atmos/.github/workflows/native-ci.yml at cc9aff76e843c213d9e63d9283fa77b5b56d46ec · cloudposse/atmos · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
name: Native CI

on:
  pull_request:
    types: [opened, synchronize, reopened]
    # Only run when something this E2E actually exercises changes, so unrelated
    # PRs aren't spammed with scanner SARIF/code-scanning annotations.
    paths:
      # The E2E fixture + its validation test-case.
      - "tests/fixtures/scenarios/native-ci-e2e/**"
      - "tests/test-cases/native-ci-e2e.yaml"
      # The workflow itself.
      - ".github/workflows/native-ci.yml"
      # The feature this E2E exercises, so scanner/CI source changes still run it.
      - "pkg/ci/**"
      - "pkg/hooks/**"
      - "actions/cache/**"
  workflow_dispatch:

permissions:
  contents: read
  pull-requests: write
  security-events: write
  statuses: write

env:
  ATMOS_NATIVE_CI_WORKDIR: tests/fixtures/scenarios/native-ci-e2e
  ATMOS_VERSION_CHECK_ENABLED: "false"
  NATIVE_CI_TRIVY_VERSION: "0.70.0"
  NATIVE_CI_KICS_VERSION: "2.1.20"

jobs:
  terraform-plan:
    name: "[native ci] terraform plan"
    runs-on: ubuntu-latest
    timeout-minutes: 20

    services:
      floci:
        image: floci/floci@sha256:78ee619e895a01a5c0db9d1037082bf487807290583a4e78300de2b6e041a9b1 # 1.5.23
        ports:
          - 4566:4566

    steps:
      - name: Check out code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
        with:
          go-version-file: "go.mod"

      - name: Build Atmos
        run: |
          make build-linux
          echo "${{ github.workspace }}/build" >> "$GITHUB_PATH"

      - name: Restore Atmos native CI cache
        uses: ./actions/cache
        env:
          ATMOS_CHDIR: ${{ env.ATMOS_NATIVE_CI_WORKDIR }}

      - name: Validate native CI fixture
        working-directory: ${{ env.ATMOS_NATIVE_CI_WORKDIR }}
        run: atmos validate stacks

      - name: Mirror Terraform providers
        working-directory: ${{ env.ATMOS_NATIVE_CI_WORKDIR }}
        run: atmos terraform cache mirror bucket -s test --platform=linux_amd64 --format=json

      - name: Install scanner tools for native CI fixture
        run: |
          scanner_bin="$RUNNER_TEMP/native-ci-scanners/bin"
          scanner_assets="$RUNNER_TEMP/native-ci-scanners/assets"
          mkdir -p "$scanner_bin" "$scanner_assets"

          # Download and verify the Trivy binary against its published checksum
          # before extracting, so a tampered or corrupted archive never executes.
          curl -fsSL \
            -o "$RUNNER_TEMP/trivy.tar.gz" \
            "https://github.com/aquasecurity/trivy/releases/download/v${NATIVE_CI_TRIVY_VERSION}/trivy_${NATIVE_CI_TRIVY_VERSION}_Linux-64bit.tar.gz"
          curl -fsSL \
            -o "$RUNNER_TEMP/trivy_checksums.txt" \
            "https://github.com/aquasecurity/trivy/releases/download/v${NATIVE_CI_TRIVY_VERSION}/trivy_${NATIVE_CI_TRIVY_VERSION}_checksums.txt"
          trivy_sha="$(grep " trivy_${NATIVE_CI_TRIVY_VERSION}_Linux-64bit.tar.gz$" "$RUNNER_TEMP/trivy_checksums.txt" | awk '{print $1}')"
          echo "${trivy_sha}  $RUNNER_TEMP/trivy.tar.gz" | sha256sum -c -
          tar -xzf "$RUNNER_TEMP/trivy.tar.gz" -C "$scanner_bin" trivy

          # Download and verify the KICS binary against its published checksum
          # before extracting.
          curl -fsSL \
            -o "$RUNNER_TEMP/kics.tar.gz" \
            "https://github.com/Checkmarx/kics/releases/download/v${NATIVE_CI_KICS_VERSION}/kics_${NATIVE_CI_KICS_VERSION}_linux_amd64.tar.gz"
          curl -fsSL \
            -o "$RUNNER_TEMP/kics_checksums.txt" \
            "https://github.com/Checkmarx/kics/releases/download/v${NATIVE_CI_KICS_VERSION}/checksums.txt"
          kics_sha="$(grep " kics_${NATIVE_CI_KICS_VERSION}_linux_amd64.tar.gz$" "$RUNNER_TEMP/kics_checksums.txt" | awk '{print $1}')"
          echo "${kics_sha}  $RUNNER_TEMP/kics.tar.gz" | sha256sum -c -
          tar -xzf "$RUNNER_TEMP/kics.tar.gz" -C "$scanner_bin" kics

          # The KICS query assets (extracted-info.zip) have no published checksum,
          # so they cannot be verified the same way. They are data, not an executable.
          curl -fsSL \
            -o "$RUNNER_TEMP/kics-extracted-info.zip" \
            "https://github.com/Checkmarx/kics/releases/download/v${NATIVE_CI_KICS_VERSION}/extracted-info.zip"
          unzip -q "$RUNNER_TEMP/kics-extracted-info.zip" -d "$scanner_assets/kics"

          chmod +x "$scanner_bin/trivy" "$scanner_bin/kics"
          echo "$scanner_bin" >> "$GITHUB_PATH"
          echo "KICS_QUERIES_PATH=$scanner_assets/kics/assets/queries" >> "$GITHUB_ENV"

      - name: Terraform plan
        id: terraform-plan
        working-directory: ${{ env.ATMOS_NATIVE_CI_WORKDIR }}
        env:
          ATMOS_CI_GITHUB_TOKEN: ${{ github.token }}
          GITHUB_TOKEN: ${{ github.token }}
        run: atmos terraform plan bucket -s test

  terraform-apply:
    name: "[native ci] terraform apply"
    needs: terraform-plan
    runs-on: ubuntu-latest
    timeout-minutes: 20

    services:
      floci:
        image: floci/floci@sha256:78ee619e895a01a5c0db9d1037082bf487807290583a4e78300de2b6e041a9b1 # 1.5.23
        ports:
          - 4566:4566

    steps:
      - name: Check out code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Set up Go
        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
        with:
          go-version-file: "go.mod"

      - name: Build Atmos
        run: |
          make build-linux
          echo "${{ github.workspace }}/build" >> "$GITHUB_PATH"

      - name: Restore Atmos native CI cache
        uses: ./actions/cache
        env:
          ATMOS_CHDIR: ${{ env.ATMOS_NATIVE_CI_WORKDIR }}

      - name: Validate native CI fixture
        working-directory: ${{ env.ATMOS_NATIVE_CI_WORKDIR }}
        run: atmos validate stacks

      - name: Mirror Terraform providers
        working-directory: ${{ env.ATMOS_NATIVE_CI_WORKDIR }}
        run: atmos terraform cache mirror bucket -s test --platform=linux_amd64 --format=json

      - name: Terraform apply
        id: terraform-apply
        working-directory: ${{ env.ATMOS_NATIVE_CI_WORKDIR }}
        env:
          ATMOS_CI_GITHUB_TOKEN: ${{ github.token }}
          GITHUB_TOKEN: ${{ github.token }}
        run: atmos terraform apply bucket -s test -auto-approve