From 4fa5d3256febe0a4b241f00548ddd6809d3c3d10 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Guillaume=20Desv=C3=A9?= <guillaume.desve@almapay.com>
Date: Thu, 10 Oct 2024 09:56:07 +0200
Subject: [PATCH] Fix Aqua workflow targets, update Aqua workflow (#152)

---
 .github/workflows/aqua.yml | 39 ++++++++++++++++++++++++++++----------
 1 file changed, 29 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/aqua.yml b/.github/workflows/aqua.yml
index da50a86..27c9a06 100644
--- a/.github/workflows/aqua.yml
+++ b/.github/workflows/aqua.yml
@@ -1,30 +1,49 @@
 name: Aqua
+
 on:
   pull_request:
     branches:
-      - main
+      - master
 
 jobs:
   aqua:
-    name: Aqua scanner
+    name: Code scanning
     runs-on: ubuntu-24.04
+
+    permissions:
+      contents: read
+      id-token: write
+
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          show-progress: false
+
+      - name: Authenticate to Google Cloud
+        id: gcloud-auth
+        uses: google-github-actions/auth@v2
+        with:
+          token_format: access_token
+          workload_identity_provider: projects/699052769907/locations/global/workloadIdentityPools/github-identity-pool-shared/providers/github-identity-provider-shared  # yamllint disable-line
+          service_account: github-gar-widgets@lyrical-carver-335213.iam.gserviceaccount.com
+
+      - name: Authenticate to Artifact Registry
+        uses: docker/login-action@v3
+        with:
+          registry: europe-docker.pkg.dev
+          username: oauth2accesstoken
+          password: ${{ steps.gcloud-auth.outputs.access_token }}
 
       - name: Run Aqua scanner
         uses: docker://aquasec/aqua-scanner
-        with:
-          args: trivy fs --sast --reachability --scanners misconfig,vuln,secret .
-          # To customize which severities add the following flag: --severity UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
-          # To enable SAST scanning, add: --sast
-          # To enable reachability scanning, add: --reachability
-          # To enable npm/dotnet non-lock file scanning, add: --package-json / --dotnet-proj
         env:
           AQUA_KEY: ${{ secrets.AQUA_KEY }}
           AQUA_SECRET: ${{ secrets.AQUA_SECRET }}
           GITHUB_TOKEN: ${{ github.token }}
           AQUA_URL: https://api.eu-1.supply-chain.cloud.aquasec.com
           CSPM_URL: https://eu-1.api.cloudsploit.com
-          TRIVY_RUN_AS_PLUGIN: "aqua"
-          # For http/https proxy configuration add env vars: HTTP_PROXY/HTTPS_PROXY, CA-CRET (path to CA certificate)
+          TRIVY_RUN_AS_PLUGIN: aqua
+          TRIVY_DB_REPOSITORY: europe-docker.pkg.dev/lyrical-carver-335213/ghcr-remote-cache/aquasecurity/trivy-db:2
+        with:
+          args: trivy fs --sast --reachability --scanners misconfig,vuln,secret .