ||
| push: false | ||
| tags: ${{ steps.enrich-version.outputs.image_tag }} | ||
| load: true | ||
| cache-from: type=gha | ||
| cache-to: type=gha,mode=max | ||
| build-args: | | ||
| BUILD_CONTEXT=./integrations/${{ steps.enrich-version.outputs.integration }} | ||
| INTEGRATION_VERSION=${{ steps.enrich-version.outputs.version }} | ||
| - name: Run Trivy vulnerability scanner | ||
| uses: aquasecurity/[email protected] | ||
| with: | ||
| image-ref: ${{ steps.enrich-version.outputs.image_tag }} | ||
| ignore-unfixed: true | ||
| vuln-type: 'os,library' | ||
| severity: 'CRITICAL,HIGH' | ||
| output: trivy-${{ steps.enrich-version.outputs.integration }}.txt | ||
|
|
||
| - name: Publish Trivy Output to Summary | ||
| run: | | ||
| if [[ -s trivy-${{ steps.enrich-version.outputs.integration }}.txt ]]; then | ||
| { | ||
| echo "### Security Output" | ||
| echo "<details><summary>Click to expand</summary>" | ||
| echo "" | ||
| echo '```terraform' | ||
| cat trivy-${{ steps.enrich-version.outputs.integration }}.txt | ||
| echo '```' | ||
| echo "</details>" | ||
| } >> $GITHUB_STEP_SUMMARY | ||
| fi |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| ./Dockerfile.Deb |
Oops, something went wrong.