Skip to content

Commit 278794a

Browse files
jacdavijacdavi
committed
Merge branch 'main' into managed_identity
2 parents 7374ae6 + f63305b commit 278794a

4 files changed

Lines changed: 80 additions & 10 deletions

File tree

‎.github/workflows/m365_image_build.yaml‎

Lines changed: 28 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,10 @@ env:
1616

1717
jobs:
1818
build:
19+
name: Build
20+
runs-on: windows-latest
21+
# This condition prevents duplicate runs.
22+
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
1923
# based on https://github.com/orgs/community/discussions/26253#discussioncomment-6745038
2024
# intent is to run on current ref, unless this is a scheduled run, then run on list defined below
2125
strategy:
@@ -29,7 +33,6 @@ jobs:
2933
- { scheduled: false }
3034
include:
3135
- ref: ${{ github.head_ref || github.ref_name }}
32-
runs-on: windows-latest
3336
permissions:
3437
contents: read
3538
packages: write
@@ -98,6 +101,7 @@ jobs:
98101
99102
docker build $docker_args m365/image
100103
echo "digest=$(docker images --no-trunc --quiet $Env:IMAGE.ToLower())" >> $Env:GITHUB_OUTPUT
104+
echo "image=$($Env:IMAGE.ToLower())" >> $Env:GITHUB_OUTPUT
101105
if ($Env:PUSH -eq "true") {
102106
docker push $Env:IMAGE.ToLower() --all-tags
103107
}
@@ -122,3 +126,26 @@ jobs:
122126
cosign sign --yes "$_@$digest"
123127
}
124128
exit 0
129+
outputs:
130+
image: ${{ steps.build-and-push.outputs.image }}
131+
scan:
132+
name: Scan
133+
# This condition prevents duplicate runs.
134+
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
135+
permissions:
136+
security-events: write
137+
needs: build
138+
runs-on: ubuntu-latest
139+
steps:
140+
- name: Run Trivy vulnerability scanner
141+
uses: aquasecurity/trivy-action@0.28.0
142+
with:
143+
image-ref: ${{ needs.build.outputs.image }}:latest
144+
format: 'sarif'
145+
output: 'trivy-results.sarif'
146+
147+
- name: Upload Trivy scan results to GitHub Security tab
148+
uses: github/codeql-action/upload-sarif@v3
149+
with:
150+
sarif_file: 'trivy-results.sarif'
151+
category: m365-image

‎.github/workflows/terraform_scan.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
name: Terraform Scan
2+
permissions:
3+
security-events: write
4+
on:
5+
push:
6+
branches: [ "*" ]
7+
pull_request:
8+
branches: [ "main" ]
9+
jobs:
10+
scan:
11+
name: Scan
12+
runs-on: ubuntu-latest
13+
# This condition prevents duplicate runs.
14+
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
15+
steps:
16+
- name: Checkout code
17+
uses: actions/checkout@v4
18+
19+
- name: Run Trivy vulnerability scanner in IaC mode
20+
uses: aquasecurity/trivy-action@0.28.0
21+
with:
22+
scan-type: 'config'
23+
hide-progress: true
24+
format: 'sarif'
25+
output: 'trivy-results.sarif'
26+
exit-code: '0'
27+
severity: 'CRITICAL,HIGH,MEDIUM'
28+
- name: Upload Trivy scan results to GitHub Security tab
29+
uses: github/codeql-action/upload-sarif@v3
30+
with:
31+
sarif_file: 'trivy-results.sarif'
32+
category: terraform

‎m365/image/Dockerfile‎

Lines changed: 19 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,34 @@
11
FROM mcr.microsoft.com/windows/servercore:ltsc2022
2+
SHELL ["powershell"]
3+
24

