prisma.yml

# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.

# A sample workflow that checks for security issues using
# the Prisma Cloud Infrastructure as Code Scan Action on
# the IaC files present in the repository.
# The results are uploaded to GitHub Security Code Scanning
#
# For more details on the Action configuration see https://github.com/prisma-cloud-shiftleft/iac-scan-action

name: Prisma Cloud IaC Scan

on:
  push:
    branches: [ "master" ]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [ "master" ]
  schedule:
    - cron: '41 13 * * 1'

permissions:
  contents: read

jobs:
  prisma_cloud_iac_scan:
    permissions:
      contents: read # for actions/checkout to fetch code
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
    runs-on: ubuntu-latest
    name: Run Prisma Cloud IaC Scan to check
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
      - id: iac-scan
        name: Run Scan on CFT files in the repository
        uses: prisma-cloud-shiftleft/iac-scan-action@53278c231c438216d99b463308a3cbed351ba0c3
        with:
          # You will need Prisma Cloud API Access Token
          # More details in https://github.com/prisma-cloud-shiftleft/iac-scan-action
          prisma_api_url: ${{ secrets.PRISMA_CLOUD_API_URL }}
          access_key: ${{ secrets.PRISMA_CLOUD_ACCESS_KEY }}
          secret_key: ${{ secrets.PRISMA_CLOUD_SECRET_KEY }}
          # Scan sources on Prisma Cloud are uniquely identified by their name
          asset_name: 'my-asset-name'
          # The service need to know the type of IaC being scanned
          template_type: 'CFT'
      - name: Upload SARIF file
        uses: github/codeql-action/upload-sarif@2f93e4319b2f04a2efc38fa7f78bd681bc3f7b2f # v2.23.2
        # Results are generated only on a success or failure
        # this is required since GitHub by default won't run the next step
        # when the previous one has failed.
        # And alternative it to add `continue-on-error: true` to the previous step
        if: success() || failure()
        with:
          # The SARIF Log file name is configurable on scan action
          # therefore the file name is best read from the steps output
          sarif_file: ${{ steps.iac-scan.outputs.iac_scan_result_sarif_path }}