main.yml

name: lacework-iac-example-ga

# Controls when the workflow will run

on:

  # Triggers the workflow on push or pull request events but only for the "main" branch

  push:

    branches: [ "main" ]

  pull_request:

    branches: [ "main" ]

  # Allows you to run this workflow manually from the Actions tab

  workflow_dispatch:

# A workflow run is made up of one or more jobs that can run sequentially or in parallel

jobs:

  # This workflow contains a single job called "build"

  build:

    # The type of runner that the job will run on

    runs-on: ubuntu-20.04

    # Steps represent a sequence of tasks that will be executed as part of the job

    steps:

      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it

      - name: Checkout Code

        uses: actions/checkout@v3

      - name: Create environment variables file
        run: |
          env | grep "GITHUB_\|LW_\|CI_" > env.list
          echo "LW_ACCOUNT=${{ secrets.LW_ACCOUNT }}" >> env.list
          echo "LW_API_KEY=${{ secrets.LW_API_KEY }}" >> env.list
          echo "LW_API_SECRET=${{ secrets.LW_API_SECRET }}" >> env.list
          echo "EXIT_FLAG=CRITICAL=1" >> env.list

      - name: Scan the repo for vulnerabilities in IaC
        run: |
          docker run \
            --env-file env.list \
            -v "$(pwd):/app/src" \
            lacework/codesec-iac:stable