codescan-analysis.yml

# This workflow requires that you have an existing account with codescan.io
# For more information about configuring your workflow,
# read our documentation at https://github.com/codescan-io/codescan-scanner-action
name: CodeScan

on:
  push:
    branches: [ master ]
  pull_request:
    # The branches below must be a subset of the branches above
    branches: [ master ]
  schedule:
    - cron: '34 20 * * 1'

jobs:
    CodeScan:
        runs-on: ubuntu-latest
        steps:
            -   name: Checkout repository
                uses: actions/checkout@v2
            -   name: Cache files
                uses: actions/cache@v2
                with:
                    path: |
                        ~/.sonar
                    key: ${{ runner.os }}-sonar
                    restore-keys: ${{ runner.os }}-sonar
            -   name: Run Analysis
                uses: codescan-io/codescan-scanner-action@master
                with:
                    login: ${{ secrets.CODESCAN_AUTH_TOKEN }}
                    organization: ${{ secrets.CODESCAN_ORGANIZATION_KEY }}
                    projectKey: ${{ secrets.CODESCAN_PROJECT_KEY }}
            -   name: Upload SARIF file
                uses: github/codeql-action/upload-sarif@v1
                with:
                    sarif_file: codescan.sari
- name: Vault Secrets

  # You may pin to the exact commit or the version.

  # uses: hashicorp/vault-action@d5a69ceca1c3867700c32135c0da4788efdd2c0e

  uses: hashicorp/vault-action@v2.3.1

  with:

    # The URL for the vault endpoint

    url: 

    # A semicolon-separated list of secrets to retrieve. These will automatically be converted to environmental variable keys. See README for more details

    secrets: 

    # The Vault namespace from which to query secrets. Vault Enterprise only, unset by default

    namespace: # optional

    # The method to use to authenticate with Vault.

    method: # optional, default is token

    # Vault role for specified auth method

    role: # optional

    # Custom Vault path, if the auth method was mounted at a different path

    path: # optional

    # The Vault Token to be used to authenticate with Vault

    token: # optional

    # The Role Id for App Role authentication

    roleId: # optional

    # The Secret Id for App Role authentication

    secretId: # optional

    # The Github Token to be used to authenticate with Vault

    githubToken: # optional

    # The path to the Kubernetes service account secret

    kubernetesTokenPath: # optional, default is /var/run/secrets/kubernetes.io/serviceaccount/token

    # The JSON payload to be sent to Vault when using a custom authentication method.

    authPayload: # optional

    # A string of newline separated extra headers to include on every request.

    extraHeaders: # optional

    # Whether or not export secrets as environment variables.

    exportEnv: # optional, default is true

    # Whether or not export Vault token as environment variables.

    exportToken: # optional, default is false

    # Base64 encoded CA certificate to verify the Vault server certificate.

    caCertificate: # optional

    # Base64 encoded client certificate for mTLS communication with the Vault server.

    clientCertificate: # optional

    # Base64 encoded client key for mTLS communication with the Vault server.

    clientKey: # optional

    # When set to true, disables verification of the Vault server certificate.  Setting this to true in production is not recommended.

    tlsSkipVerify: # optional, default is false

    # Base64 encoded Private key to sign JWT

    jwtPrivateKey: # optional

    # Password for key stored in jwtPrivateKey (if needed)

    jwtKeyPassword: # optional

    # Time in seconds, after which token expires

    jwtTtl: # optional, default is 3600