From c5498ccb78d85fc194b0d04d24090ab6fe9750f4 Mon Sep 17 00:00:00 2001 From: Chris Christiansen Date: Wed, 2 Sep 2026 20:37:03 +0000 Subject: [PATCH] feat(tyr): add cloudbuild security gate configuration --- cloudbuild.yaml | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/cloudbuild.yaml b/cloudbuild.yaml index 3800abe..5f0a079 100644 --- a/cloudbuild.yaml +++ b/cloudbuild.yaml @@ -8,15 +8,21 @@ steps: - | pip install flake8 echo "--- Running static analysis on TYR tools ---" - flake8 tyr/tools/ + flake8 --ignore=E501,W291,W293 tyr/tools/ # Step 2: Run scan_tyr_surface.py to check GCP environment compliance. # NOTE: This step requires a custom build image with gcloud, python, the required # python libraries, and spire binaries installed. It also needs appropriate permissions. - name: 'gcr.io/google.com/cloudsdktool/cloud-sdk' # Placeholder image id: 'SurfaceScan' - entrypoint: 'python3' - args: ['tyr/tools/scan_tyr_surface.py'] + entrypoint: 'bash' + args: + - '-c' + - | + python3 -m venv /tmp/venv + source /tmp/venv/bin/activate + pip install google-cloud-secret-manager google-cloud-bigquery + python3 tyr/tools/scan_tyr_surface.py # Step 3: Run attest_tyr_supply_chain.py against a built container image. # NOTE: This step requires a custom build image with cosign. It would run after