build(deps): bump fortify/gha-export-vulnerabilities from fcb374411cff9809028c911dabb8b57dbdae623b to d2838d7a21c0499504efe8f384573f51bea799e0 #171
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # This workflow uses actions that are not certified by GitHub. | |
| # They are provided by a third-party and are governed by | |
| # separate terms of service, privacy policy, and support | |
| # documentation. | |
| name: Cloudrail | |
| on: | |
| push: | |
| branches: [ "master" ] | |
| pull_request: | |
| branches: [ "master" ] | |
| schedule: | |
| - cron: '27 18 * * 6' | |
| permissions: | |
| contents: read | |
| jobs: | |
| cloudrail: | |
| name: Run Indeni Cloudrail on Terraform code with SARIF output | |
| runs-on: ubuntu-latest | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0 | |
| with: | |
| egress-policy: audit | |
| - name: Clone repo | |
| uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 | |
| # For Terraform, Cloudrail requires the plan as input. So we generate it using | |
| # the Terraform core binary. | |
| - uses: hashicorp/setup-terraform@a1502cd9e758c50496cc9ac5308c4843bcd56d36 # v3.0.0 | |
| with: | |
| terraform_version: v0.13.2 | |
| - run: terraform init | |
| - run: terraform plan -out=plan.out | |
| env: | |
| AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} | |
| AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} | |
| # Confirm we have the plan file | |
| - run: stat plan.out | |
| - name: Run Cloudrail | |
| uses: indeni/cloudrail-run-ga@b56ed2d30913c975b36df231adc2eabf05523622 | |
| with: | |
| tf-plan-file: plan.out # This was created in a "terraform plan" step | |
| cloudrail-api-key: ${{ secrets.CLOUDRAIL_API_KEY }} # This requires registration to Indeni Cloudrail's SaaS at https://web.cloudrail.app | |
| cloud-account-id: # Leave this empty for Static Analaysis, or provide an account ID for Dynamic Analysis, see instructions in Cloudrail SaaS | |
| - name: Upload SARIF file | |
| uses: github/codeql-action/upload-sarif@2f93e4319b2f04a2efc38fa7f78bd681bc3f7b2f # v2.23.2 | |
| # Remember that if issues are found, Cloudrail return non-zero exit code, so the if: always() | |
| # is needed to ensure the SARIF file is uploaded | |
| if: always() | |
| with: | |
| sarif_file: cloudrail_results.sarif |