policy-as-code/action.yml at main · advanced-security/policy-as-code · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
name: "ghas-policy-as-code"
description: "Advanced Security Policy as Code"

inputs:
  severity:
    description: "Severity Level"
    default: error

  repository:
    description: Repository owner and repo name
    default: ${{ github.repository }}

  token:
    description: GitHub Personal Access Token
    default: ${{ github.token }}

  policy-repo-token:
    description: Separate GitHub PAT if the policy files are stored in a separate repository

  ref:
    description: GitHub Ref
    default: ${{ github.ref }}

  action:
    description: "Action to take upon discovery of security issues hitting threshold"
    default: break

  policy:
    description: Policy as Code repository owner/repo name

  policy-path:
    description: Policy as Code file path (including path in repo)

  policy-branch:
    description: Policy as Code branch
    default: main

  retries:
    description: Number of times to retry the action
    default: 240 # 1 hours worth of retries

  argvs:
    description: "Additional Arguments"

  output:
    description: Path where structured JSON results are written
    default: .compliance/results.json

outputs:
  results:
    description: Structured JSON results, with schema_version, total_violations, total_errors, and per-check results. If the results file is missing (for example, the run failed before writing it), a fallback payload is emitted instead with total_violations and total_errors set to null and a top-level error message describing the failure.
    value: ${{ steps.results.outputs.results }}

runs:
  using: "composite"
  steps:
    - id: policy
      shell: bash
      run: |
        echo "Running Policy as Code..."
        export PYTHONPATH=${{ github.action_path }}:${{ github.action_path }}/vendor
        python3 -m ghascompliance \
          --severity "${{ inputs.severity }}" \
          --action "${{ inputs.action }}" \
          --github-token "${{ inputs.token }}" \
          --policy-repo-token "${{ inputs.policy-repo-token }}" \
          --github-repository "${{ inputs.repository }}" \
          --github-ref "${{ inputs.ref }}" \
          --github-policy "${{ inputs.policy }}" \
          --github-policy-path "${{ inputs.policy-path }}" \
          --github-policy-branch "${{ inputs.policy-branch }}" \
          --retry-count "${{ inputs.retries }}" \
          --output "${{ inputs.output }}" \
          ${{ inputs.argvs }}
    - id: results
      if: always()
      shell: bash
      env:
        RESULTS_FILE: ${{ inputs.output }}
      run: |
        delimiter="$(python -c 'import secrets; print(secrets.token_hex(16))' 2>/dev/null || python3 -c 'import secrets; print(secrets.token_hex(16))')"
        {
          printf 'results<<%s\n' "$delimiter"
          if [ -f "$RESULTS_FILE" ]; then
            cat "$RESULTS_FILE"
          else
            printf '%s\n' '{"schema_version":1,"total_violations":null,"total_errors":null,"checks":{},"error":"Results file was not found; the run may have failed before writing results"}'
          fi
          printf '%s\n' "$delimiter"
        } >> "$GITHUB_OUTPUT"