You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# perform application build and unit testing, will use custom repository properties when implemented for chef-primary-application, chef-build-profile, and chef-build-language
68
-
build: true
68
+
build: false
69
69
# ga-build-profile: $chef-ga-build-profile
70
70
# language: $chef-ga-build-language # this will be removed from stub as autodetected in central GA
71
71
unit-tests: false
72
72
73
73
# perform SonarQube scan, with or wihout unit test coverage data
74
74
# requires secrets SONAR_TOKEN and SONAR_HOST_URL (progress.sonar.com)
75
-
perform-sonarqube-scan: true
75
+
perform-sonarqube-scan: false
76
76
# perform-sonar-build: true
77
77
# build-profile: 'default'
78
78
# report-unit-test-coverage: true
79
79
80
80
# report to central developer dashboard
81
81
report-to-atlassian-dashboard: false
82
-
quality-product-name: ${{ github.event.repository.name }} # product name for quality reporting, like Chef360, Courier, Inspec
82
+
quality-product-name: 'Chef-Agents'# product name for quality reporting, like Chef360, Courier, Inspec
83
+
# quality-product-name: ${{ github.event.repository.name }} # like 'Chef-360' - the product name for quality reporting, like Chef360, Courier, Inspec
83
84
# quality-sonar-app-name: 'YourSonarAppName'
84
85
# quality-testing-type: 'Integration' like Unit, Integration, e2e, api, Performance, Security
85
86
# quality-service-name: 'YourServiceOrRepoName'
@@ -95,11 +96,9 @@ jobs:
95
96
export-github-sbom: true # SPDX JSON artifact on job instance
96
97
perform-blackduck-sca-scan: true # combined with generate sbom & generate github-sbom, also needs version above
97
98
blackduck-project-group-name: 'Chef-Agents'# typically one of (Chef), Chef-Agents, Chef-Automate, Chef-Chef360, Chef-Habitat, Chef-Infrastructure-Server, Chef-Shared-Services, Chef-Non-Product'
98
-
blackduck-project-name: ${{ github.event.repository.name }} # BlackDuck project name, typically the repository name - using chef-chef-cli as using 'chef-cli' a name in sbominator fails to generate the notice file with invalid group error
99
+
blackduck-project-name: ${{ github.event.repository.name }} # BlackDuck project name, typically the repository name
99
100
generate-blackduck-sbom: true # obsolete, use perform-blackduck-sca-scan instead
100
-
101
-
run-bundle-install: true
102
-
101
+
103
102
generate-msft-sbom: false
104
103
license_scout: false # Run license scout for license compliance (uses .license_scout.yml)
# stub to call common GitHub Action (GA) as part of Continuous Integration (CI) Pull Request process checks for main branch
2
+
# inputs are described in the chef/common-github-actions/<GA.yml> with same name as this stub
3
+
#
4
+
# secrets are inherited from the calling workflow, typically SONAR_TOKEN, SONAR_HOST_URL, GH_TOKEN, AKEYLESS_JWT_ID, POLARIS_SERVER_URL and POLARIS_ACCESS_TOKEN
5
+
6
+
name: CI Pull Request on Main Branch
7
+
8
+
on:
9
+
pull_request:
10
+
branches: [ main, release/** ]
11
+
push:
12
+
branches: [ main, release/** ]
13
+
14
+
workflow_dispatch:
15
+
16
+
permissions:
17
+
contents: read
18
+
19
+
env:
20
+
STUB_VERSION: "1.0.7"
21
+
22
+
jobs:
23
+
echo_version:
24
+
name: 'Echo stub version'
25
+
runs-on: ubuntu-latest
26
+
steps:
27
+
- name: echo version of stub and inputs
28
+
run: |
29
+
echo "CI main pull request stub version $STUB_VERSION"
- name: 'Detect app, language, and build profile environment variables from repository custom properties'
40
+
id: set-custom-metadata
41
+
# GH API returns something like [{"property_name":"GABuildLanguage","value":"go"},{"property_name":"GABuildProfile","value":"cli"},{"property_name":"primaryApplication","value":"chef-360"}]'
detect-version-source-type: 'none'# options include "none" (do not detect), "file", "github-tag" or "github-release"
82
+
detect-version-source-parameter: ''# use for file name
83
+
language: ${{ needs.detect-custom-metadata.outputs.appBuildLanguage }} # Go, Ruby, Rust, JavaScript, TypeScript, Python, Java, C#, PHP, other - used for build and SonarQube language setting
84
+
85
+
# complexity-checks, linting, trufflehog and trivy
86
+
perform-complexity-checks: true
87
+
# scc-output-filename: 'scc-output.txt'
88
+
perform-language-linting: false # Perform language-specific linting and pre-compilation checks
89
+
perform-trufflehog-scan: true
90
+
perform-trivy-scan: true
91
+
92
+
