Skip to content

Commit ab9a80c

Browse files
ostermanclaudeaknysh
authored
feat(hooks): CI annotations and SARIF upload for scanner findings (#2631)
* feat(hooks): surface scanner findings in CI job summary + fix Checkov in Docker image Security scanner hooks (Checkov, Trivy, KICS, Infracost) already render a markdown findings summary to the terminal, but it never reached the CI pipeline — findings were buried in the `atmos terraform plan` log stream. Route that summary to the GitHub Actions job step summary automatically when running in GitHub Actions ($GITHUB_STEP_SUMMARY), reusing the existing CI provider OutputWriter seam: - pkg/ci/summary.go: new ci.WriteStepSummary helper (no-op outside CI / when no summary destination), hiding the internal provider OutputWriter type. - pkg/hooks/command_engine.go: renderCISummary, called after renderTerminal in CommandEngine.Run. Best-effort — a step-summary write failure logs at debug and never fails the hook. Covers all four CommandEngine-based scanner/cost kinds uniformly. Also fix Checkov crashing inside the official Atmos Docker image: bump the base image from debian:bookworm-slim (glibc 2.36) to debian:trixie-slim (glibc 2.41) so the PyInstaller-bundled Checkov binary (needs GLIBC_2.38+) loads its frozen Python runtime instead of failing with a missing-version error. Includes unit + end-to-end tests, hooks docs, changelog blog post, and roadmap. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(roadmap): link scanner CI-summary milestone to PR #2617 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(roadmap): classify Infracost as a cost tool, not a security scanner Addresses CodeRabbit review on PR #2617: the milestone description grouped Infracost under "security scanner hooks"; Infracost is a cost-analysis tool. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(hooks): native CI annotations + SARIF Code Scanning upload for scanner findings Surface scanner-hook findings (checkov/trivy/kics) in CI beyond the job summary — as inline GitHub annotations on the PR diff and as uploaded SARIF in GitHub Code Scanning (the Security tab) — natively, without the github/codeql-action. CI reporting is modeled as provider capabilities, not hooks (the deprecated ci.* hook kinds are not revived): - pkg/ci/internal/provider: new optional capability interfaces Annotator and SARIFReporter + neutral Annotation/SARIFReport types (opt-in via type assertion, like CacheProvider/DebugModeDetector). - pkg/ci/results.go: ci.Annotate / ci.ReportSARIF helpers (Detect → type-assert → call; no-op otherwise) + public type aliases, mirroring ci.WriteStepSummary. - pkg/ci/providers/github: implement Annotate (::error/::warning workflow commands with proper escaping; severity → level) and ReportSARIF (CodeScanning.UploadSarif; gzip+base64; category stamped into runs[].automationDetails.id so per-component uploads don't overwrite). - pkg/schema: new ci.annotations (default on) and ci.results (default off) feature gates, siblings of ci.summary/checks/comments; all require ci.enabled. The hook hands findings to the provider when the gate is on: - pkg/hooks/sarif: the shared SARIF handler now surfaces parsed findings + raw SARIF on the Summary (so checkov/trivy/kics are all covered by one change), labeling by the SARIF tool name when no kind is set. - pkg/hooks/command_engine.go: emitCIAnnotations + publishCIResults after renderCISummary; auto-derive the Code Scanning category from the scan target (component vs stack/component). Reconcile the step-summary to the ci.enabled gate (was provider-detection-only). - Custom hooks: a format-handler registry lets kind: command opt in via format: sarif (+ optional results path), reusing the shared SARIF handler for any SARIF-emitting tool with no Go code. Includes unit + end-to-end tests, hooks docs (incl. required GitHub Actions permissions), changelog blog post, and a roadmap milestone. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(roadmap): link scanner CI annotations/results milestone to PR #2631 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(hooks): clarify GitHub Advanced Security is a paid GitHub add-on for ci.results Code Scanning is free on public repos; private repos need GitHub Advanced Security, which GitHub licenses as a paid add-on per active committer — Atmos charges nothing for any CI reporting. Annotations and the summary need no add-on. Make this explicit in the hooks docs and blog. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore: update ci annotations and actions * test: add native CI e2e fixture * feat(hooks): surface scanner findings in CI job summary + fix Checkov in Docker image Security scanner hooks (Checkov, Trivy, KICS, Infracost) already render a markdown findings summary to the terminal, but it never reached the CI pipeline — findings were buried in the `atmos terraform plan` log stream. Route that summary to the GitHub Actions job step summary automatically when running in GitHub Actions ($GITHUB_STEP_SUMMARY), reusing the existing CI provider OutputWriter seam: - pkg/ci/summary.go: new ci.WriteStepSummary helper (no-op outside CI / when no summary destination), hiding the internal provider OutputWriter type. - pkg/hooks/command_engine.go: renderCISummary, called after renderTerminal in CommandEngine.Run. Best-effort — a step-summary write failure logs at debug and never fails the hook. Covers all four CommandEngine-based scanner/cost kinds uniformly. Also fix Checkov crashing inside the official Atmos Docker image: bump the base image from debian:bookworm-slim (glibc 2.36) to debian:trixie-slim (glibc 2.41) so the PyInstaller-bundled Checkov binary (needs GLIBC_2.38+) loads its frozen Python runtime instead of failing with a missing-version error. Includes unit + end-to-end tests, hooks docs, changelog blog post, and roadmap. