verify-ec2.yml

name: Verify the Baseline on EC2

on:
  push:
    branches: [master]
  pull_request:
    branches: [master]
  release:
    types:
      - published
jobs:
  my-job:
    name: Validate my profile
    runs-on: ubuntu-latest
    env:
      CHEF_LICENSE: accept-silent
      KITCHEN_YAML: kitchen.ec2.yml
    strategy:
      matrix:
        suite: ["vanilla", "hardened"]
      fail-fast: false
    steps:
      - name: add needed packages
        run: sudo apt-get install -y jq
      - name: Configure AWS credentials
        env:
          AWS_SUBNET_ID: ${{ secrets.AWS_SUBNET_ID }}
          AWS_SSH_KEY_ID: ${{ secrets.AWS_SSH_KEY_ID }}
        uses: aws-actions/configure-aws-credentials@v1
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-east-1
      - name: Check out repository
        uses: actions/checkout@v4
      - name: Clone full repository so we can push
        run: git fetch --prune --unshallow
      - name: Setup Ruby
        uses: ruby/setup-ruby@v1
        with:
          ruby-version: "2.7"
      # - name: Setup caching
      #   uses: actions/cache@v4
      #   with:
      #     path: vendor/bundle
      #     key: ${{ runner.os }}-gems-${{ hashFiles('**/Gemfile.lock') }}
      #     restore-keys: |
      #       ${{ runner.os }}-gems-
      - name: Bundle install
        run: |
          gem install bundler
          bundle config path vendor/bundle
          bundle install
      - name: Regenerate current `profile.json`
        run: |
          bundle exec inspec json . | jq . > profile.json
      - name: Update profile.json in the repository
        uses: stefanzweifel/git-auto-commit-action@v4.1.0
        with:
          commit_message: "Updating profile.json in the repository"
          branch: ${{ github.branch }}
      - name: Run Kitchen Create
        run: bundle exec kitchen create ${{ matrix.suite }}-ubuntu-1804 || true
      - name: Run Kitchen Converge
        run: bundle exec kitchen converge ${{ matrix.suite }}-ubuntu-1804 || true
      - name: Run Kitchen Verify
        run: bundle exec kitchen verify ${{ matrix.suite }}-ubuntu-1804 || true
      - name: Run Kitchen Destroy
        run: bundle exec kitchen destroy ${{ matrix.suite }}-ubuntu-1804 || true
      - name: Display our ${{ matrix.suite }} results summary
        uses: mitre/saf_action@v1
        with:
          command_string: "view:summary -i spec/results/${{ matrix.suite }}-test-result.json"
      - name: Ensure the scan meets our ${{ matrix.suite }} results threshold
        uses: mitre/saf_action@v1
        with:
          command_string: "validate:threshold -i spec/results/${{ matrix.suite }}-test-result.json -F ${{ matrix.suite }}.threshold.yml"
      - name: Save Test Result JSON
        uses: actions/upload-artifact@v4
        with:
          path: spec/results