splunk-security_content/.github/workflows/appinspect.yml

name: appinspect
on:
  pull_request_target:
  pull_request:
    types: [opened, reopened, synchronize]
  push:

jobs:
  appinspect:
    runs-on: ubuntu-latest
    steps:
      - name: Check out the repository code
        uses: actions/checkout@v4
       
      - uses: actions/setup-python@v5
        with:
          python-version: '3.11'
          architecture: 'x64'
          
      - name: Install Python Dependencies and ContentCTL and Atomic Red Team
        run: |
          pip install contentctl>=4.0.0
          git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git external_repos/atomic-red-team
          git clone --depth=1 --single-branch --branch=master https://github.com/mitre/cti external_repos/cti
      
      - name: Running appinspect with enrichments
        env:
          APPINSPECTUSERNAME: "${{ secrets.APPINSPECTUSERNAME }}"
          APPINSPECTPASSWORD: "${{ secrets.APPINSPECTPASSWORD }}"
        run: |
          echo $APPINSPECTUSERNAME
          contentctl inspect --splunk-api-username "$APPINSPECTUSERNAME" --splunk-api-password "$APPINSPECTPASSWORD" --stack_type victoria --enrichments --enable-metadata-validation
          echo "done appinspect"
          mkdir -p artifacts/app_inspect_report
          cp -r dist/*.html artifacts/app_inspect_report
          cp -r dist/*.tar.gz artifacts/

      - name: store_artifacts
        uses: actions/upload-artifact@v4
        with:
          name: content-latest
          path: |
            artifacts/DA-ESS-ContentUpdate-latest.tar.gz
            artifacts/app_inspect_report