Merge pull request #157 from solarwinds/NH-89340

NH-89340: add scan as part of build and publish lambda layer
solarwinds · Sep 13, 2024 · 11d42fa · 11d42fa
2 parents 1123df0 + fcd7832
commit 11d42fa
Show file tree

Hide file tree

Showing 2 changed files with 50 additions and 10 deletions.
diff --git a/.github/workflows/build_publish_lambda_layer.yml b/.github/workflows/build_publish_lambda_layer.yml
@@ -65,6 +65,53 @@ jobs:
           name: ruby-layer-${{ matrix.arch }}.zip
           path: lambda/build/ruby-layer-${{ matrix.arch }}.zip
 
+  # extract the built layer from artifacts, then scan it with reverselab
+  reverselab_scan_layer:
+    needs:
+      - build_layer
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        arch:
+          - x86_64
+          - arm64
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: extract layer zip from artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: ruby-layer-${{ matrix.arch }}.zip
+          path: lambda
+
+      - name: extract current solarwinds_apm version
+        run: |
+          APM_VERSION=$(grep "gem 'solarwinds_apm'" lambda/otel/layer/Gemfile | awk -F"'" '{print $4}')
+          echo "SOLARWINDS_APM_VERSION=$APM_VERSION" >> $GITHUB_ENV
+
+      - name: Scan build artifact on the Portal ${{ matrix.arch }}
+        id: rl-scan
+
+        env:
+          RLPORTAL_ACCESS_TOKEN: ${{ secrets.REVERSE_LAB_TOKEN }}
+
+        uses: reversinglabs/gh-action-rl-scanner-cloud-only@v1
+        with:
+          artifact-to-scan: ./lambda/ruby-layer-${{ matrix.arch }}.zip
+          rl-verbose: true
+          rl-portal-server: solarwinds
+          rl-portal-org: SolarWinds
+          rl-portal-group: SaaS-Agents-SWO
+          rl-package-url: solarwinds-apm-ruby/apm-ruby-lambda-layer-${{ matrix.arch }}@${{ env.SOLARWINDS_APM_VERSION }}
+
+      - name: report the scan status
+        if: success() || failure()
+        run: |
+          echo "The status is: '${{ steps.rl-scan.outputs.status }}'"
+          echo "The description is: '${{ steps.rl-scan.outputs.description }}'"
+
   # extract the built layer from artifacts, then publish it based on region
   publish_layer:
     needs:
@@ -95,18 +142,10 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - if: ${{ inputs.publish-dest == 'staging' }}
-        name: use staging credentials
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          role-to-assume: ${{ secrets.LAMBDA_PUBLISHER_ARN_STAGING }}
-          aws-region: ${{ matrix.aws_region }}
-
-      - if: ${{ inputs.publish-dest == 'production' }}
-        name: use production credentials
+      - name: configure AWS ${{ inputs.publish-dest }} credential
         uses: aws-actions/configure-aws-credentials@v4
         with:
-          role-to-assume: ${{ secrets.LAMBDA_PUBLISHER_ARN_PROD }}
+          role-to-assume: ${{ inputs.publish-dest == 'production' && secrets.LAMBDA_PUBLISHER_ARN_PROD || inputs.publish-dest == 'staging' && secrets.LAMBDA_PUBLISHER_ARN_STAGING }}
           aws-region: ${{ matrix.aws_region }}
 
       - name: extract layer zip from artifacts

diff --git a/.gitignore b/.gitignore
@@ -47,6 +47,7 @@ appoptics.com
 test/clib/Makefile
 *.so
 *.o
+ext/oboe_metal/extconf_local.rb
 
 # test script
 install_gem.sh