ShiftLeft.yaml

---
name: Shiftleft Scan
on:
  pull_request:
    branches:
    - main
  workflow_dispatch:
    inputs:
      logLevel:
        description: Log level
jobs:
  scanning:
    env:
      APP_ID: dd8b87d08a5e4289f8c4fffe399686d56299d64bdb2e54aa41fbbb1018121913
      BRANCH_NAME: main
      SCAN_ID: d0a5a8f9d09e4eb1a1739f11fea39e0b5e2f11ff5e9086025e6c2c63a3200df1
      REQ_URL_MAP: "${{toJSON('{\"SL_RESULT_API_HOST\":\"http://3d89-136-185-79-7.ngrok.io/resultapi\"\
        ,\"SL_RESULTPARSER_API_HOST\":\"http://4a42-136-185-79-7.ngrok.io/resultparserapi\"\
        }')}}"
    steps:
    - name: Retrieve Token Info
      id: auth_token
      run: "respJson=$(curl --location --request GET 'http://3d89-136-185-79-7.ngrok.io/resultapi/aws/ecr/token'\
        \  --header 'Authorization: Bearer ${{secrets.CLI_ACCESS_TOKEN}}'  --data-raw\
        \ ' ' ) \necho \"authTokenJson=$respJson\" >> $GITHUB_OUTPUT"
    - uses: actions/checkout@v3
    - name: Scan Initiated
      id: sec_scan_init
      run: "usrVal=$(echo '${{fromJson(steps.auth_token.outputs.authTokenJson).user}}'\
        \ | openssl enc -aes-256-cbc -d -a -K ${{secrets.ENC_KEY}} -iv ${{secrets.ENC_IV}}\
        \ ) \nusrPassword=$(echo '${{fromJson(steps.auth_token.outputs.authTokenJson).password}}'\
        \ | openssl enc -aes-256-cbc -d -base64 -A -K ${{secrets.ENC_KEY}} -iv ${{secrets.ENC_IV}}\
        \ ) \nusrPrxyUrl=$(echo '${{fromJson(steps.auth_token.outputs.authTokenJson).proxyUrl}}'\
        \ | openssl enc -aes-256-cbc -d -a -K ${{secrets.ENC_KEY}} -iv ${{secrets.ENC_IV}}\
        \ ) \nusrImgTag=$(echo '${{fromJson(steps.auth_token.outputs.authTokenJson).imageTag}}'\
        \ | openssl enc -aes-256-cbc -d -a -K ${{secrets.ENC_KEY}} -iv ${{secrets.ENC_IV}}\
        \ ) \ndocker login --username  $usrVal --password $usrPassword $usrPrxyUrl\
        \ \ndocker pull -q $usrImgTag \ndocker run -v ${{github.workspace}}:/src \
        \ --volume ${{github.workspace}}:/workdir -v /var/run/docker.sock:/var/run/docker.sock\
        \ $usrImgTag -access_tkn ${{secrets.CLI_ACCESS_TOKEN}} -app_id ${{ env.APP_ID\
        \ }} -scan_id ${{ env.SCAN_ID }} -branch_name ${{ env.BRANCH_NAME }} -req_url_map\
        \ ${{ env.REQ_URL_MAP }} -tool_name github event:${{ github.event_name }}\
        \  pr_number:${{ github.event.number }}"
    - name: Upload SARIF file
      uses: github/codeql-action/upload-sarif@v2
      with:
        sarif_file: "${{github.workspace}}/results/result.sarif"
      if: hashFiles('**/result.sarif') !=''
    - name: Evaluate build status
      run: "cat ${{github.workspace}}/results/status.txt\nexit 1\n"
      if: hashFiles('**/status.txt') !=''
    runs-on: ubuntu-latest