|
| 1 | +name: Native CI |
| 2 | + |
| 3 | +on: |
| 4 | + pull_request: |
| 5 | + types: [opened, synchronize, reopened] |
| 6 | + # Only run when something this E2E actually exercises changes, so unrelated |
| 7 | + # PRs aren't spammed with scanner SARIF/code-scanning annotations. |
| 8 | + paths: |
| 9 | + # The E2E fixture + its validation test-case. |
| 10 | + - "tests/fixtures/scenarios/native-ci-e2e/**" |
| 11 | + - "tests/test-cases/native-ci-e2e.yaml" |
| 12 | + # The workflow itself. |
| 13 | + - ".github/workflows/native-ci.yml" |
| 14 | + # The feature this E2E exercises, so scanner/CI source changes still run it. |
| 15 | + - "pkg/ci/**" |
| 16 | + - "pkg/hooks/**" |
| 17 | + - "actions/cache/**" |
| 18 | + workflow_dispatch: |
| 19 | + |
| 20 | +permissions: |
| 21 | + contents: read |
| 22 | + pull-requests: write |
| 23 | + security-events: write |
| 24 | + statuses: write |
| 25 | + |
| 26 | +env: |
| 27 | + ATMOS_NATIVE_CI_WORKDIR: tests/fixtures/scenarios/native-ci-e2e |
| 28 | + ATMOS_VERSION_CHECK_ENABLED: "false" |
| 29 | + NATIVE_CI_TRIVY_VERSION: "0.70.0" |
| 30 | + NATIVE_CI_KICS_VERSION: "2.1.20" |
| 31 | + |
| 32 | +jobs: |
| 33 | + terraform-plan: |
| 34 | + name: "[native ci] terraform plan" |
| 35 | + runs-on: ubuntu-latest |
| 36 | + timeout-minutes: 20 |
| 37 | + |
| 38 | + services: |
| 39 | + floci: |
| 40 | + image: floci/floci@sha256:c88ec20bf221630dd195d38a14eeb0ac52ddfa72c37ebb3c8aa17f63ae27c5f2 # 1.5.23 |
| 41 | + ports: |
| 42 | + - 4566:4566 |
| 43 | + |
| 44 | + steps: |
| 45 | + - name: Check out code |
| 46 | + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 |
| 47 | + with: |
| 48 | + persist-credentials: false |
| 49 | + |
| 50 | + - name: Set up Go |
| 51 | + uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6 |
| 52 | + with: |
| 53 | + go-version-file: "go.mod" |
| 54 | + |
| 55 | + - name: Build Atmos |
| 56 | + run: | |
| 57 | + make build-linux |
| 58 | + echo "${{ github.workspace }}/build" >> "$GITHUB_PATH" |
| 59 | +
|
| 60 | + - name: Restore Atmos native CI cache |
| 61 | + uses: ./actions/cache |
| 62 | + env: |
| 63 | + ATMOS_CHDIR: ${{ env.ATMOS_NATIVE_CI_WORKDIR }} |
| 64 | + |
| 65 | + - name: Validate native CI fixture |
| 66 | + working-directory: ${{ env.ATMOS_NATIVE_CI_WORKDIR }} |
| 67 | + run: atmos validate stacks |
| 68 | + |
| 69 | + - name: Mirror Terraform providers |
| 70 | + working-directory: ${{ env.ATMOS_NATIVE_CI_WORKDIR }} |
| 71 | + run: atmos terraform cache mirror bucket -s test --platform=linux_amd64 --format=json |
| 72 | + |
| 73 | + - name: Install scanner tools for native CI fixture |
| 74 | + run: | |
| 75 | + scanner_bin="$RUNNER_TEMP/native-ci-scanners/bin" |
| 76 | + scanner_assets="$RUNNER_TEMP/native-ci-scanners/assets" |
| 77 | + mkdir -p "$scanner_bin" "$scanner_assets" |
| 78 | +
|
| 79 | + # Download and verify the Trivy binary against its published checksum |
| 80 | + # before extracting, so a tampered or corrupted archive never executes. |
| 81 | + curl -fsSL \ |
| 82 | + -o "$RUNNER_TEMP/trivy.tar.gz" \ |
| 83 | + "https://github.com/aquasecurity/trivy/releases/download/v${NATIVE_CI_TRIVY_VERSION}/trivy_${NATIVE_CI_TRIVY_VERSION}_Linux-64bit.tar.gz" |
| 84 | + curl -fsSL \ |
| 85 | + -o "$RUNNER_TEMP/trivy_checksums.txt" \ |
| 86 | + "https://github.com/aquasecurity/trivy/releases/download/v${NATIVE_CI_TRIVY_VERSION}/trivy_${NATIVE_CI_TRIVY_VERSION}_checksums.txt" |
| 87 | + trivy_sha="$(grep " trivy_${NATIVE_CI_TRIVY_VERSION}_Linux-64bit.tar.gz$" "$RUNNER_TEMP/trivy_checksums.txt" | awk '{print $1}')" |
| 88 | + echo "${trivy_sha} $RUNNER_TEMP/trivy.tar.gz" | sha256sum -c - |
