s1-cns-scan.yml

name: SentinelOne CNS Scan

on:
  workflow_call:
    inputs:
      policy_id:
        description: 'The S1 scan policy'
        type: string
        required: true
      scope_type:
        description: 'The scope in which the scan policy is configured'
        default: "ACCOUNT"
        type: string
      iac_enabled:
        description: 'Whether Iac scanning should be enabled'
        default: true
        type: boolean
      secrets_enabled:
        description: 'Whether secrets scanning should be enabled(It will run only on a pull_request event)'
        default: true
        type: boolean
      vuln_enabled:
        description: 'Whether vulnerability scanning should be enabled'
        default: true
        type: boolean
      skip_paths:
        description: 'Provide a space separated list of paths that need to be skipped during vulnerablity scanning'
        type: string
      vuln_fail:
        description: 'Fail the workflow if vulnerabilities are detected, default is false'
        type: boolean
        default: false
    secrets:
      S1_API_TOKEN:
        description: 'S1 API Token configured for scanning'
        required: true
      CONSOLE_URL:
        description: 'S1 Management consoloe URL'
        required: true
      SCOPE_ID:
        description: 'Scope ID from S1 console'
        required: true

jobs:
  s1-shift-left-cli:
    runs-on: ubuntu-latest
    container:
      # latest version v1.0.4 - update digest after checking the image when
      # new version comes out.
      image: pingsafe/s1-shift-left-cli@sha256:1bceb426867bd3389fcff6174d06e6bfee23f029903d8d006a52444e12867c06
      options: --entrypoint ""
    permissions:
      contents: read
    env:
      REPO_FULL_NAME: ${{ github.repository }}
      REPO_URL: ${{ github.server_url }}


    steps:
      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd  # v5
        with:
          ref: ${{ github.ref }}
          filter: tree:0
          fetch-depth: 0

      - name: Configure SentinelOne Shift Left CLI
        run: s1-cns-cli config --service-user-api-token "$S1_TOKEN" --management-console-url "$CONSOLE_URL" --scope-type "$SCOPE_TYPE" --scope-id "$SCOPE_ID" --policy-id "$POLICY_ID"
        env:
          S1_TOKEN: ${{ secrets.S1_API_TOKEN  }}
          CONSOLE_URL: ${{ secrets.CONSOLE_URL }}
          SCOPE_TYPE: ${{ inputs.scope_type }}
          SCOPE_ID: ${{ secrets.SCOPE_ID }}
          POLICY_ID: ${{ inputs.policy_id }}


      - name: Configure git config
        run: git config --global --add safe.directory "$PWD"

      - name: Run Secret Detector
        # Run only on pull requests as we've scans configured to run on pull requests and publish is
        # only available on pull requests.
        if: github.event_name  == 'pull_request' && inputs.secrets_enabled
        id: secret-detector
        continue-on-error: true
        run: s1-cns-cli scan secret -d "$PWD" --pull-request "$SRC" "$DEST" --repo-full-name "$REPO_FULL_NAME"  --repo-url "$REPO_URL/$REPO_FULL_NAME" --provider GITHUB --publish-result
        env:
          DEST: ${{ github.event.pull_request.base.sha }}
          SRC: ${{ github.event.pull_request.head.sha }}

      - name: Run IaC Scanner
        if: inputs.iac_enabled
        continue-on-error: true
        run: s1-cns-cli scan iac -d "$PWD" --repo-full-name "$REPO_FULL_NAME"  --repo-url "$REPO_URL/$REPO_FULL_NAME" --branch "$BRANCH" --provider GITHUB --publish-result
        id: iac-scanner
        env:
          BRANCH: ${{ github.head_ref || github.ref_name }}

      - name: Run Vulnerability Scanner
        if: inputs.vuln_enabled
        id: vuln-scanner
        continue-on-error: true
        run: |
          args=(--repo-full-name "$REPO_FULL_NAME" --repo-url "$REPO_URL/$REPO_FULL_NAME" --provider GITHUB --repository-type organization)
          if [ -n "$SKIP_PATHS" ]; then
            args+=(--skip-paths "$SKIP_PATHS")
          fi
          s1-cns-cli scan vuln "${args[@]}" -d "$PWD" --publish-result
        env:
          SKIP_PATHS: ${{ inputs.skip_paths }}

      - name: Check for failures
        if: (steps.secret-detector.outcome == 'failure' || steps.iac-scanner.outcome == 'failure') || ( steps.vuln-scanner.outcome == 'failure' && inputs.vuln_fail == true )
        run: exit 1