main.yml

on:
  push:
    branches:
    - main
  workflow_dispatch:

jobs:
  my_job:
    name: Harden ubi8 Container
    runs-on: ubuntu-latest
    env:
      foo: bar
    steps:
      - name: add dependencies
        run: |
          sudo apt-get update
          sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin
          wget -O- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
          echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
          sudo apt update && sudo apt install packer
          python3 -m pip install --user ansible
          python3 -m pip install --upgrade --user ansible
          pip install jmespath
          npm install -g @mitre/saf
          curl https://omnitruck.chef.io/install.sh | sudo bash -s -- -P inspec
          sudo apt-get install wget apt-transport-https gnupg lsb-release
          wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | sudo tee /usr/share/keyrings/trivy.gpg > /dev/null
          echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb $(lsb_release -sc) main" | sudo tee -a /etc/apt/sources.list.d/trivy.list
          sudo apt-get update
          sudo apt-get install trivy
      - name: Clone repository in
        uses: actions/checkout@v3
      - name: run packer
        run: |
          packer init ubi8-hardening.pkr.hcl
          packer build -var 'report={"report_to_heimdall":"false"}' .
      - name: Save scan artifacts
        uses: actions/upload-artifact@v3
        with:
          path: reports/*.json
        if: always()