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(roadmap): link scanner CI-summary milestone to PR #2617 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(roadmap): classify Infracost as a cost tool, not a security scanner Addresses CodeRabbit review on PR #2617: the milestone description grouped Infracost under "security scanner hooks"; Infracost is a cost-analysis tool. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(hooks): native CI annotations + SARIF Code Scanning upload for scanner findings Surface scanner-hook findings (checkov/trivy/kics) in CI beyond the job summary — as inline GitHub annotations on the PR diff and as uploaded SARIF in GitHub Code Scanning (the Security tab) — natively, without the github/codeql-action. CI reporting is modeled as provider capabilities, not hooks (the deprecated ci.* hook kinds are not revived): - pkg/ci/internal/provider: new optional capability interfaces Annotator and SARIFReporter + neutral Annotation/SARIFReport types (opt-in via type assertion, like CacheProvider/DebugModeDetector). - pkg/ci/results.go: ci.Annotate / ci.ReportSARIF helpers (Detect → type-assert → call; no-op otherwise) + public type aliases, mirroring ci.WriteStepSummary. - pkg/ci/providers/github: implement Annotate (::error/::warning workflow commands with proper escaping; severity → level) and ReportSARIF (CodeScanning.UploadSarif; gzip+base64; category stamped into runs[].automationDetails.id so per-component uploads don't overwrite). - pkg/schema: new ci.annotations (default on) and ci.results (default off) feature gates, siblings of ci.summary/checks/comments; all require ci.enabled. The hook hands findings to the provider when the gate is on: - pkg/hooks/sarif: the shared SARIF handler now surfaces parsed findings + raw SARIF on the Summary (so checkov/trivy/kics are all covered by one change), labeling by the SARIF tool name when no kind is set. - pkg/hooks/command_engine.go: emitCIAnnotations + publishCIResults after renderCISummary; auto-derive the Code Scanning category from the scan target (component vs stack/component). Reconcile the step-summary to the ci.enabled gate (was provider-detection-only). - Custom hooks: a format-handler registry lets kind: command opt in via format: sarif (+ optional results path), reusing the shared SARIF handler for any SARIF-emitting tool with no Go code. Includes unit + end-to-end tests, hooks docs (incl. required GitHub Actions permissions), changelog blog post, and a roadmap milestone. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(roadmap): link scanner CI annotations/results milestone to PR #2631 Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * docs(hooks): clarify GitHub Advanced Security is a paid GitHub add-on for ci.results Code Scanning is free on public repos; private repos need GitHub Advanced Security, which GitHub licenses as a paid add-on per active committer — Atmos charges nothing for any CI reporting. Annotations and the summary need no add-on. Make this explicit in the hooks docs and blog. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore: update ci annotations and actions * test: add native CI e2e fixture * Normalize AWS auth endpoint config * Fix screengrab build command list * Fix CI annotations and validation failures * Update quick-start acceptance snapshots * Normalize SARIF paths for scanner hooks * Fix native scanner CI annotations * Scope scanner SARIF category to tool name and event-scoped preflight Derive the Code Scanning category from the SARIF tool driver name (with hook kind/command fallback) instead of stack/component, stamp a trailing slash into automationDetails.id, force non-blocking security-severity on downgraded findings, and make hook preflight binary checks event-scoped. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Scope Native CI to scanner-related path changes Native CI runs the scanner hooks (checkov/trivy/kics) against the native-ci-e2e fixture and publishes SARIF + code-scanning annotations. Running it on every PR spams unrelated PRs with scanner findings. Gate the pull_request trigger with a paths filter so it only runs when the fixture, its test-case, the workflow, or the scanner/CI source it exercises (pkg/ci, pkg/hooks, actions/cache) changes. workflow_dispatch is unchanged for manual runs. Native CI is not a required check, so skipping it on unrelated PRs does not block merges. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Reduce native CI scanner findings to one per scanner The scanner target buckets were completely bare, so trivy (8 findings) and kics (4 findings) each flagged a dozen-plus distinct S3 misconfigurations, spamming every PR's code-scanning annotations. Harden each target bucket to mostly-good defaults with versioning as the single intentional gap, so each scanner reports exactly one clearly-attributable finding: - trivy: PAB + CMK encryption + logging -> AWS-0090 (versioning) only - kics: tags + logging, and exclude the account-level IAM Access Analyzer query (not a per-bucket property) -> "S3 Bucket Without Versioning" only - checkov: stays pinned to CKV_AWS_21; its default S3 suite also flags architectural rules (replication/lifecycle/notifications) out of scope here Verified locally with trivy 0.70.0 and kics 2.1.20: one finding each. terraform validate, terraform fmt, and atmos validate stacks all pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Fix doubled SARIF paths for workdir-relative scanner output kics and Checkov emit SARIF artifactLocation URIs relative to the Atmos working directory (e.g. components/terraform/<c>/x.tf), which already include the component prefix. normalizeRel assumed every relative path was relative to the component dir and prepended sourceRoot, producing doubled paths (components/terraform/<c>/components/terraform/<c>/x.tf) that GitHub Code Scanning could not anchor — so only Trivy (which emits an absolute path) surfaced an annotation on the PR. Resolve relative paths against candidate bases (repo root, Atmos base path, scan dir, component dir) and use the first that points at a real file, so a base already containing the component prefix is not added twice. Add the Atmos base path as a mapper root and regression tests for the workdir-relative, file-relative, and absolute cases. