Chris Christiansen
9fcb9c354a
Some checks are pending
Check Python Version Consistency / Check Python Version (push) Waiting to run
36 lines
1.4 KiB
YAML
36 lines
1.4 KiB
YAML
steps:
|
|
# Step 1: Run static analysis and linting on Python tool scripts.
|
|
- name: 'python:3.9-slim'
|
|
id: 'StaticAnalysis'
|
|
entrypoint: 'bash'
|
|
args:
|
|
- '-c'
|
|
- |
|
|
pip install flake8
|
|
echo "--- Running static analysis on TYR tools ---"
|
|
flake8 --ignore=E501,W291,W293 tyr/tools/
|
|
|
|
# Step 2: Run scan_tyr_surface.py to check GCP environment compliance.
|
|
# NOTE: This step requires a custom build image with gcloud, python, the required
|
|
# python libraries, and spire binaries installed. It also needs appropriate permissions.
|
|
- name: 'gcr.io/google.com/cloudsdktool/cloud-sdk' # Placeholder image
|
|
id: 'SurfaceScan'
|
|
entrypoint: 'bash'
|
|
args:
|
|
- '-c'
|
|
- |
|
|
python3 -m venv /tmp/venv
|
|
source /tmp/venv/bin/activate
|
|
pip install google-cloud-secret-manager google-cloud-bigquery
|
|
python3 tyr/tools/scan_tyr_surface.py
|
|
|
|
# Step 3: Run attest_tyr_supply_chain.py against a built container image.
|
|
# NOTE: This step requires a custom build image with cosign. It would run after
|
|
# a container image is built and pushed in a real pipeline.
|
|
- name: 'gcr.io/google.com/cloudsdktool/cloud-sdk' # Placeholder image
|
|
id: 'SupplyChainAttestation'
|
|
entrypoint: 'python3'
|
|
args:
|
|
- 'tyr/tools/attest_tyr_supply_chain.py'
|
|
- '--image_uri=${_IMAGE_URI}' # Assumes image URI is passed as a substitution
|