scan.yaml

name: scan

on:
  workflow_dispatch: # Allows manual triggering

env:
  REDIS_ORIG_IMAGE: "cgr.dev/cgr-demo.com/redis-server-bitnami:7.0.13-r3-202310161618"
  SCAN_WITH_GRYPE: "true"
  SCAN_WITH_PRISMA_CLOUD: "true"
  
jobs:
  scan-existing-image:
    runs-on: ubuntu-latest
    permissions:
      actions: read
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
      contents: read
      packages: write
      id-token: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@v4
        with:
          ref: main

      - name: Setup Go environment
        uses: actions/setup-go@v5.1.0
        with:
          cache: false
      
      - name: Install Grype
        if: ${{ env.SCAN_WITH_GRYPE == 'true' }}
        run: |
          curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin
        
      - uses: chainguard-dev/setup-chainctl@v0.2.4
        with:
          identity: "4cf15780a13a9b6576d8b357e6524554c8c12a18/a662f56b58103354"
        
      - name: 'Auth to Registry'
        run: |
          chainctl auth configure-docker
          docker pull "${{ env.REDIS_ORIG_IMAGE }}"
          
      - name: Scan Image with Grype
        if: ${{ env.SCAN_WITH_GRYPE == 'true' }}
        run: |
          grype "${{ env.REDIS_ORIG_IMAGE }}" -o sarif > grype-results.sarif
          cat grype-results.sarif
          
      - name: Upload Grype SARIF results
        if: ${{ env.SCAN_WITH_GRYPE == 'true' }}
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: grype-results.sarif

      - name: Prisma Cloud image scan
        if: ${{ env.SCAN_WITH_PRISMA_CLOUD == 'true' }}
        id: prismascan
        uses: PaloAltoNetworks/prisma-cloud-scan@v1.6.7
        with:
          pcc_console_url: ${{ secrets.PCC_CONSOLE_URL }}
          pcc_user: ${{ secrets.PCC_USER }}
          pcc_pass: ${{ secrets.PCC_PASS }}
          image_name: "${{ env.REDIS_ORIG_IMAGE }}"
      
      - name: Upload Prisma Cloud SARIF file
        if: ${{ env.SCAN_WITH_PRISMA_CLOUD == 'true' }}
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ${{ steps.prismascan.outputs.sarif_file }}