# perform application build and unit testing, will use custom repository properties when implemented for chef-primary-application, chef-build-profile, and chef-build-language
polaris-working-directory: '.'# Working directory for the scan, defaults to . but usually lang-dependent like ./src
105
+
polaris-coverity-build-command: 'go build -o bin/chef-cli.exe'# Coverity build command, typically done in build stage by language or here as param 1-liner like "mvn clean install"
106
+
polaris-coverity-clean-command: 'go clean'# Coverity clean command, typically done before build stage by language or here as param 1-liner like "mvn clean"
107
+
polaris-detect-search-depth: '5'# Detect search depth, blank but can be set to "3" to search up to 3 levels of subdirectories for code to scan'
108
+
polaris-assessment-mode: 'SAST'# Assessment mode (SAST, CI or SOURCE_UPLOAD)
109
+
wait-for-scan: true
110
+
# polaris-detect-args: '' # Additional Detect arguments, can supply extra arguments like "--detect.diagnostic=true"
111
+
# coverity_build_command: "go build"
112
+
# coverity_clean_command: "go clean"
113
+
# polaris-config-path: '' # Path to Detect configuration file, typically a file supplied at root level like ./detect-config.yml
114
+
# polaris-coverity-config-path: '' # Path to Coverity configuration file, typically a file supplied at root level like ./coverity.yml
115
+
# polaris-coverity-args: '' # Additional Coverity arguments,can supply extra arguments like "--config-override capture.build.build-command=make
116
+
117
+
# perform SonarQube scan, with or without unit test coverage data
118
+
# requires secrets SONAR_TOKEN and SONAR_HOST_URL (progress.sonar.com)
119
+
perform-sonarqube-scan: true
120
+
# perform-sonar-build: true
121
+
# build-profile: 'default'
122
+
# report-unit-test-coverage: true
123
+
perform-docker-scan: false # scan Dockerfile and built images with Docker Scout or Trivy; see repo custom properties matching "container"
124
+
125
+
# report to central developer dashboard
126
+
report-to-atlassian-dashboard: false
127
+
quality-product-name: ${{ github.event.repository.name }} # product name for quality reporting, like Chef360, Courier, Inspec
128
+
# quality-sonar-app-name: 'YourSonarAppName'
129
+
# quality-testing-type: 'Integration' like Unit, Integration, e2e, api, Performance, Security
130
+
# quality-service-name: 'YourServiceOrRepoName'
131
+
# quality-junit-report: 'path/to/junit/report''
132
+
133
+
# perform Habitat-based and native packaging, publish to package repositories
publish-habitat-packages: false # Publish Habitat packages to Builder
137
+
publish-habitat-hab_package: false # Chef Habitat package to install (e.g., core/nginx)
138
+
publish-habitat-hab_version: "1.0.0"# Chef Habitat package version (optional)
139
+
publish-habitat-hab_release: "20240101010101"# Chef Habitat package release (optional)
140
+
publish-habitat-hab_channel: "stable"# Chef Habitat package channel (e.g., stable, base, base-2025); default is stable
141
+
publish-habitat-hab_auth_token: ""# Chef Habitat Builder authentication token (uses secret if not provided)
142
+
publish-habitat-runner_os: "ubuntu-latest"# OS runner for Habitat package publishing job, can also be windows-latest
143
+
habitat-grype-scan: false # Scan built Habitat packages with Grype for vulnerabilities
144
+
publish-packages: false # Publish packages (e.g., container from Dockerfile to ECR, go-releaser binary to releases page, omnibus to artifactory, gems, choco, homebrew, other app stores)
145
+
146
+
# generate and export Software Bill of Materials (SBOM) in various formats
147
+
generate-sbom: true
148
+
export-github-sbom: true # SPDX JSON artifact on job instance
149
+
generate-msft-sbom: false
150
+
license_scout: false # Run license scout for license compliance (uses .license_scout.yml)
151
+
152
+
# perform Blackduck software composition analysis (SCA) for 3rd party CVEs, licensing, and operational risk
153
+
perform-blackduck-sca-scan: true # combined with generate sbom & generate github-sbom, also needs version above
154
+
blackduck-project-group-name: 'Chef-Agents'# typically one of (Chef), Chef-Agents, Chef-Automate, Chef-Chef360, Chef-Habitat, Chef-Infrastructure-Server, Chef-Shared-Services, Chef-Non-Product'
155
+
blackduck-project-name: ${{ github.event.repository.name }} # BlackDuck project name, typically the repository name
0 commit comments