splunk-security_content/.github/workflows/appinspect.yml

name: appinspect
on:
  pull_request_target:
    types: [opened, reopened, synchronize]
jobs:
  appinspect:
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository code
        uses: actions/checkout@v4
        with:
            ref: refs/pull/${{ github.event.pull_request.number }}/merge
       
      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'
          architecture: 'x64'
          
      - name: Install Python Dependencies and ContentCTL and Atomic Red Team
        run: |
          if [ -n "${{ vars.CONTENTCTL_VERSION }}" ]; then
            echo "Installing contentctl version ${{ vars.CONTENTCTL_VERSION }}"
            pip install contentctl==${{ vars.CONTENTCTL_VERSION }}
          else
            echo "Installing latest contentctl version"
            pip install contentctl
          fi
          git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git external_repos/atomic-red-team
          git clone --depth=1 --single-branch --branch=master https://github.com/mitre/cti external_repos/cti
      
      - name: Running appinspect with enrichments
        env:
          APPINSPECTUSERNAME: "${{ secrets.APPINSPECTUSERNAME }}"
          APPINSPECTPASSWORD: "${{ secrets.APPINSPECTPASSWORD }}"
        run: |
          echo $APPINSPECTUSERNAME
          contentctl inspect --splunk-api-username "$APPINSPECTUSERNAME" --splunk-api-password "$APPINSPECTPASSWORD" --enrichments --enable-metadata-validation --suppress-missing-content-exceptions
          echo "done appinspect"
          mkdir -p artifacts/app_inspect_report
          cp -r dist/*.html artifacts/app_inspect_report
          cp -r dist/*.tar.gz artifacts/

      - name: store_artifacts
        uses: actions/upload-artifact@v4
        with:
          name: content-latest
          path: |
            artifacts/DA-ESS-ContentUpdate-latest.tar.gz
            artifacts/app_inspect_report