diff --git a/.github/workflows/security-gate.yml b/.github/workflows/security-gate.yml new file mode 100644 index 0000000..fba53b1 --- /dev/null +++ b/.github/workflows/security-gate.yml @@ -0,0 +1,32 @@ +name: Security Gate - Instriq + +on: + push: + branches: + - main + +jobs: + build: + runs-on: ubuntu-latest + env: + MAX_CRITICAL: 0 + MAX_HIGH: 0 + MAX_MEDIUM: 0 + MAX_LOW: 0 + GITHUB_TOKEN: ${{ secrets.TOKEN }} + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Pull Docker image from GitHub Container Registry + run: docker pull ghcr.io/instriq/security-gate/security-gate:latest + + - name: Verify security alerts from dependabot + run: | + docker run ghcr.io/instriq/security-gate/security-gate:latest \ + -t $GITHUB_TOKEN \ + -r ${{ github.repository }} \ + --critical $MAX_CRITICAL \ + --high $MAX_HIGH \ + --medium $MAX_MEDIUM \ + --low $MAX_LOW