Skip to content

Update workflows to use artifact actions v4 and replace the archived workflow … #41

Update workflows to use artifact actions v4 and replace the archived workflow …

Update workflows to use artifact actions v4 and replace the archived workflow … #41

Workflow file for this run

name: Verify the Baseline on EC2
on:
push:
branches: [master]
pull_request:
branches: [master]
release:
types:
- published
jobs:
my-job:
name: Validate my profile
runs-on: ubuntu-latest
env:
CHEF_LICENSE: accept-silent
KITCHEN_YAML: kitchen.ec2.yml
strategy:
matrix:
suite: ["vanilla", "hardened"]
fail-fast: false
steps:
- name: add needed packages
run: sudo apt-get install -y jq
- name: Configure AWS credentials
env:
AWS_SUBNET_ID: ${{ secrets.AWS_SUBNET_ID }}
AWS_SSH_KEY_ID: ${{ secrets.AWS_SSH_KEY_ID }}
uses: aws-actions/configure-aws-credentials@v1
with:
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
aws-region: us-east-1
- name: Check out repository
uses: actions/checkout@v2
- name: Clone full repository so we can push
run: git fetch --prune --unshallow
- name: Setup Ruby
uses: ruby/setup-ruby@v1
with:
ruby-version: "2.7"
# - name: Setup caching
# uses: actions/cache@v4
# with:
# path: vendor/bundle
# key: ${{ runner.os }}-gems-${{ hashFiles('**/Gemfile.lock') }}
# restore-keys: |
# ${{ runner.os }}-gems-
- name: Bundle install
run: |
gem install bundler
bundle config path vendor/bundle
bundle install
- name: Regenerate current `profile.json`
run: |
bundle exec inspec json . | jq . > profile.json
- name: Update profile.json in the repository
uses: stefanzweifel/[email protected]
with:
commit_message: "Updating profile.json in the repository"
branch: ${{ github.branch }}
- name: Run Kitchen Create
run: bundle exec kitchen create ${{ matrix.suite }}-ubuntu-1804 || true
- name: Run Kitchen Converge
run: bundle exec kitchen converge ${{ matrix.suite }}-ubuntu-1804 || true
- name: Run Kitchen Verify
run: bundle exec kitchen verify ${{ matrix.suite }}-ubuntu-1804 || true
- name: Run Kitchen Destroy
run: bundle exec kitchen destroy ${{ matrix.suite }}-ubuntu-1804 || true
- name: Display our ${{ matrix.suite }} results summary
uses: mitre/saf_action@v1
with:
command_string: "view:summary -i spec/results/${{ matrix.suite }}-test-result.json"
- name: Ensure the scan meets our ${{ matrix.suite }} results threshold
uses: mitre/saf_action@v1
with:
command_string: "validate:threshold -i spec/results/${{ matrix.suite }}-test-result.json -F ${{ matrix.suite }}.threshold.yml"
- name: Save Test Result JSON
uses: actions/upload-artifact@v4
with:
path: spec/results