Repository navigation
feat(wd_mycloud): install break-glass SSH keys and restore them at boot #815
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: IaC Security Scan | |
| on: | |
| # Deliberately no `paths:` filter - Checkov scans `--directory .` (the | |
| # whole repo) regardless of what changed, and it's a required status | |
| # check on main's ruleset. A path-filtered required check that doesn't | |
| # run on a given PR (e.g. a docs-only change) sits "expected" forever - | |
| # GitHub rulesets have no "skip if not triggered" logic - which blocked | |
| # PR #290 outright, even with --admin (this ruleset has no admin bypass | |
| # by design). Always running is the only way a full-repo scan can be a | |
| # required check without occasionally blocking unrelated PRs. | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| security-events: write | |
| actions: read | |
| concurrency: | |
| group: iac-security-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| checkov: | |
| name: Checkov | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Python | |
| uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7 | |
| with: | |
| python-version: "3.15" | |
| - name: Install Checkov | |
| run: | | |
| python -m pip install --disable-pip-version-check "checkov==3.2.529" | |
| - name: Run Checkov | |
| run: | | |
| mkdir -p reports/checkov | |
| checkov \ | |
| --directory . \ | |
| --compact \ | |
| --output cli \ | |
| --output sarif \ | |
| --output-file-path console,reports/checkov/checkov.sarif | |
| - name: Upload Checkov report artifact | |
| if: always() | |
| uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7 | |
| with: | |
| name: checkov-report-${{ github.run_id }} | |
| path: reports/checkov | |
| if-no-files-found: ignore | |
| retention-days: 30 | |
| - name: Upload Checkov SARIF | |
| if: always() && hashFiles('reports/checkov/checkov.sarif') != '' | |
| continue-on-error: true | |
| uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4 | |
| with: | |
| sarif_file: reports/checkov/checkov.sarif |