update actions

mitre · Jul 8, 2024 · f5f8a5c · f5f8a5c
1 parent 88c35ff
commit f5f8a5c
Show file tree

Hide file tree

Showing 2 changed files with 38 additions and 45 deletions.
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -16,14 +16,13 @@ jobs:
       HEIMDALL_API_KEY: ${{ secrets.SAF_HEIMDALL_UPLOAD_KEY }}
       CA_FILE_BASE64_AA: ${{ secrets.CA_FILE_BASE64_AA }}
       CA_FILE_BASE64_AB: ${{ secrets.CA_FILE_BASE64_AB }}
-      CERTIFICATE_KEY_FILE_BASE64: ${{ secrets.CERTIFICATE_KEY_FILE_BASE64 }}
       CERTIFICATE_KEY_FILE: ${{ secrets.CERTIFICATE_KEY_FILE }}
 
     steps:
-      # - name: Add Dependencies
-      #   run: |
-      #     npm install -g @mitre/saf
-      #     curl -L https://omnitruck.cinc.sh/install.sh | sudo bash -s -- -P cinc-auditor
+      - name: Add Dependencies
+        run: |
+          npm install -g @mitre/saf
+          curl -L https://omnitruck.cinc.sh/install.sh | sudo bash -s -- -P cinc-auditor
 
       - name: Clone Repository
         uses: actions/checkout@v4
@@ -34,37 +33,31 @@ jobs:
           echo "${{ env.CA_FILE_BASE64_AB }}" >> CA_FILE
           base64 --decode CA_FILE > certificates/dod_CAs.pem
           echo "${{ env.CERTIFICATE_KEY_FILE }}" > certificates/mongodb.pem
-          cat certificates/mongodb.pem
-          cat certificates/dod_CAs.pem
 
-      - name: Display first 100 characters of CERTIFICATE_KEY_FILE
+      - name: Run Packer Hardening
         run: |
-          head -c 100 certificates/mongodb.pem
-
-      # - name: Run Packer Hardening
-      #   run: |
-      #     packer init mongo-hardening.pkr.hcl
-      #     packer build mongo-hardening.pkr.hcl
-
-      # - name: Log in to GitHub Container Registry
-      #   uses: docker/login-action@v2
-      #   with:
-      #     registry: ghcr.io
-      #     username: ${{ github.actor }}
-      #     password: ${{ secrets.GITHUB_TOKEN }}
+          packer init mongo-hardening.pkr.hcl
+          packer build mongo-hardening.pkr.hcl
 
-      # - name: Tag and Push Docker Image
-      #   run: |
-      #     docker tag mongo-hardened:latest ghcr.io/${{ github.repository_owner }}/mongo-hardened:latest
-      #     docker push ghcr.io/${{ github.repository_owner }}/mongo-hardened:latest
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
 
-      # - name: Run Packer Validation
-      #   run: |
-      #     packer build -var 'report={"report_to_heimdall":"${{ env.REPORT_TO_HEIMDALL }}","heimdall_url":"${{ env.HEIMDALL_URL }}","heimdall_api_key":"${{ env.HEIMDALL_API_KEY }}"}' mongo-validate.pkr.hcl
-      #     docker ps -a
+      - name: Tag and Push Docker Image
+        run: |
+          docker tag mongo-hardened:latest ghcr.io/${{ github.repository_owner }}/mongo-hardened:latest
+          docker push ghcr.io/${{ github.repository_owner }}/mongo-hardened:latest
 
-      # - name: Save Scan Artifacts
-      #   uses: actions/upload-artifact@v4
-      #   with:
-      #     path: reports/*.json
-      #   if: always()
+      - name: Run Packer Validation
+        run: |
+          packer build -var 'report={"report_to_heimdall":"${{ env.REPORT_TO_HEIMDALL }}","heimdall_url":"${{ env.HEIMDALL_URL }}","heimdall_api_key":"${{ env.HEIMDALL_API_KEY }}"}' mongo-validate.pkr.hcl
+          docker ps -a
+
+      - name: Save Scan Artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          path: reports/*.json
+        if: always()
diff --git a/mongo-validate.pkr.hcl b/mongo-validate.pkr.hcl
@@ -41,22 +41,22 @@ source "docker" "hardened" {
   commit      = false
   pull        = false
   discard     = true
-  run_command = [
-    "-d",
-    "--name", "${var.input_hardened_image.name}",
-    "{{.Image}}",
-  ]
   // run_command = [
   //   "-d",
   //   "--name", "${var.input_hardened_image.name}",
-  //   "-p", "27017:27017",
-  //   "-v", "mongodb_configdb:/data/configdb",
-  //   "-v", "mongodb_db:/data/db",
-  //   "-e", "PATH=/usr/local/src/openssl-3.1.0/apps:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
-  //   "-e", "LD_LIBRARY_PATH=/usr/local/src/openssl-3.1.0",
   //   "{{.Image}}",
-  //   "mongod", "--config", "/etc/mongod.conf"
   // ]
+  run_command = [
+    "-d",
+    "--name", "${var.input_hardened_image.name}",
+    "-p", "27017:27017",
+    "-v", "mongodb_configdb:/data/configdb",
+    "-v", "mongodb_db:/data/db",
+    "-e", "PATH=/usr/local/src/openssl-3.1.0/apps:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+    "-e", "LD_LIBRARY_PATH=/usr/local/src/openssl-3.1.0",
+    "{{.Image}}",
+    "mongod", "--config", "/etc/mongod.conf"
+  ]
 }
 
 # Run validation process