Skip to content

update actions

update actions #154

Workflow file for this run

on:
push:
branches:
- main
workflow_dispatch:
jobs:
harden_validate_mongodb:
name: Harden and Validate MongoDB Container
runs-on: ubuntu-latest
env:
REPORT_TO_HEIMDALL: true
HEIMDALL_URL: https://heimdall-demo.mitre.org/evaluations
HEIMDALL_API_KEY: ${{ secrets.SAF_HEIMDALL_UPLOAD_KEY }}
CA_FILE_BASE64_AA: ${{ secrets.CA_FILE_BASE64_AA }}
CA_FILE_BASE64_AB: ${{ secrets.CA_FILE_BASE64_AB }}
CERTIFICATE_KEY_FILE: ${{ secrets.CERTIFICATE_KEY_FILE }}
INSPEC_INPUTS: ${{ secrets.INSPEC_INPUTS }}
steps:
- name: Add Dependencies
run: |
npm install -g @mitre/saf
curl -L https://omnitruck.cinc.sh/install.sh | sudo bash -s -- -P cinc-auditor
- name: Clone Repository
uses: actions/checkout@v4
- name: Move Certificates and Input file
shell: bash
run: |
printf "%s" "${{ env.CA_FILE_BASE64_AA }}" > CA_FILE
printf "%s" "${{ env.CA_FILE_BASE64_AB }}" >> CA_FILE
base64 --decode CA_FILE > certificates/dod_CAs.pem
printf "%s" "${{ env.CERTIFICATE_KEY_FILE }}" > certificates/mongodb.pem
printf "%s" "${{ env.INSPEC_INPUTS }}" > spec/mongo-inspec-profile/inputs.yml
- name: Run Packer Hardening
run: |
packer init mongo-hardening.pkr.hcl
packer build mongo-hardening.pkr.hcl
- name: Log in to GitHub Container Registry
uses: docker/login-action@v2
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Tag and Push Docker Image
run: |
docker tag mongo-hardened:latest ghcr.io/${{ github.repository_owner }}/mongo-hardened:latest
docker push ghcr.io/${{ github.repository_owner }}/mongo-hardened:latest
- name: Run Packer Validation
run: |
packer build -var 'report={"report_to_heimdall":"${{ env.REPORT_TO_HEIMDALL }}","heimdall_url":"${{ env.HEIMDALL_URL }}","heimdall_api_key":"${{ env.HEIMDALL_API_KEY }}"}' mongo-validate.pkr.hcl
docker ps -a
- name: Save Scan Artifacts
uses: actions/upload-artifact@v4
with:
path: reports/*.json
if: always()