cnvm-ci.yml

name: CNVM-CI

on:
  pull_request_target:
    branches:
      - main
      - "[0-9]+.[0-9]+"
    types: [opened, synchronize, reopened]

jobs:
  Run-CNVM-Tests:
    name: CNVM integration test
    runs-on: ubuntu-22.04
    timeout-minutes: 40
    steps:
      - name: Check out the repo
        uses: actions/checkout@v3

      - name: Init Hermit
        run: ./bin/hermit env -r >> $GITHUB_ENV

      - name: Set up Python
        uses: actions/setup-python@v4
        with:
          python-version: '3.9'

      - name: Install Poetry
        run: |
          curl -sSL https://install.python-poetry.org | python3 -
          poetry --version

      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v2
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: 'us-east-2'

      - name: Build cloudbeat binary
        uses: magefile/mage-action@v2
        with:
          version: latest
          args: build

      - name: Run Elasticsearch
        uses: elastic/elastic-github-actions/elasticsearch@master
        with:
          stack-version: 8.8.0
          security-enabled: false

      - name: Run cloudbeat CNVM in background
        env:
          ES_HOST: http://localhost:9200
          ES_USERNAME: elastic
          ES_PASSWORD: changeme
        run: |
          ./cloudbeat -c deploy/vulnerability/cloudbeat-vuln-mgmt.yml -d '*' &

      - name: Check for vulnerabilities
        working-directory: ./tests
        env:
          USE_K8S: false
        run: |
          poetry install
          poetry run pytest -k "cnvm"

      - name: Print cloudbeat logs
        if: always()
        run: |
          cat logs/cloudbeat*