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Fix native CI apply by keeping scanner targets Floci-applyable The previous commit hardened the scanner target buckets with KMS keys and S3 bucket logging to suppress findings via real resources. That broke the terraform-apply E2E: the Floci emulator cannot create KMS keys (UnrecognizedClientException) or S3 bucket logging (empty result), so apply failed even though plan + the scanners passed. Revert the targets to minimal buckets (apply cleanly on Floci, as the pre-hardening green runs proved) and control scanner noise in the hooks instead, so each scanner still reports exactly one finding: - checkov: --check CKV_AWS_21 (unchanged) - trivy: --severity MEDIUM (AWS-0090 versioning is the only MEDIUM check) - kics: --include-queries <versioning> (replaces --exclude-queries) Verified locally with trivy 0.70.0 and kics 2.1.20: one finding each. terraform validate/fmt and atmos validate stacks pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Exclude no-color.org from link check (CI timeouts) The Check Markdown Links job failed with exit code 2 on two TIMEOUT entries for https://no-color.org/ (referenced from docs/prd/ io-handling-strategy.md and help-system-architecture.md) — 0 real errors, just a slow external site. Add it to lychee.toml's exclude list, matching the existing pattern for flaky external domains (gnu.org, tldp.org, regex101.com, etc.). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Test scanner inline-ignore directives in native CI fixture Exercise each scanner's native suppression directive end-to-end instead of only scoping via CLI flags. Each target is scoped to two checks — versioning + access logging — and the logging finding is suppressed inline with the scanner's own ignore syntax, proving Atmos runs each scanner in a context where it can read those directives (without them, two findings would surface; only versioning should): - checkov: --check CKV_AWS_21,CKV_AWS_18 + #checkov:skip=CKV_AWS_18 - trivy: --severity MEDIUM,LOW + #trivy:ignore:AWS-0089 (+ public-access block so the only LOW is logging) - kics: --include-queries versioning,logging + # kics-scan disable=<logging> Targets stay Floci-applyable (bucket + public-access block only; no KMS or S3 logging resources, which Floci cannot create). Verified locally with checkov 3.3.x, trivy 0.70.0, kics 2.1.20: one finding each. terraform validate/fmt and atmos validate stacks pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * Route KMS to Floci in native CI fixture provider config Add a kms endpoint to the test stack's AWS provider so aws_kms_key requests reach the Floci emulator instead of escaping to real AWS (which fails with UnrecognizedClientException since the test creds are fake). The current targets don't create KMS keys, but this bakes in the routing so a future hardened bucket can use customer-managed-key encryption without rediscovering the missing endpoint. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix: address code-review findings on scanner CI branch - native-ci.yml: verify Trivy/KICS binary downloads against their published sha256 checksums before extraction (supply-chain hardening); KICS extracted-info.zip has no published checksum and is left as-is. - hooks.RunAll: add missing perf.Track instrumentation. - aws endpointURLFromManager: use the actually-matched identity key (original or lowercase fallback) when resolving the provider config. - identity_dots test: exercise real key-case preservation with a mixed-case key and assert IdentityCaseMap retains original casing. - stores docs: use endpoint: consistently in the Floci example. - godot: add trailing periods to several comments. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * test(ci): cover CI-reporting helpers to clear 80% patch gate Add white-box unit tests for the uncovered/partial branches in the scanner CI-reporting paths, raising patch coverage on the changed files from ~82% to ~94% (set-mode) with comfortable margin over Codecov's partial-counted 80% gate. - pkg/hooks: emitCIAnnotations, publishCIResults (warn-normalize + verbatim + no-op branches), reportsAsWarning, firstSARIFToolName, normalizeSARIFLevels edge/error cases, deriveSARIFCategory fallback, and the format-handler registry (RegisterFormatHandler / formatHandlerFor / resolveResultHandler). - pkg/hooks/sarif: isWindowsDrivePath, cleanAbs, relUnder, fileExists, relativeBases, normalizeAbs/normalizeRel fallbacks, atmosBasePath, sourceComponentPath, customFormatOutputPath nil-guard. - pkg/ci/providers/github: withCategory malformed-run branches, ReportSARIF missing-context + upload-failure wrapping, Annotate write-error propagation. Test-only change; no production code modified. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Andriy Knysh <aknysh@users.noreply.github.com>
1 parent c3ab183 commit ab9a80c

