This repository has been archived by the owner on Mar 6, 2023. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 0
42 lines (38 loc) · 1.79 KB
/
shiftleft.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
---
# This workflow integrates ShiftLeft NG SAST with GitHub
# Visit https://docs.shiftleft.io for help
name: ShiftLeft
on:
pull_request:
workflow_dispatch:
jobs:
NextGen-Static-Analysis:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
- uses: actions/setup-go@v2
with:
go-version: '^1.14'
- name: Build
run: |
go build ./...
- name: Download ShiftLeft CLI
run: |
curl https://cdn.shiftleft.io/download/sl > ${GITHUB_WORKSPACE}/sl && chmod a+rx ${GITHUB_WORKSPACE}/sl
- name: Extract branch name
shell: bash
run: echo "##[set-output name=branch;]$(echo ${GITHUB_REF#refs/heads/})"
id: extract_branch
- name: NextGen Static Analysis
run: |
${GITHUB_WORKSPACE}/sl --version
${GITHUB_WORKSPACE}/sl analyze --app readfasterapp --tag branch=${{ github.head_ref || steps.extract_branch.outputs.branch }} --go --cpg $(pwd)
env:
SHIFTLEFT_ACCESS_TOKEN: ${{ secrets.SHIFTLEFT_ACCESS_TOKEN }}
- name: Create status check
run: |
URL="https://www.shiftleft.io/violationlist/readfasterapp?apps=readfasterapp&isApp=1"
GH_CHECK_URL="https://api.github.com/repos/${GITHUB_REPOSITORY}/check-runs"
curl -XPOST $GH_CHECK_URL -H "Authorization: Token ${GITHUB_TOKEN}" -H "accept: application/vnd.github.antiope-preview+json" -H "Content-Type: application/json" -d "{\"name\": \"ShiftLeft NextGen Static Analysis\", \"head_sha\": \"${GITHUB_REF}\", \"external_id\": \"readfasterapp\", \"details_url\": \"${URL}\", \"status\": \"completed\", \"conclusion\": \"action_required\", \"output\": {\"title\": \"ShiftLeft NextGen Static Analysis Findings\", \"summary\": \"Visit ${URL} for the findings\"}}"
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}