Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

demo: policy denials #4

Draft
wants to merge 3 commits into
base: main
Choose a base branch
from
Draft

demo: policy denials #4

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5ffc9ce
demo: demonstrate that policy verification will deny the removal of a…
kriscoleman Nov 17, 2023
1a8740f
fix: don't skip verify?
kriscoleman Nov 17, 2023
76ff9ad
fix: use in-toto instead of testifysec when pulling witness
kriscoleman Nov 17, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 2 additions & 18 deletions .github/workflows/pipeline.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,21 +143,6 @@ jobs:
artifact-upload-name: syft.spdx.json
artifact-upload-path: syft.spdx.json

cve-scan:
needs: save-image
uses: ./.github/workflows/witness.yml
with:
pull_request: ${{ github.event_name == 'pull_request' }}
step: cve-scan
attestations: "git github environment"
artifact-download: image.tar
pre-command: |
curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin
command: |
grype docker-archive:/tmp/image.tar -o sarif --file grype.sarif
artifact-upload-name: grype.sarif
artifact-upload-path: grype.sarif

secret-scan:
needs: save-image
uses: ./.github/workflows/witness.yml
Expand All @@ -174,17 +159,16 @@ jobs:
artifact-upload-path: trufflehog.json

verify:
needs: [ generate-sbom, cve-scan, secret-scan]
needs: [ generate-sbom, secret-scan]

if: ${{ github.event_name == 'push' }}
uses: ./.github/workflows/witness.yml
with:
pull_request: ${{ github.event_name == 'pull_request' }}
step: verify
attestations: "git github environment"
artifact-download: image.tar
pre-command: |
curl -sSfL https://github.com/testifysec/witness/releases/download/v0.1.14/witness_0.1.14_linux_amd64.tar.gz -o witness.tar.gz && \
curl -sSfL https://github.com/in-toto/witness/releases/download/v0.1.14/witness_0.1.14_linux_amd64.tar.gz -o witness.tar.gz && \
tar -xzvf witness.tar.gz -C /usr/local/bin/ && rm ./witness.tar.gz
command: |
witness verify -p policy-signed.json -k swfpublic.pem -f /tmp/image.tar --enable-archivista -l debug
Loading