cimon-action/action.yml at main · CycodeLabs/cimon-action · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
name: Cimon by Cycode
description: Runtime Security Solution for your CI/CD Pipeline
branding:
  icon: shield
  color: green
author: CycodeLabs
inputs:
  client-id:
    description: Cimon client ID for authentication
    required: false
  secret:
    description: Cimon secret for authentication
    required: false
  url:
    description: Cimon endpoint for authentication
    required: false
  prevent:
    description: Enable prevention mode
    required: true
    default: 'false'
  allowed-ips:
    description: A comma-separated list of allowed IP addresses
    required: false
  allowed-hosts:
    description: A comma-separated list of domain names
    required: false
  file-integrity:
    description: Enable file integrity module in prevent mode
    required: false
    default: 'false'
  memory-protection:
    description: Enable memory protection module in prevent mode
    required: false
    default: 'false'
  ignored-ip-nets:
    description: |
      A comma or white space separated list of ignored IP networks in CIDR
      notation, e.g. 10.0.0.0/8, 172.16.0.0/12. This setting is mandatory if
      your workflow runs containers attached to a custom network with
      configured sub-range. In other words, inter-container networking is
      usually ignored by Cimon. Cimon implicitly ignores 10.0.0.0/8 and
      172.16.0.0/12 networks.
    required: false
  github-token:
    description: GitHub token for enriching build information
    required: false
    default: ${{ github.token }}
  report-job-summary:
    description: Report results through job summary output
    required: false
    default: 'true'
  report-pr-summary:
    description: Report results through PR comment
    required: false
    default: 'false'
  report-process-tree:
    description: Enable to report the process tree
    required: false
    default: 'false'
  slack-webhook-endpoint:
    description: Slack webhook endpoint to report security events
    required: false
  apply-fs-events:
    description: Enable processing filesystem events and display them in the process tree report
    required: false
    default: 'false'
  log-level:
    description: Log level (Used for debugging)
    required: false
    default: 'info'
  feature-gates:
    description: Set of key=value pairs that describe Cimon features.
    required: false
  fail-on-error:
    description: Fail the CI if Cimon encountered an error
    required: false
    default: 'false'
  release-path:
    description: Path to Cimon release file (Used for debugging)
    required: false
    default: ''
  hardening:
    description: |
      Enable hardening rules engine to detect/prevent CI/CD supply chain attacks
      (base64-decode-exec, credential theft, typosquatting, etc.).
      Combine with prevent=true for active blocking.
    required: false
    default: 'false'
  hardening-tier:
    description: |
      Maximum hardening tier to enable:
      1 = critical rules only (Tier 1)
      2 = critical + high impact (Tier 1+2, default)
      3 = all rules including defense-in-depth (Tier 1+2+3)
    required: false
    default: '2'
  hardening-disabled-rules:
    description: Comma-separated list of hardening rule IDs to disable
    required: false

runs:
  using: node20
  main: 'dist/main/index.js'
  post: 'dist/post/index.js'