diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 04dc497b..054630dc 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -91,6 +91,7 @@ jobs: replace-symbol: ${{ github.event.inputs.replace-symbol || '_'}} build: + if: ${{ needs.prepare.outputs.components != '[]' || (github.event_name == 'workflow_dispatch' || github.event_name == 'release') }} name: ${{ matrix.component.name }} Image Build needs: [prepare] runs-on: ubuntu-22.04 diff --git a/.github/workflows/run_hardering_tests.yaml b/.github/workflows/run_hardering_tests.yaml new file mode 100644 index 00000000..bdb8d4ad --- /dev/null +++ b/.github/workflows/run_hardering_tests.yaml @@ -0,0 +1,66 @@ +name: Run Hardening Tests + +permissions: + contents: read + packages: read + actions: read + +on: + push: + branches: + - "main" + paths-ignore: + - "docs/**" + - "CODE-OF-CONDUCT.md" + - "CONTRIBUTING.md" + - "LICENSE" + - "README.md" + - "SECURITY.md" + pull_request: + branches: + - "**" + paths-ignore: + - "docs/**" + - "CODE-OF-CONDUCT.md" + - "CONTRIBUTING.md" + - "LICENSE" + - "README.md" + - "SECURITY.md" + workflow_dispatch: + inputs: + publish_docker: + description: "Publish images to ghcr.io/netcracker" + type: boolean + default: false + required: false + +jobs: + Wait-for-images: + runs-on: ubuntu-latest + strategy: + fail-fast: false + matrix: + workflow_name: + - build.yaml + steps: + - name: Wait for ${{ matrix.workflow_name }} + uses: netcracker/qubership-workflow-hub/actions/wait-for-workflow@3e428f45132119ce49d90f3770a45d4fe1d1078d + with: + workflow: ${{ matrix.workflow_name }} + token: ${{ secrets.GITHUB_TOKEN }} + poll-interval: 20 + Hardening-Tests: + if: ${{ github.actor != 'dependabot[bot]' && github.event.pull_request.user.login != 'dependabot[bot]' }} + needs: Wait-for-images + uses: Netcracker/qubership-test-pipelines/.github/workflows/pgskipper.yaml@feature/apps-hardening-scan + with: + repository_name: ${{ github.repository }} + service_branch: '${{ github.head_ref || github.ref_name }}' + pipeline_branch: 'feature/apps-hardening-scan' #this value must match the value after '@' in 'uses' + skip_tests: false + scope: 'hardening' + secrets: + AWS_S3_ACCESS_KEY_ID: ${{secrets.AWS_S3_ACCESS_KEY_ID}} + AWS_S3_ACCESS_KEY_SECRET: ${{secrets.AWS_S3_ACCESS_KEY_SECRET}} + +