mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
pyth0n1c
108 lines
4.3 KiB
YAML
108 lines
4.3 KiB
YAML
name: detection-testing
|
|
on:
|
|
push:
|
|
pull_request:
|
|
types: [opened, reopened]
|
|
jobs:
|
|
|
|
validate-tag-if-present:
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: TAGGED, Validate that the tag is in the correct format
|
|
|
|
run: |
|
|
echo "The GITHUB_REF: $GITHUB_REF"
|
|
#First check to see if the release is a tag
|
|
if [[ $GITHUB_REF =~ refs/tags/* ]]; then
|
|
#Yes, this is a tag, so we need to test to make sure that the tag
|
|
#is in the correct format (like v1.10.20)
|
|
if [[ $GITHUB_REF =~ refs/tags/v[0-9]+.[0-9]+.[0-9]+ ]]; then
|
|
echo "PASS: Tagged release with good format"
|
|
exit 0
|
|
else
|
|
echo "FAIL: Tagged release with bad format"
|
|
exit 1
|
|
fi
|
|
else
|
|
echo "PASS: Not a tagged release"
|
|
exit 0
|
|
fi
|
|
|
|
quit-for-dependabot:
|
|
runs-on: ubuntu-latest
|
|
if: github.actor != 'dependabot[bot]' && github.actor != 'dependabot-preview[bot]'
|
|
steps:
|
|
- name: "Placeholder"
|
|
run: |
|
|
echo "yes it ran"
|
|
|
|
|
|
detection-testing:
|
|
runs-on: ubuntu-latest
|
|
environment: Detection-Testing-Approval
|
|
needs: [validate-tag-if-present, quit-for-dependabot]
|
|
steps:
|
|
|
|
- name: Checkout Repo
|
|
uses: actions/checkout@v2
|
|
|
|
|
|
#The following branch name only works (and is only used) for a push
|
|
#to a branch. We used a different method for getting the source branch
|
|
#from a PR
|
|
- name: Get branch and PR required for detection testing main.py
|
|
id: vars
|
|
run: |
|
|
echo "::set-output name=branch::${GITHUB_REF#refs/heads/}"
|
|
|
|
- name: Install System Packages
|
|
run: |
|
|
sudo apt update -qq
|
|
sudo apt install jq -qq
|
|
|
|
- uses: actions/setup-python@v2
|
|
with:
|
|
python-version: '3.9' #Available versions here - https://github.com/actions/python-versions/releases easy to change/make a matrix/use pypy
|
|
architecture: 'x64' # optional x64 or x86. Defaults to x64 if not specified
|
|
|
|
- name: Install Python Dependencies
|
|
run: |
|
|
#Get the virtualenv set up
|
|
cd automated_detection_testing/ci/python_ci_code
|
|
rm -rf venv
|
|
python3 -m venv --clear venv
|
|
source venv/bin/activate
|
|
python3 -m pip install --upgrade pip
|
|
python3 -m pip install wheel
|
|
python3 -m pip install -q -r requirements.txt
|
|
|
|
|
|
#Set up credentials in the environment so that boto will be able to find them
|
|
- uses: aws-actions/configure-aws-credentials@v1
|
|
with:
|
|
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
|
|
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
|
|
#Right now the script is hard coded to EU because of the dev who originally wrote it...
|
|
#probably change that arg to None and set here?
|
|
aws-region: us-west-1 #assume we will always use this, could make this an environment variable...
|
|
|
|
- name: Run Detection testing
|
|
timeout-minutes: 120
|
|
run: |
|
|
cd automated_detection_testing/ci/python_ci_code
|
|
source venv/bin/activate
|
|
|
|
echo "github.event.issue.pull_request : [${{ github.event.issue.pull_request }}]"
|
|
echo "github.event.pull_request.number : [${{ github.event.pull_request.number }}]"
|
|
echo "steps.vars.outputs.branch : [${{ steps.vars.outputs.branch }}]"
|
|
echo "github.event.pull_request.head.ref: [${{ github.event.pull_request.head.ref }}]"
|
|
|
|
if [[ ! -z "${{ github.event.pull_request.head.ref }}" && ! -z "${{ github.event.pull_request.number }}" ]]; then
|
|
echo "Pull request from source branch [${{ github.event.pull_request.head.ref }}] for PR number [${{ github.event.issue.number }}]"
|
|
python3 main.py -b ${{ github.event.pull_request.head.ref }} -pr ${{ github.event.pull_request.number }}
|
|
else
|
|
echo "Push from branch [${{ steps.vars.outputs.branch }}]"
|
|
python3 main.py -b ${{ steps.vars.outputs.branch }}
|
|
fi
|