Skip to content

Commit 907c681

Browse files
Vasu1105Vasu1105
committed
Updates the workflow
Signed-off-by: Vasu1105 <vjagdale@progress.com>
1 parent 0cb40df commit 907c681

1 file changed

Lines changed: 129 additions & 20 deletions

File tree

‎.github/workflows/ci-main-pull-request-stub-1.0.7.yml‎

Lines changed: 129 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,45 +1,154 @@
1-
# This stub runs only the TruffleHog scan as part of CI checks on pull requests to main branch.
1+
# stub to call common GitHub Action (GA) as part of Continuous Integration (CI) Pull Request process checks for main branch
2+
# inputs are described in the chef/common-github-actions/<GA.yml> with same name as this stub
3+
#
4+
# secrets are inherited from the calling workflow, typically SONAR_TOKEN, SONAR_HOST_URL, GH_TOKEN, AKEYLESS_JWT_ID, POLARIS_SERVER_URL and POLARIS_ACCESS_TOKEN
25

3-
name: CI Pull Request – TruffleHog Only
6+
name: CI Pull Request on Main Branch
47

58
on:
69
pull_request:
710
branches: [ vj/update-common-github-action-workflow, main ]
811
push:
9-
branches: [ vj/update-common-github-action-workflow,main ]
10-
12+
branches: [ vj/update-common-github-action-workflow, main ]
1113
workflow_dispatch:
1214

1315
permissions:
1416
contents: read
17+
env:
18+
STUB_VERSION: "1.0.7"
1519

1620
jobs:
21+
echo_version:
22+
name: 'Echo stub version'
23+
runs-on: ubuntu-latest
24+
steps:
25+
- name: echo version of stub and inputs
26+
run: |
27+
echo "CI main pull request stub version $STUB_VERSION"
28+
29+
detect-custom-metadata:
30+
name: 'Detect custom properties'
31+
runs-on: ubuntu-latest
32+
outputs:
33+
primaryApp: ${{ steps.set-custom-metadata.outputs.primaryApplication }}
34+
appBuildLanguage: ${{ steps.set-custom-metadata.outputs.applicationBuildLanguage }}
35+
appBuildProfile: ${{ steps.set-custom-metadata.outputs.applicationBuildProfile }}
36+
steps:
37+
- name: 'Detect app, language, and build profile environment variables from repository custom properties'
38+
id: set-custom-metadata
39+
# GH API returns something like [{"property_name":"GABuildLanguage","value":"go"},{"property_name":"GABuildProfile","value":"cli"},{"property_name":"primaryApplication","value":"chef-360"}]'
40+
run: |
41+
response=$(gh api -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" /repos/${{ github.repository }}/properties/values)
42+
primaryApplication=$(echo "$response" | jq -r '.[] | select(.property_name=="primaryApplication") | .value')
43+
GABuildLanguage=$(echo "$response" | jq -r '.[] | select(.property_name=="GABuildLanguage") | .value')
44+
GABuildProfile=$(echo "$response" | jq -r '.[] | select(.property_name=="GABuildProfile") | .value')
45+
echo "PRIMARY APP... $primaryApplication"
46+
echo "BUILD LANG... $GABuildLanguage"
47+
echo "BUILD PROFILE... $GABuildProfile"
48+
echo "PRIMARY_APPLICATION=$primaryApplication" >> $GITHUB_ENV
49+
echo "GA_BUILD_LANGUAGE=$GABuildLanguage" >> $GITHUB_ENV
50+
echo "GA_BUILD_PROFILE=$GABuildProfile" >> $GITHUB_ENV
51+
# If workflow_dispatch, use inputs (left), if other trigger, use default env (right)
52+
# echo "::set-output name=build-and-verify::${{ github.event.inputs.build-and-verify || 'true' }}"
53+
echo "::set-output name=primaryApplication::$primaryApplication"
54+
echo "::set-output name=applicationBuildLanguage::$GABuildLanguage"
55+
echo "::set-output name=applicationBuildProfile::$GABuildProfile"
56+
continue-on-error: true
57+
env:
58+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
1759
call-ci-main-pr-check-pipeline:
1860
uses: chef/common-github-actions/.github/workflows/ci-main-pull-request.yml@main
61+
needs: detect-custom-metadata
1962
secrets: inherit
2063
permissions:
2164
id-token: write
2265
contents: read
66+
2367
with:
24-
visibility: ${{ github.event.repository.visibility }}
68+
application: ${{ needs.detect-custom-metadata.outputs.primaryApp }}
69+
visibility: ${{ github.event.repository.visibility }} # private, public, or internal
70+
# go-private-modules: GOPRIVATE for Go private modules, default is 'github.com/progress-platform-services/*
71+
72+
# if version specified, it takes precedence; can be a semver like 1.0.2-xyz or a tag like "latest"
73+
version: '6.1.22' # ${{ github.event.repository.version }}
74+
detect-version-source-type: 'none' # options include "none" (do not detect), "file", "github-tag" or "github-release"
75+
detect-version-source-parameter: '' # use for file name
76+
language: ${{ needs.detect-custom-metadata.outputs.appBuildLanguage }} # Go, Ruby, Rust, JavaScript, TypeScript, Python, Java, C#, PHP, other - used for build and SonarQube language setting
2577

