diff --git a/.github/workflows/generate-docs.yml b/.github/workflows/generate-docs.yml new file mode 100644 index 0000000..bffba4a --- /dev/null +++ b/.github/workflows/generate-docs.yml @@ -0,0 +1,19 @@ +name: Generate Action Docs +on: + pull_request: + paths: + - action.yml + - README.md + +jobs: + doc: + runs-on: ubuntu-latest + permissions: + contents: write + steps: + - uses: actions/checkout@v3 + with: + ref: ${{ github.event.pull_request.head.ref }} + - uses: pndurette/gh-actions-auto-docs@v1 + with: + heading_size: 2 diff --git a/README.md b/README.md index 54a4f1d..7fb6432 100644 --- a/README.md +++ b/README.md @@ -9,22 +9,31 @@ The Upwind Security ShiftLeft ShiftLeft Scan Event Publish Event Action enables - Docker Environment: Ensure that the GitHub runner has access to Docker to build and manage images. - Upwind Credentials: Obtain your Upwind Client ID and Client Secret for authentication. + ## Inputs - -Define the following inputs in your workflow to configure the ShiftLeft actions: - -- `upwind_client_id` (required): Your Upwind Client ID. -- `upwind_client_secret` (required): Your Upwind Client Secret. -- `docker_image` (required): The Docker image to scan, which should reside on the same runner. -- `docker_user` (optional): Username for authenticating to the Docker registry. -- `docker_password` (optional): Password for authenticating to the Docker registry. -- `pull_image` (optional): Boolean flag to determine if the image should be pulled. Set to false if the image is available locally. Default is true. -- `oci_client` (optional): Which client should be used to pull the image. The default `docker` will use the docker daemon. Other options include `podman` and `skopeo`. Note that the binary must be installed and available on the path. -- `output_json` (optional): path to output JSON results to -- `commit_sha` (optional): SHA to be associated with the build. By default this uses the $GITHUB_SHA environmental variable -- `additional_registries` (optional): Comma-separated list of additional registries to associate with the scanned image, passed as a string (String input) -- `use_sudo` (optional): indicate whether the scanner should run with `sudo` to be able to access the image -- `block_on` (optional): Block the workflow based on Upwind Scan Recommendation. Value can be either `do_not_deploy` or `deploy_with_caution` +|Input|Description|Default|Required| +|-----|-----------|-------|:------:| +|`upwind_client_id`|Upwind Client ID|n/a|yes| +|`upwind_client_secret`|Upwind Client Secret|n/a|yes| +|`docker_image`|Already built docker image residing on same runner|n/a|yes| +|`docker_user`|User to authenticate to the Docker registry|n/a|no| +|`docker_password`|Password to authenticate to the Docker registry|n/a|no| +|`pull_image`|Attempt to pull the image. Set to false if image is available locally|`True`|no| +|`oci_client`|Client with which to pull image. Options are docker (default), podman, and skopeo|`docker`|no| +|`additional_registries`|Comma-separated list of additional registries to associate with the scanned image, passed as a string|n/a|no| +|`output_json`|File location to write JSON output to|`output.json`|no| +|`commit_sha`|SHA to be associated with the build. By default this uses the $GITHUB_SHA environmental variable|`${GITHUB_SHA}`|no| +|`upwind_uri`|Public Upwind URI domain name|`upwind.io`|no| +|`use_sudo`|whether to use sudo when invoking the scan to connect to the OCI client|`True`|no| +|`github_token`|GitHub token for authentication|n/a|no| +|`pr_number`|Pull request number|n/a|no| +|`repo_name`|The GitHub repository in owner/repo format|n/a|no| +|`add_comment`|Whether to add a comment to the PR when a scan is completed|`False`|no| +|`debug`|Enable debug logging|`False`|no| +|`block_on`|Block workflow based on Upwind Scan Recommendation. Can be either 'do_not_deploy' or 'deploy_with_caution'|n/a|no| +## Outputs +None + ## Usage @@ -94,4 +103,3 @@ This workflow triggers on pushes to the main branch, builds the Docker image, an ## Troubleshooting - Authentication Issues: Verify that your Upwind credentials are correct and have the necessary permissions. - Docker Access: Ensure that the GitHub runner has the required permissions to access Docker. -