302a309b9d
GE Aerospace now expects a Darkwing check on every repo. Two files rather than one, because they answer different questions and only one of them is ours. scan-darkwing-portable.yml is copied byte-for-byte from the ge-aero/darkwing README so it keeps matching the sanctioned integration. Manual dispatch only. scan-darkwing-pr.yml runs on pull requests and is ours to change. It exists because the README workflow cannot simply be given a pull_request trigger: it resolves its target as `inputs.target_ref || 'main'`, and a pull_request event carries no inputs, so the expression falls through to 'main' and the job scans the default branch instead of the code under review. That is a check that is green because it never looked. This one resolves the PR head SHA explicitly. Neither file gates a merge. Darkwing exits 0 whatever it finds, and its results vary between runs on identical code, so a passing job means the scan ran and nothing more. The SARIF-parsing step that would turn a finding into a failure is written but commented out, to be switched on once the false-positive rate on this codebase is known. Scope: product
33 lines
1.0 KiB
YAML
33 lines
1.0 KiB
YAML
# Darkwing vulnerability scan, manual dispatch.
|
|
#
|
|
# Copied verbatim from the ge-aero/darkwing README so it stays byte-identical
|
|
# to the sanctioned integration. Do not edit this file to add triggers or
|
|
# gating - see scan-darkwing-pr.yml for that, which is ours to change.
|
|
#
|
|
# The file must sit on the default branch before a scan can run on ANY branch.
|
|
name: Scan (darkwing, portable)
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
target_ref:
|
|
description: Ref, branch, or sha of this repo to scan
|
|
required: false
|
|
type: string
|
|
default: main
|
|
|
|
permissions:
|
|
contents: read # checkout this repo via the ambient GITHUB_TOKEN
|
|
security-events: write # SARIF upload to the Security tab
|
|
actions: read # required by upload-sarif on private/internal repos
|
|
|
|
jobs:
|
|
scan:
|
|
runs-on: darkwing-scan
|
|
steps:
|
|
# @v1 is a moving tag pointing to the latest release that is compatible
|
|
# with this workflow file.
|
|
- uses: ge-aero/darkwing@v1
|
|
with:
|
|
target_ref: ${{ inputs.target_ref || 'main' }}
|