Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions .github/workflows/generate-docs.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
name: Generate Action Docs
on:
pull_request:
paths:
- action.yml
- README.md

jobs:
doc:
runs-on: ubuntu-latest
permissions:
contents: write
steps:
- uses: actions/checkout@v3
with:
ref: ${{ github.event.pull_request.head.ref }}
- uses: pndurette/gh-actions-auto-docs@v1
with:
heading_size: 2
40 changes: 24 additions & 16 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,22 +9,31 @@ The Upwind Security ShiftLeft ShiftLeft Scan Event Publish Event Action enables
- Docker Environment: Ensure that the GitHub runner has access to Docker to build and manage images.
- Upwind Credentials: Obtain your Upwind Client ID and Client Secret for authentication.

<!--doc_begin-->
## Inputs

Define the following inputs in your workflow to configure the ShiftLeft actions:

- `upwind_client_id` (required): Your Upwind Client ID.
- `upwind_client_secret` (required): Your Upwind Client Secret.
- `docker_image` (required): The Docker image to scan, which should reside on the same runner.
- `docker_user` (optional): Username for authenticating to the Docker registry.
- `docker_password` (optional): Password for authenticating to the Docker registry.
- `pull_image` (optional): Boolean flag to determine if the image should be pulled. Set to false if the image is available locally. Default is true.
- `oci_client` (optional): Which client should be used to pull the image. The default `docker` will use the docker daemon. Other options include `podman` and `skopeo`. Note that the binary must be installed and available on the path.
- `output_json` (optional): path to output JSON results to
- `commit_sha` (optional): SHA to be associated with the build. By default this uses the $GITHUB_SHA environmental variable
- `additional_registries` (optional): Comma-separated list of additional registries to associate with the scanned image, passed as a string (String input)
- `use_sudo` (optional): indicate whether the scanner should run with `sudo` to be able to access the image
- `block_on` (optional): Block the workflow based on Upwind Scan Recommendation. Value can be either `do_not_deploy` or `deploy_with_caution`
|Input|Description|Default|Required|
|-----|-----------|-------|:------:|
|`upwind_client_id`|Upwind Client ID|n/a|yes|
|`upwind_client_secret`|Upwind Client Secret|n/a|yes|
|`docker_image`|Already built docker image residing on same runner|n/a|yes|
|`docker_user`|User to authenticate to the Docker registry|n/a|no|
|`docker_password`|Password to authenticate to the Docker registry|n/a|no|
|`pull_image`|Attempt to pull the image. Set to false if image is available locally|`True`|no|
|`oci_client`|Client with which to pull image. Options are docker (default), podman, and skopeo|`docker`|no|
|`additional_registries`|Comma-separated list of additional registries to associate with the scanned image, passed as a string|n/a|no|
|`output_json`|File location to write JSON output to|`output.json`|no|
|`commit_sha`|SHA to be associated with the build. By default this uses the $GITHUB_SHA environmental variable|`${GITHUB_SHA}`|no|
|`upwind_uri`|Public Upwind URI domain name|`upwind.io`|no|
|`use_sudo`|whether to use sudo when invoking the scan to connect to the OCI client|`True`|no|
|`github_token`|GitHub token for authentication|n/a|no|
|`pr_number`|Pull request number|n/a|no|
|`repo_name`|The GitHub repository in owner/repo format|n/a|no|
|`add_comment`|Whether to add a comment to the PR when a scan is completed|`False`|no|
|`debug`|Enable debug logging|`False`|no|
|`block_on`|Block workflow based on Upwind Scan Recommendation. Can be either 'do_not_deploy' or 'deploy_with_caution'|n/a|no|
## Outputs
None
<!--doc_end-->

## Usage

Expand Down Expand Up @@ -94,4 +103,3 @@ This workflow triggers on pushes to the main branch, builds the Docker image, an
## Troubleshooting
- Authentication Issues: Verify that your Upwind credentials are correct and have the necessary permissions.
- Docker Access: Ensure that the GitHub runner has the required permissions to access Docker.