102 files changed

Lines changed: 4050 additions & 320 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

.github/actions/go-version-check/action.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ runs:
7272
7373
- name: Comment on PR
7474
if: steps.compare.outputs.changed == 'true'
75-
uses: actions/github-script@v7
75+
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
7676
with:
7777
github-token: ${{ inputs.token }}
7878
script: |

.github/actions/verify-sha-pinning/action.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ runs:
2929
steps:
3030
- name: Verify SHA pins against upstream tags
3131
id: verify
32-
uses: actions/github-script@v7
32+
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
3333
env:
3434
WORKFLOW_DIR: ${{ inputs.workflow-dir }}
3535
with:
@@ -273,7 +273,7 @@ runs:
273273
274274
- name: Post or update PR comment
275275
if: always() && github.event_name == 'pull_request'
276-
uses: actions/github-script@v7
276+
uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
277277
env:
278278
RESULTS_JSON: ${{ steps.verify.outputs.results_json }}
279279
VERIFIED_COUNT: ${{ steps.verify.outputs.verified_count }}

.github/workflows/algolia.yaml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -36,12 +36,12 @@ jobs:
3636
persist-credentials: false
3737

3838
- name: Setup Node
39-
uses: actions/setup-node@v4
39+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
4040
with:
4141
node-version-file: "website/.nvmrc"
4242

4343
- name: Setup pnpm
44-
uses: pnpm/action-setup@v4
44+
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
4545
with:
4646
version: 9
4747

