stackql-audit-action/docs/examples/google-only-audit-workflow-dispatch.yml at main · stackql/stackql-audit-action · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
# Copy this into .github/workflows/gcp-audit.yml in your repo.
#
# Setup:
#   1. Add a repo secret named GCP_SA_JSON containing the JSON of a GCP
#      service account with read-only audit permissions on the target project.
#   2. Trigger via the Actions tab → "GCP Audit" → Run workflow.
#
# Pin the action to a tag or commit SHA for reproducibility, e.g.
#   uses: stackql/stackql-audit-action@v0.1

name: GCP Audit

on:
  workflow_dispatch:
    inputs:
      project-id:
        description: GCP project ID to audit
        required: true
      fail-on-severity:
        description: Severity threshold to fail on (CRITICAL/HIGH/MEDIUM/LOW/NONE)
        required: false
        default: HIGH
      upload-logs:
        description: Upload per-invocation stackql logs as an artifact (for debugging)
        required: false
        default: 'false'

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: stackql/stackql-audit-action@v0.1
        with:
          gcp-project-id: ${{ inputs.project-id }}
          gcp-credentials: ${{ secrets.GCP_SA_JSON }}
          fail-on-severity: ${{ inputs.fail-on-severity }}
          upload-logs: ${{ inputs.upload-logs }}
          # Retention for the logs artifact, in days. 0 = repository default; max 90.
          log-retention-days: '7'