Skip to content

update actions

update actions #137

Workflow file for this run

on:
push:
branches:
- main
workflow_dispatch:
jobs:
my_job:
name: Harden MongoDB Container
runs-on: ubuntu-latest
env:
REPORT_TO_HEIMDALL: true
HEIMDALL_URL: https://heimdall-demo.mitre.org/evaluations
HEIMDALL_API_KEY: ${{ secrets.SAF_HEIMDALL_UPLOAD_KEY }}
CA_FILE_BASE64_AA: ${{ secrets.CA_FILE_BASE64_AA }}
CA_FILE_BASE64_AB: ${{ secrets.CA_FILE_BASE64_AB }}
CERTIFICATE_KEY_FILE_BASE64: ${{ secrets.CERTIFICATE_KEY_FILE_BASE64 }}
steps:
- name: Add Dependencies
run: |
# python3 -m pip install --user ansible
# python3 -m pip install --upgrade --user ansible
npm install -g @mitre/saf
curl -L https://omnitruck.cinc.sh/install.sh | sudo bash -s -- -P cinc-auditor
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Clone Repository
uses: actions/checkout@v4
- name: Move Certificates
run: |
echo ${{ env.CA_FILE_BASE64_AA }} > CA_FILE
echo ${{ env.CA_FILE_BASE64_AB }} >> CA_FILE
base64 --decode CA_FILE > certificates/dod_CAs.pem
echo ${{ env.CERTIFICATE_KEY_FILE_BASE64 }} > CERTIFICATE_KEY_FILE
base64 --decode CERTIFICATE_KEY_FILE > certificates/mongodb.pem
- name: Run Packer
run: |
packer init mongo-hardening.pkr.hcl
packer build mongo-hardening.pkr.hcl
docker ps -a
docker image ls
packer build -var 'report={"report_to_heimdall":"${{ env.REPORT_TO_HEIMDALL }}","heimdall_url":"${{ env.HEIMDALL_URL }}","heimdall_api_key":"${{ env.HEIMDALL_API_KEY }}"}' mongo-validate.pkr.hcl
docker ps -a
- name: Save Scan Artifacts
uses: actions/upload-artifact@v4
with:
path: reports/*.json
if: always()