splunk-security_content/.github/workflows/build.yml

name: build
on:
  pull_request:
    types: [opened, reopened, synchronize]
  push:
    branches:
      - develop
jobs:
  build:
    #Note that the CircleCI job used a Container.  The way to do this with Github Actions
    #is to first start up a Virtual Machine, then we can by following:
    # https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#jobsjob_idcontainer
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository code
        uses: actions/checkout@v4
       
      - uses: actions/setup-python@v5
        with:
          python-version: '3.11' #Available versions here - https://github.com/actions/python-versions/releases  easy to change/make a matrix/use pypy
          architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified

      
      - name: Install Python Dependencies and ContentCTL and Atomic Red Team
        run: |
          pip install contentctl
          git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git
      
      - name: Running build with enrichments
        run: |
          contentctl build --enrichments
          mkdir artifacts
          mv dist/DA-ESS-ContentUpdate-latest.tar.gz artifacts/

      - name: store_artifacts
        uses: actions/upload-artifact@v4
        with:
          name: content-latest
          path: |
            artifacts/DA-ESS-ContentUpdate-latest.tar.gz