chris/OSVauco
1
0
Fork 0
Code Issues 1 Pull Requests Actions 2 Packages Projects Releases Wiki Activity

feat(tyr): add cloudbuild security gate configuration

Browse Source
This commit is contained in:
Chris Christiansen 2026-09-02 20:37:03 +00:00
parent e865d817cc
commit c5498ccb78
1 changed files with 9 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
cloudbuild.yaml
View File

@ -8,15 +8,21 @@ steps:
- | - |
pip install flake8 pip install flake8
echo "--- Running static analysis on TYR tools ---" echo "--- Running static analysis on TYR tools ---"
flake8 tyr/tools/ flake8 --ignore=E501,W291,W293 tyr/tools/
# Step 2: Run scan_tyr_surface.py to check GCP environment compliance. # Step 2: Run scan_tyr_surface.py to check GCP environment compliance.
# NOTE: This step requires a custom build image with gcloud, python, the required # NOTE: This step requires a custom build image with gcloud, python, the required
# python libraries, and spire binaries installed. It also needs appropriate permissions. # python libraries, and spire binaries installed. It also needs appropriate permissions.
- name: 'gcr.io/google.com/cloudsdktool/cloud-sdk' # Placeholder image - name: 'gcr.io/google.com/cloudsdktool/cloud-sdk' # Placeholder image
id: 'SurfaceScan' id: 'SurfaceScan'
entrypoint: 'python3' entrypoint: 'bash'
args: ['tyr/tools/scan_tyr_surface.py'] args:
- '-c'
- |
python3 -m venv /tmp/venv
source /tmp/venv/bin/activate
pip install google-cloud-secret-manager google-cloud-bigquery
python3 tyr/tools/scan_tyr_surface.py
# Step 3: Run attest_tyr_supply_chain.py against a built container image. # Step 3: Run attest_tyr_supply_chain.py against a built container image.
# NOTE: This step requires a custom build image with cosign. It would run after # NOTE: This step requires a custom build image with cosign. It would run after