main.yml

name: CI

# Controls when the workflow will run
on:
  # Triggers the workflow on push or pull request events but only for the "main" branch
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]

  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

env:
  SECURE_LOG_LEVEL: ${{ secrets.LOG_LEVEL_DEBUG }}
  CS_REGISTRY_USER: ${{ secrets.SDIP_GITLAB_DEPLOY_USERNAME }}
  CS_REGISTRY_PASSWORD: ${{ secrets.SDIP_GITLAB_DEPLOY_TOKEN }}

# A workflow run is made up of one or more jobs that can run sequentially or in parallel
jobs:
  # This workflow contains a single job called "build"
  build:
    # The type of runner that the job will run on
    runs-on: ubuntu-latest

    # Steps represent a sequence of tasks that will be executed as part of the job
    steps:
      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
      - uses: actions/checkout@v4

      - name: Container Scanning
        run: |
          export SDIP_IMAGE_TAG=$GITHUB_SHA
          export CS_IMAGE=$GITHUB_REPOSITORY:${SDIP_IMAGE_TAG}
          gtcs scan
        env:
          LOG_LEVEL_DEBUG: ${{ secrets.LOG_LEVEL_DEBUG }}
          SDIP_GITLAB_DEPLOY_USERNAME: ${{ secrets.SDIP_GITLAB_DEPLOY_USERNAME }}
          SDIP_GITLAB_DEPLOY_TOKEN: ${{ secrets.SDIP_GITLAB_DEPLOY_TOKEN }}
          SDIP_RUNNER_TAG: ${{ secrets.SDIP_RUNNER_TAG }}

      - name: Upload Container Scanning Report
        uses: actions/upload-artifact@v2
        with:
          name: container_scanning_report
          path: gl-container-scanning-report.json