@@ -78,12 +78,12 @@ jobs:
7878
persist-credentials: false
7979

8080
- name: Setup Node
81-
uses: actions/setup-node@v4
81+
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
8282
with:
8383
node-version-file: "website/.nvmrc"
8484

8585
- name: Setup pnpm
86-
uses: pnpm/action-setup@v4
86+
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
8787
with:
8888
version: 9
8989

.github/workflows/atmos-pro.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ jobs:
2525
with:
2626
persist-credentials: false
2727
# Install Go and toolchain dependencies
28-
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
28+
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
2929
with:
3030
go-version-file: go.mod
3131
- run: go mod tidy
@@ -40,7 +40,7 @@ jobs:
4040
# gofumpt
4141
- name: Get changed Go files
4242
id: changed-files
43-
uses: tj-actions/changed-files@a284dc1814e3fd07f2e34267fc8f81227ed29fb8 # v45.0.6
43+
uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
4444
with:
4545
use_rest_api: "true"
4646
files: |

.github/workflows/codeql.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -94,7 +94,7 @@ jobs:
9494
# Without this step, the action may fail intermittently with
9595
# "could not load export data" errors due to cache corruption
9696
- name: Set up Go
97-
uses: actions/setup-go@v5
97+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
9898
with:
9999
go-version-file: go.mod
100100
cache: true

.github/workflows/dependency-review.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,12 +24,12 @@ jobs:
2424
persist-credentials: false
2525

2626
- name: Set up Go
27-
uses: actions/setup-go@v5
27+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
2828
with:
2929
go-version-file: go.mod
3030

3131
- name: Dependency Review
32-
uses: actions/dependency-review-action@v4
32+
uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
3333
with:
3434
# Disable OpenSSF scorecard to reduce summary size (prevents 1024k limit errors)
3535
show-openssf-scorecard: false

