core-cloud-workflow-checkov-sast-scan/action.yaml at main · UKHomeOffice/core-cloud-workflow-checkov-sast-scan · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
name: 'Checkov SAST Scan'
description: 'Runs a Checkov scan on source code using central policies.'

inputs:
  path:
    description: 'The path to the directory to scan.'
    required: false
    default: '.'
    type: string
  version-tag:
    description: 'The git ref of the central policies repo to use.'
    required: false
    default: 'main'
    type: string
  org:
    description: 'Set if using GHES instance'
    type: string
    required: false
    default: 'UKHomeOffice'

runs:
  using: 'composite'
  steps:
    - name: Checkout reusable workflow for custom policies
      uses: actions/checkout@v4
      with:
        repository: '${{ inputs.org }}/core-cloud-workflow-checkov-sast-scan'
        ref: ${{ inputs.version-tag }}
        path: 'checkout-central-checkov-policies'

    - name: Checkout custom policies
      uses: actions/checkout@v4
      with:
        repository: '${{ inputs.org }}/core-cloud-workflow-checkov-sast-scan'
        ref: ${{ inputs.version-tag }}
        path: 'checkout-central-checkov-policies'

    - name: Move policies
      shell: bash
      run: |
        mkdir -p central-checkov-policies
        mv checkout-central-checkov-policies/central-checkov-policies central-checkov-policies
        mv checkout-central-checkov-policies/finops-policies finops-policies

    - name: Checkout Checkov Map File
      uses: actions/checkout@v4
      with:
        repository: '${{ inputs.org }}/core-cloud-workflow-checkov-sast-scan'
        ref: 'checkov-mapping-updates'
        path: 'checkout-checkov-mapping-updates'

    - name: Run Checkov Scan
      id: checkov_scan
      uses: bridgecrewio/checkov-action@v12
      with:
        output_format: cli,sarif
        quiet: true
        soft_fail: true
        directory: ${{ inputs.path }}
        output_file_path: results.sarif
        external_checks_dirs: central-checkov-policies
        skip_check: CKV_CCL_CUSTOM_001,CKV_CCL_CUSTOM_002,CKV_AWS_28,CKV_TF_1

    - name: Set up Python
      uses: actions/setup-python@v4
      with:
        python-version: '3.8'

    - name: Fix File Permissions
      shell: bash
      run: sudo chown -R $USER:$USER results.sarif

    - name: Process SARIF file
      shell: bash
      run: python3 -u checkout-checkov-mapping-updates/scripts/update_via_map_file.py

    - name: Determine commit SHA for SARIF upload
      if: ${{ github.event_name == 'pull_request' }}
      shell: bash
      run: |
        SHA=$(git cat-file -p HEAD | grep '^parent' | sed -n '2p' | awk '{print $2}')
        if [ -n "$SHA" ]; then
          PR_NUMBER=$(echo "$GITHUB_REF" | sed 's|refs/pull/\([0-9]*\)/merge|\1|')
          git fetch --depth=1 origin "refs/pull/${PR_NUMBER}/head" 2>/dev/null || true
          git checkout "$SHA" 2>/dev/null || true
        fi
        [ -z "$SHA" ] && SHA=$(git rev-parse HEAD)
        printf 'SARIF_COMMIT_SHA=%s\n' "$SHA" >> "$GITHUB_ENV"

    - name: Upload SARIF file
      uses: github/codeql-action/upload-sarif@v4
      with:
        sarif_file: 'results.sarif'
        category: 'checkov-sast-scan'
        ref: ${{ github.event_name == 'pull_request' && format('refs/pull/{0}/head', github.event.number) || github.ref }}
        sha: ${{ env.SARIF_COMMIT_SHA || github.sha }}

    - name: Run Checkov Scan (FinOps policies only)
      id: checkov_scan_finops
      uses: bridgecrewio/checkov-action@v12
      with:
        output_format: cli
        quiet: true
        soft_fail: true
        directory: ${{ inputs.path }}
        framework: terraform_plan
        external_checks_dirs: finops-policies
        download_external_modules: true
        check: CC_FINOPS_TAGS