diff --git a/.github/workflows/action.yaml b/.github/workflows/action.yaml index 77a0b9d..002f6b3 100644 --- a/.github/workflows/action.yaml +++ b/.github/workflows/action.yaml @@ -11,7 +11,7 @@ jobs: id: start_scan uses: ./ with: - plan: rapid_static # Specify which plan to use for the scan (check plan section). + scan_profile: fast_scan # Specify which scan profile to use for the scan (check scan section). asset_type: android-apk # type of asset to scan. target: ostorlab.apk # path for target tto scan. scan_title: title_scan_ci # type a title for your scan. diff --git a/Dockerfile b/Dockerfile index 391cd5a..014265b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,3 +1,9 @@ -FROM python:3.8-alpine -RUN pip install ostorlab -CMD ostorlab --api-key="$INPUT_OSTORLAB_API_KEY" ci-scan run --log-flavor=github --title="$INPUT_SCAN_TITLE" --plan="$INPUT_PLAN" --break-on-risk-rating="$INPUT_BREAK_ON_RISK_RATING" --max-wait-minutes="$INPUT_MAX_WAIT_MINUTES" $INPUT_ASSET_TYPE $INPUT_TARGET +FROM python:3.8-slim-buster as base +FROM base as builder +RUN mkdir /install +WORKDIR /install +RUN pip install --prefix=/install ostorlab +FROM base +WORKDIR /root/ +COPY --from=builder /install /usr/local +CMD ostorlab --api-key="$INPUT_OSTORLAB_API_KEY" ci-scan run --log-flavor=github --title="$INPUT_SCAN_TITLE" --scan-profile="$INPUT_SCAN_PROFILE" --break-on-risk-rating="$INPUT_BREAK_ON_RISK_RATING" --max-wait-minutes="$INPUT_MAX_WAIT_MINUTES" $INPUT_ASSET_TYPE $INPUT_TARGET diff --git a/README.md b/README.md index 3a5f441..8c439a5 100644 --- a/README.md +++ b/README.md @@ -42,7 +42,7 @@ jobs: id: start_scan uses: actions/ostorlab_actions@v1 with: - plan: rapid_static + scan_profile: fast_scan asset_type: android-apk target: andoird_apk.apk can_title: title_scan_ci @@ -55,7 +55,7 @@ jobs: The Github actions the following options: - - **`plan`** *(['rapid_static', 'static_dynamic_backend'])*: [Required] - Specifies the scan plan ( `rapid_static` for fast static only analysis and `full analysis` for full static, dynamic and backend coverage). + - **`scan_profile`** *(['fast_scan', 'full_scan'])*: [Required] - Specifies the scan profile ( `fast_scan` for fast static only analysis and `full_scan` for full static, dynamic and backend coverage). - **`asset_type`** *(['android-apk', 'android-aab', 'ios-ipa'])*: [Required] - Target asset, Ostorlab supports APK, AAB and IPA. - **`target`**: [Required] - target file to scan. - **`ostorlab_api_key`**: [Required] - API Key from Ostorlab portal. diff --git a/action.yml b/action.yml index 985c8e0..9fe05db 100644 --- a/action.yml +++ b/action.yml @@ -1,10 +1,10 @@ name: Ostorlab Security Scanner description: Scan mobile apps for outdated dependencies, hardcoded secrets, privacy leakages, and insecure code (Signup at ostorlab.co). inputs: - plan: - description: Specifies your scan plan ( free (rapid_static) for community scans and static_dynamic_backend for full analysis) + scan_profile: + description: Specifies your scan profile ( free "fast_scan" for community scans and "full_scan" for full analysis) required: true - default: rapid_static + default: fast_scan asset_type: description: Type of asset to scan. (['android-apk', 'android-aab', 'ios-ipa']) required: true