.github/workflows/native-ci.yml

Lines changed: 169 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,169 @@
1+
name: Native CI
2+
3+
on:
4+
pull_request:
5+
types: [opened, synchronize, reopened]
6+
# Only run when something this E2E actually exercises changes, so unrelated
7+
# PRs aren't spammed with scanner SARIF/code-scanning annotations.
8+
paths:
9+
# The E2E fixture + its validation test-case.
10+
- "tests/fixtures/scenarios/native-ci-e2e/**"
11+
- "tests/test-cases/native-ci-e2e.yaml"
12+
# The workflow itself.
13+
- ".github/workflows/native-ci.yml"
14+
# The feature this E2E exercises, so scanner/CI source changes still run it.
15+
- "pkg/ci/**"
16+
- "pkg/hooks/**"
17+
- "actions/cache/**"
18+
workflow_dispatch:
19+
20+
permissions:
21+
contents: read
22+
pull-requests: write
23+
security-events: write
24+
statuses: write
25+
26+
env:
27+
ATMOS_NATIVE_CI_WORKDIR: tests/fixtures/scenarios/native-ci-e2e
28+
ATMOS_VERSION_CHECK_ENABLED: "false"
29+
NATIVE_CI_TRIVY_VERSION: "0.70.0"
30+
NATIVE_CI_KICS_VERSION: "2.1.20"
31+
32+
jobs:
33+
terraform-plan:
34+
name: "[native ci] terraform plan"
35+
runs-on: ubuntu-latest
36+
timeout-minutes: 20
37+
38+
services:
39+
floci:
40+
image: floci/floci@sha256:c88ec20bf221630dd195d38a14eeb0ac52ddfa72c37ebb3c8aa17f63ae27c5f2 # 1.5.23
41+
ports:
42+
- 4566:4566
43+
44+
steps:
45+
- name: Check out code
46+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
47+
with:
48+
persist-credentials: false
49+
50+
- name: Set up Go
51+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
52+
with:
53+
go-version-file: "go.mod"
54+
55+
- name: Build Atmos
56+
run: |
57+
make build-linux
58+
echo "${{ github.workspace }}/build" >> "$GITHUB_PATH"
59+
60+
- name: Restore Atmos native CI cache
61+
uses: ./actions/cache
62+
env:
63+
ATMOS_CHDIR: ${{ env.ATMOS_NATIVE_CI_WORKDIR }}
64+
65+
- name: Validate native CI fixture
66+
working-directory: ${{ env.ATMOS_NATIVE_CI_WORKDIR }}
67+
run: atmos validate stacks
68+
69+
- name: Mirror Terraform providers
70+
working-directory: ${{ env.ATMOS_NATIVE_CI_WORKDIR }}
71+
run: atmos terraform cache mirror bucket -s test --platform=linux_amd64 --format=json
72+
73+
- name: Install scanner tools for native CI fixture
74+
run: |
75+
scanner_bin="$RUNNER_TEMP/native-ci-scanners/bin"
76+
scanner_assets="$RUNNER_TEMP/native-ci-scanners/assets"
77+
mkdir -p "$scanner_bin" "$scanner_assets"
78+
79+
# Download and verify the Trivy binary against its published checksum
80+
# before extracting, so a tampered or corrupted archive never executes.
81+
curl -fsSL \
82+
-o "$RUNNER_TEMP/trivy.tar.gz" \
83+
"https://github.com/aquasecurity/trivy/releases/download/v${NATIVE_CI_TRIVY_VERSION}/trivy_${NATIVE_CI_TRIVY_VERSION}_Linux-64bit.tar.gz"
84+
curl -fsSL \
85+
-o "$RUNNER_TEMP/trivy_checksums.txt" \
86+
"https://github.com/aquasecurity/trivy/releases/download/v${NATIVE_CI_TRIVY_VERSION}/trivy_${NATIVE_CI_TRIVY_VERSION}_checksums.txt"
87+
trivy_sha="$(grep " trivy_${NATIVE_CI_TRIVY_VERSION}_Linux-64bit.tar.gz$" "$RUNNER_TEMP/trivy_checksums.txt" | awk '{print $1}')"
88+
echo "${trivy_sha} $RUNNER_TEMP/trivy.tar.gz" | sha256sum -c -
89+
tar -xzf "$RUNNER_TEMP/trivy.tar.gz" -C "$scanner_bin" trivy
90+
91+
# Download and verify the KICS binary against its published checksum
92+
# before extracting.
93+
curl -fsSL \
94+
-o "$RUNNER_TEMP/kics.tar.gz" \
95+
"https://github.com/Checkmarx/kics/releases/download/v${NATIVE_CI_KICS_VERSION}/kics_${NATIVE_CI_KICS_VERSION}_linux_amd64.tar.gz"
96+
curl -fsSL \
97+
-o "$RUNNER_TEMP/kics_checksums.txt" \
98+
"https://github.com/Checkmarx/kics/releases/download/v${NATIVE_CI_KICS_VERSION}/checksums.txt"
99+
kics_sha="$(grep " kics_${NATIVE_CI_KICS_VERSION}_linux_amd64.tar.gz$" "$RUNNER_TEMP/kics_checksums.txt" | awk '{print $1}')"
100+
echo "${kics_sha} $RUNNER_TEMP/kics.tar.gz" | sha256sum -c -
101+
tar -xzf "$RUNNER_TEMP/kics.tar.gz" -C "$scanner_bin" kics
102+
103+
# The KICS query assets (extracted-info.zip) have no published checksum,
104+
# so they cannot be verified the same way. They are data, not an executable.
105+
curl -fsSL \
106+
-o "$RUNNER_TEMP/kics-extracted-info.zip" \
107+
"https://github.com/Checkmarx/kics/releases/download/v${NATIVE_CI_KICS_VERSION}/extracted-info.zip"
108+
unzip -q "$RUNNER_TEMP/kics-extracted-info.zip" -d "$scanner_assets/kics"
109+
110+
chmod +x "$scanner_bin/trivy" "$scanner_bin/kics"
111+
echo "$scanner_bin" >> "$GITHUB_PATH"
112+
echo "KICS_QUERIES_PATH=$scanner_assets/kics/assets/queries" >> "$GITHUB_ENV"
113+
114+
- name: Terraform plan
115+
id: terraform-plan
116+
working-directory: ${{ env.ATMOS_NATIVE_CI_WORKDIR }}
117+
env:
118+
ATMOS_CI_GITHUB_TOKEN: ${{ github.token }}
119+
GITHUB_TOKEN: ${{ github.token }}
120+
run: atmos terraform plan bucket -s test
121+
122+
terraform-apply:
123+
name: "[native ci] terraform apply"
124+
needs: terraform-plan
125+
runs-on: ubuntu-latest
126+
timeout-minutes: 20
127+
128+
services:
129+
floci:
130+
image: floci/floci@sha256:c88ec20bf221630dd195d38a14eeb0ac52ddfa72c37ebb3c8aa17f63ae27c5f2 # 1.5.23
131+
ports:
132+
- 4566:4566
133+
134+
steps:
135+
- name: Check out code
136+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
137+
with:
138+
persist-credentials: false
139+
140+
- name: Set up Go
141+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
142+
with:
143+
go-version-file: "go.mod"
144+
145+
- name: Build Atmos
146+
run: |
147+
make build-linux
148+
echo "${{ github.workspace }}/build" >> "$GITHUB_PATH"
149+
150+
- name: Restore Atmos native CI cache
151+
uses: ./actions/cache
152+
env:
153+
ATMOS_CHDIR: ${{ env.ATMOS_NATIVE_CI_WORKDIR }}
154+
155+
- name: Validate native CI fixture
156+
working-directory: ${{ env.ATMOS_NATIVE_CI_WORKDIR }}
157+
run: atmos validate stacks
158+
159+
- name: Mirror Terraform providers
160+
working-directory: ${{ env.ATMOS_NATIVE_CI_WORKDIR }}
161+
run: atmos terraform cache mirror bucket -s test --platform=linux_amd64 --format=json
162+
163+
- name: Terraform apply
164+
id: terraform-apply
165+
working-directory: ${{ env.ATMOS_NATIVE_CI_WORKDIR }}
166+
env:
167+
ATMOS_CI_GITHUB_TOKEN: ${{ github.token }}
168+
GITHUB_TOKEN: ${{ github.token }}
169+
run: atmos terraform apply bucket -s test -auto-approve

