scan_deployed_image.yml

name: Scan Deployed Image

on:
  schedule:
    - cron: "0 6 * * *" # 2300 PST, 0200 EST

env:
  AWS_DEFAULT_REGION: us-west-2
  SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
  GIT_HASH: ${{ github.event.pull_request.head.sha || github.sha }}

jobs:
  rescan_deployed_image:
    if: ${{ false }} # Disabled until we have a deployed image to scan
    runs-on: ubuntu-latest
    steps:
      - name: Check out code
        uses: actions/checkout@v3
        with:
          ref: ${{ env.GIT_HASH }}
      - name: Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v2.1.0
        with:
          aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
          aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
          aws-region: us-west-2
      - name: Check deployed image for vulnerability findings - impl
        env:
          APP_ENV: impl
        run: bash ./scripts/check_deployed_image_findings "easi-backend" "7"
      - name: Check deployed image for vulnerability findings - prod
        env:
          APP_ENV: prod
        run: bash ./scripts/check_deployed_image_findings "easi-backend" "7"
      - name: Announce failure
        if: ${{ failure() }}
        run: ./scripts/github-action-announce-broken-branch