| 89 | + tar -xzf "$RUNNER_TEMP/trivy.tar.gz" -C "$scanner_bin" trivy |
| 90 | +
|
| 91 | + # Download and verify the KICS binary against its published checksum |
| 92 | + # before extracting. |
| 93 | + curl -fsSL \ |
| 94 | + -o "$RUNNER_TEMP/kics.tar.gz" \ |
| 95 | + "https://github.com/Checkmarx/kics/releases/download/v${NATIVE_CI_KICS_VERSION}/kics_${NATIVE_CI_KICS_VERSION}_linux_amd64.tar.gz" |
| 96 | + curl -fsSL \ |
| 97 | + -o "$RUNNER_TEMP/kics_checksums.txt" \ |
| 98 | + "https://github.com/Checkmarx/kics/releases/download/v${NATIVE_CI_KICS_VERSION}/checksums.txt" |
| 99 | + kics_sha="$(grep " kics_${NATIVE_CI_KICS_VERSION}_linux_amd64.tar.gz$" "$RUNNER_TEMP/kics_checksums.txt" | awk '{print $1}')" |
| 100 | + echo "${kics_sha} $RUNNER_TEMP/kics.tar.gz" | sha256sum -c - |
| 101 | + tar -xzf "$RUNNER_TEMP/kics.tar.gz" -C "$scanner_bin" kics |
| 102 | +
|
| 103 | + # The KICS query assets (extracted-info.zip) have no published checksum, |
| 104 | + # so they cannot be verified the same way. They are data, not an executable. |
| 105 | + curl -fsSL \ |
| 106 | + -o "$RUNNER_TEMP/kics-extracted-info.zip" \ |
| 107 | + "https://github.com/Checkmarx/kics/releases/download/v${NATIVE_CI_KICS_VERSION}/extracted-info.zip" |
| 108 | + unzip -q "$RUNNER_TEMP/kics-extracted-info.zip" -d "$scanner_assets/kics" |
| 109 | +
|
| 110 | + chmod +x "$scanner_bin/trivy" "$scanner_bin/kics" |
| 111 | + echo "$scanner_bin" >> "$GITHUB_PATH" |
| 112 | + echo "KICS_QUERIES_PATH=$scanner_assets/kics/assets/queries" >> "$GITHUB_ENV" |
| 113 | +
|
| 114 | + - name: Terraform plan |
| 115 | + id: terraform-plan |
| 116 | + working-directory: ${{ env.ATMOS_NATIVE_CI_WORKDIR }} |
| 117 | + env: |
| 118 | + ATMOS_CI_GITHUB_TOKEN: ${{ github.token }} |
| 119 | + GITHUB_TOKEN: ${{ github.token }} |
| 120 | + run: atmos terraform plan bucket -s test |
| 121 | + |
| 122 | + terraform-apply: |
| 123 | + name: "[native ci] terraform apply" |
| 124 | + needs: terraform-plan |
| 125 | + runs-on: ubuntu-latest |
| 126 | + timeout-minutes: 20 |
| 127 | + |
| 128 | + services: |
| 129 | + floci: |
| 130 | + image: floci/floci@sha256:c88ec20bf221630dd195d38a14eeb0ac52ddfa72c37ebb3c8aa17f63ae27c5f2 # 1.5.23 |
| 131 | + ports: |
| 132 | + - 4566:4566 |
| 133 | + |
| 134 | + steps: |
| 135 | + - name: Check out code |
| 136 | + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 |
| 137 | + with: |
| 138 | + persist-credentials: false |
| 139 | + |
| 140 | + - name: Set up Go |
| 141 | + uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6 |
| 142 | + with: |
| 143 | + go-version-file: "go.mod" |
| 144 | + |
| 145 | + - name: Build Atmos |
| 146 | + run: | |
| 147 | + make build-linux |
| 148 | + echo "${{ github.workspace }}/build" >> "$GITHUB_PATH" |
| 149 | +
|
| 150 | + - name: Restore Atmos native CI cache |
| 151 | + uses: ./actions/cache |
| 152 | + env: |
| 153 | + ATMOS_CHDIR: ${{ env.ATMOS_NATIVE_CI_WORKDIR }} |
| 154 | + |
| 155 | + - name: Validate native CI fixture |
| 156 | + working-directory: ${{ env.ATMOS_NATIVE_CI_WORKDIR }} |
| 157 | + run: atmos validate stacks |
| 158 | + |
| 159 | + - name: Mirror Terraform providers |
| 160 | + working-directory: ${{ env.ATMOS_NATIVE_CI_WORKDIR }} |
| 161 | + run: atmos terraform cache mirror bucket -s test --platform=linux_amd64 --format=json |
| 162 | + |
| 163 | + - name: Terraform apply |
| 164 | + id: terraform-apply |
| 165 | + working-directory: ${{ env.ATMOS_NATIVE_CI_WORKDIR }} |
| 166 | + env: |
| 167 | + ATMOS_CI_GITHUB_TOKEN: ${{ github.token }} |
| 168 | + GITHUB_TOKEN: ${{ github.token }} |
| 169 | + run: atmos terraform apply bucket -s test -auto-approve |
0 commit comments