35
ARG SCUBAGEAR_VERSION=1.5.0
4-
# How URL is obtained for specific version:
6+
ARG OPA_VERSION=1.3.0
7+
# Get static URL for current version: curl -s -D- https://aka.ms/downloadazcopy-v10-windows | grep ^Location
58
# https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-v10?tabs=dnf#obtain-a-static-download-link
6-
ARG AZCOPY_URL=https://azcopyvnext-awgzd8g7aagqhzhe.b02.azurefd.net/releases/release-10.27.1-20241113/azcopy_windows_amd64_10.27.1.zip
9+
ARG AZCOPY_URL=https://azcopyvnext-awgzd8g7aagqhzhe.b02.azurefd.net/releases/release-10.29.0-20250428/azcopy_windows_amd64_10.29.0.zip
710

811
LABEL scubagear_version=${SCUBAGEAR_VERSION}
912

1013
WORKDIR /app
1114

1215
# download azcopy exe to workdir
13-
RUN powershell Invoke-WebRequest -Uri %AZCOPY_URL% -OutFile AzCopy.zip -UseBasicParsing
14-
RUN powershell Expand-Archive .\AzCopy.zip ./AzCopy -Force
15-
RUN powershell $item = Get-ChildItem .\AzCopy\*\azcopy.exe; Move-Item -Path $item -Destination .
16-
RUN powershell Remove-Item AzCopy.zip; Remove-Item -r .\AzCopy
16+
RUN $ProgressPreference = 'SilentlyContinue'; Invoke-WebRequest -Uri $Env:AZCOPY_URL -OutFile AzCopy.zip -UseBasicParsing
17+
RUN Expand-Archive .\AzCopy.zip ./AzCopy -Force
18+
RUN $item = Get-ChildItem .\AzCopy\*\azcopy.exe; Move-Item -Path $item -Destination .
19+
RUN Remove-Item AzCopy.zip; Remove-Item -r .\AzCopy
1720

1821
# Needed for setup module installs
19-
RUN powershell Install-PackageProvider -Name NuGet -Force
20-
RUN powershell Install-Module -Name ScubaGear -RequiredVersion %SCUBAGEAR_VERSION% -Force
21-
RUN powershell Initialize-SCuBA
22+
RUN Install-PackageProvider -Name NuGet -Force
23+
RUN Install-Module -Name ScubaGear -RequiredVersion $Env:SCUBAGEAR_VERSION -Force
24+
RUN Initialize-SCuBA -Scope AllUsers -NoOPA
2225
COPY run_container.ps1 .
2326

27+
# manually install OPA, grant ContainerUser execute permissions, then switch to user
28+
ENV OPA_NAME="opa_windows_amd64.exe"
29+
RUN $ProgressPreference = 'SilentlyContinue'; Invoke-WebRequest -Uri https://openpolicyagent.org/downloads/v$($Env:OPA_VERSION)/opa_windows_amd64.exe -OutFile $Env:OPA_NAME -UseBasicParsing
30+
RUN if ((Get-FileHash $Env:OPA_NAME -Algorithm SHA256).Hash -ne ([System.Text.Encoding]::ASCII.GetString((Invoke-WebRequest -Uri https://openpolicyagent.org/downloads/v$($Env:OPA_VERSION)/opa_windows_amd64.exe.sha256 -UseBasicParsing).Content) -split ' ')[0]) { exit 1 }
31+
RUN icacls.exe $env:OPA_NAME /grant 'User Manager\ContainerUser:RX'
32+
USER ContainerUser
33+
2434
CMD [ "powershell", ".\\run_container.ps1" ]

‎m365/image/run_container.ps1‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,7 @@ Foreach ($tenantConfig in $(Get-ChildItem 'input\')) {
7777
AppID = $Env:APP_ID; # App ID; Needed for Service Principal Auth
7878
Organization = $org; # primary domain of the tenantConfig needed for Service Principal Auth
7979
OutPath = ".\reports\$($org)"; # The folder path where the output will be stored
80+
OPAPath = "."
8081
ConfigFilePath = $tenantConfig.FullName
8182
Quiet = $true;
8283
}

0 commit comments

Comments
 (0)