26-
# Enabled features
78+
# complexity-checks, linting, trufflehog and trivy
79+
perform-complexity-checks: true
80+
# scc-output-filename: 'scc-output.txt'
81+
perform-language-linting: false # Perform language-specific linting and pre-compilation checks
2782
perform-trufflehog-scan: true
28-
generate-sbom: true
29-
export-github-sbom: true
83+
perform-trivy-scan: true
3084

31-
# All other features
32-
perform-complexity-checks: false
33-
perform-language-linting: false
34-
perform-blackduck-polaris: false
35-
perform-blackduck-sca-scan: false
36-
build: false
85+
# perform application build and unit testing, will use custom repository properties when implemented for chef-primary-application, chef-build-profile, and chef-build-language
86+
build: true
87+
build-profile: ${{ needs.detect-custom-metadata.outputs.appBuildProfile }}
3788
unit-tests: false
38-
perform-sonarqube-scan: false
89+
unit-test-output-path: "path/to/file.out"
90+
unit-test-command-override: ""
91+
92+
# BlackDuck SAST (Polaris) require a build or binary present in repo to do SAST testing
93+
# requires these secrets: POLARIS_SERVER_URL, POLARIS_ACCESS_TOKEN
94+
perform-blackduck-polaris: false
95+
polaris-application-name: "Chef-Agents" # one of these: Chef-Agents, Chef-Automate, Chef-Chef360, Chef-Habitat, Chef-Infrastructure-Server, Chef-Shared-Services, Chef-Other, Chef-Non-Product
96+
polaris-project-name: ${{ github.event.repository.name }} # arch-sample-cli
97+
polaris-working-directory: '.' # Working directory for the scan, defaults to . but usually lang-dependent like ./src
98+
polaris-coverity-build-command: 'go build -o bin/chef-cli.exe' # Coverity build command, typically done in build stage by language or here as param 1-liner like "mvn clean install"
99+
polaris-coverity-clean-command: 'go clean' # Coverity clean command, typically done before build stage by language or here as param 1-liner like "mvn clean"
100+
polaris-detect-search-depth: '5' # Detect search depth, blank but can be set to "3" to search up to 3 levels of subdirectories for code to scan'
101+
polaris-assessment-mode: 'SAST' # Assessment mode (SAST, CI or SOURCE_UPLOAD)
102+
wait-for-scan: true
103+
# polaris-detect-args: '' # Additional Detect arguments, can supply extra arguments like "--detect.diagnostic=true"
104+
# coverity_build_command: "go build"
105+
# coverity_clean_command: "go clean"
106+
# polaris-config-path: '' # Path to Detect configuration file, typically a file supplied at root level like ./detect-config.yml
107+
# polaris-coverity-config-path: '' # Path to Coverity configuration file, typically a file supplied at root level like ./coverity.yml
108+
# polaris-coverity-args: '' # Additional Coverity arguments,can supply extra arguments like "--config-override capture.build.build-command=make
109+
110+
# perform SonarQube scan, with or without unit test coverage data
111+
# requires secrets SONAR_TOKEN and SONAR_HOST_URL (progress.sonar.com)
112+
perform-sonarqube-scan: true
113+
# perform-sonar-build: true
114+
# build-profile: 'default'
115+
