scan

scan #8

	name: scan

	on:
	workflow_dispatch: # Allows manual triggering

	env:
	REDIS_ORIG_IMAGE: "cgr.dev/cgr-demo.com/redis-server-bitnami:7.0.13-r3-202310161618"

	jobs:
	scan-existing-image:
	runs-on: ubuntu-latest
	permissions:
	actions: read
	security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
	contents: read
	packages: write
	id-token: write
	steps:
	- name: Checkout repository
	uses: actions/checkout@v4
	with:
	ref: main

	- name: Setup Go environment
	uses: actions/[email protected]
	with:
	cache: false

	- name: Install Grype
	run: \|
	curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh \| sh -s -- -b /usr/local/bin

	- uses: chainguard-dev/[email protected]
	with:
	identity: "4cf15780a13a9b6576d8b357e6524554c8c12a18/a662f56b58103354"

	- name: 'Auth to Registry'
	run: \|
	chainctl auth configure-docker

	# - name: Scan Image with Grype
	# run: \|
	# grype "${{ env.REDIS_ORIG_IMAGE }}" -o sarif > grype-results.sarif
	# cat grype-results.sarif

	# - name: Upload SARIF results
	# uses: github/codeql-action/upload-sarif@v3
	# with:
	# sarif_file: grype-results.sarif

	- name: Prisma Cloud image scan
	id: prismascan
	uses: PaloAltoNetworks/[email protected]
	with:
	pcc_console_url: ${{ secrets.PCC_CONSOLE_URL }}
	pcc_user: ${{ secrets.PCC_USER }}
	pcc_pass: ${{ secrets.PCC_PASS }}
	image_name: "${{ env.REDIS_ORIG_IMAGE }}"
	sarif_file: prisma-results.sarif
	twistcli_publish: true

	- name: Upload SARIF file
	uses: github/codeql-action/upload-sarif@v3
	with:
	sarif_file: ${{ steps.prismascan.outputs.sarif_file }}

Provide feedback