.github/workflows/pre-commit.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ jobs:
3333
fetch-depth: 0
3434

3535
- name: Set up Go
36-
uses: actions/setup-go@v5
36+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
3737
with:
3838
go-version-file: go.mod
3939
cache: true
@@ -59,7 +59,7 @@ jobs:
5959
go mod download
6060
6161
- name: Set up Python
62-
uses: actions/setup-python@v5
62+
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
6363
with:
6464
python-version: ${{ env.PYTHON_VERSION }}
6565

.github/workflows/screengrabs.yaml

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -73,9 +73,10 @@ jobs:
7373
env:
7474
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
7575

76-
- uses: hashicorp/setup-terraform@v3
77-
with:
78-
terraform_wrapper: false
76+
- name: Add Terraform from Atmos toolchain to PATH
77+
run: |
78+
atmos toolchain install hashicorp/terraform
79+
atmos toolchain env --format=github
7980
8081
- name: Run make build-all install
8182
run: |
@@ -85,14 +86,16 @@ jobs:
8586
env:
8687
ATMOS_PAGER: "false"
8788

88-
- uses: actions/create-github-app-token@v1
89+
- uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
8990
id: github-app
9091
with:
9192
app-id: ${{ vars.BOT_GITHUB_APP_ID }}
9293
private-key: ${{ secrets.BOT_GITHUB_APP_PRIVATE_KEY }}
94+
permission-contents: write
95+
permission-pull-requests: write
9396

9497
- name: Create or update PR
95-
uses: peter-evans/create-pull-request@v7
98+
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
9699
with:
97100
token: ${{ steps.github-app.outputs.token }}
98101
branch: "chore/update-build-screengrabs-for-${{ needs.prepare.outputs.version }}"

.github/workflows/setup-go-cache-warmup.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ jobs:
3333
persist-credentials: false
3434

3535
- name: Set up Go
36-
uses: actions/setup-go@v5
36+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
3737
with:
3838
go-version-file: "go.mod"
3939
id: go

0 commit comments

Comments
 (0)