mirror of
https://github.com/fluxcd/flux2.git
synced 2026-02-08 08:47:27 +00:00
2b7a0f3fd4
This commit changes the way the build of manifests is triggered by making smarter use of the capabilities of Make. The result should be that the manifests are only regenerated if: 1. There is no `cmd/flux/manifests/` directory. 2. There have been made changes to the YAML files in the `manifests/` directory that are newer than the files in `cmd/flux/manifests/`. Signed-off-by: Hidde Beydals <hello@hidde.co>
60 lines
1.6 KiB
YAML
60 lines
1.6 KiB
YAML
name: Scan
|
|
|
|
on:
|
|
push:
|
|
branches: [ main ]
|
|
pull_request:
|
|
branches: [ main ]
|
|
schedule:
|
|
- cron: '18 10 * * 3'
|
|
|
|
jobs:
|
|
fossa:
|
|
name: FOSSA
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v2
|
|
- name: Run FOSSA scan and upload build data
|
|
uses: fossa-contrib/fossa-action@v1
|
|
with:
|
|
# FOSSA Push-Only API Token
|
|
fossa-api-key: 5ee8bf422db1471e0bcf2bcb289185de
|
|
github-token: ${{ github.token }}
|
|
|
|
snyk:
|
|
name: Snyk
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
|
|
steps:
|
|
- uses: actions/checkout@v2
|
|
- name: Setup Kustomize
|
|
uses: fluxcd/pkg//actions/kustomize@main
|
|
- name: Build manifests
|
|
run: |
|
|
make cmd/flux/manifests
|
|
- name: Run Snyk to check for vulnerabilities
|
|
uses: snyk/actions/golang@master
|
|
continue-on-error: true
|
|
env:
|
|
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
|
|
with:
|
|
args: --sarif-file-output=snyk.sarif
|
|
- name: Upload result to GitHub Code Scanning
|
|
uses: github/codeql-action/upload-sarif@v1
|
|
with:
|
|
sarif_file: snyk.sarif
|
|
|
|
codeql:
|
|
name: CodeQL
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v2
|
|
- name: Initialize CodeQL
|
|
uses: github/codeql-action/init@v1
|
|
with:
|
|
languages: go
|
|
- name: Autobuild
|
|
uses: github/codeql-action/autobuild@v1
|
|
- name: Perform CodeQL Analysis
|
|
uses: github/codeql-action/analyze@v1
|