# report-unit-test-coverage: true
116+
perform-docker-scan: false # scan Dockerfile and built images with Docker Scout or Trivy; see repo custom properties matching "container"
117+
118+
# report to central developer dashboard
39119
report-to-atlassian-dashboard: false
40-
package-binaries: false
41-
habitat-build: false
42-
publish-packages: false
43-
generate-blackduck-sbom: false
120+
quality-product-name: ${{ github.event.repository.name }} # product name for quality reporting, like Chef360, Courier, Inspec
121+
# quality-sonar-app-name: 'YourSonarAppName'
122+
# quality-testing-type: 'Integration' like Unit, Integration, e2e, api, Performance, Security
123+
# quality-service-name: 'YourServiceOrRepoName'
124+
# quality-junit-report: 'path/to/junit/report''
125+
126+
# perform Habitat-based and native packaging, publish to package repositories
127+
package-binaries: false # Package binaries (e.g., RPM, DEB, MSI, dpkg + signing + SHA)
128+
habitat-build: false # Create Habitat packages
129+
publish-habitat-packages: false # Publish Habitat packages to Builder
130+
publish-habitat-hab_package: false # Chef Habitat package to install (e.g., core/nginx)
131+
publish-habitat-hab_version: "1.0.0" # Chef Habitat package version (optional)
132+
publish-habitat-hab_release: "20240101010101" # Chef Habitat package release (optional)
133+
publish-habitat-hab_channel: "stable" # Chef Habitat package channel (e.g., stable, base, base-2025); default is stable
134+
publish-habitat-hab_auth_token: "" # Chef Habitat Builder authentication token (uses secret if not provided)
135+
publish-habitat-runner_os: "ubuntu-latest" # OS runner for Habitat package publishing job, can also be windows-latest
136+
habitat-grype-scan: false # Scan built Habitat packages with Grype for vulnerabilities
137+
publish-packages: false # Publish packages (e.g., container from Dockerfile to ECR, go-releaser binary to releases page, omnibus to artifactory, gems, choco, homebrew, other app stores)
138+
139+
# generate and export Software Bill of Materials (SBOM) in various formats
140+
generate-sbom: true
141+
export-github-sbom: true # SPDX JSON artifact on job instance
44142
generate-msft-sbom: false
45-
license_scout: false
143+
license_scout: false # Run license scout for license compliance (uses .license_scout.yml)
144+
145+
# perform Blackduck software composition analysis (SCA) for 3rd party CVEs, licensing, and operational risk
146+
perform-blackduck-sca-scan: true # combined with generate sbom & generate github-sbom, also needs version above
147+
blackduck-project-group-name: 'Chef-Agents' # typically one of (Chef), Chef-Agents, Chef-Automate, Chef-Chef360, Chef-Habitat, Chef-Infrastructure-Server, Chef-Shared-Services, Chef-Non-Product'
148+
blackduck-project-name: ${{ github.event.repository.name }} # BlackDuck project name, typically the repository name
149+
150+
run-bundle-install: true
151+
152+
# udf1: 'default' # user defined flag 1
153+
# udf2: 'default' # user defined flag 2q
154+
# udf3: 'default' # user defined flag 3

0 commit comments

Comments
 (0)