pci-dss-page-tampering/.github/workflows/inventory-and-detection.yml at main · mr-yum/pci-dss-page-tampering · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
name: Run inventory and detection

on:
  workflow_dispatch:
    inputs:
      target:
        description: 'Specific target to process (leave empty for all targets)'
        required: false
        type: string
      mode:
        description: 'Execution mode'
        required: false
        default: 'all'
        type: choice
        options:
          - all
          - inventory
          - detection
  schedule:
    # Run daily at 12:00 PM UTC, night time in Sydney/Melbourne
    - cron: '0 12 * * *'
  push:
    branches: ['main']

jobs:
  run-inventory-and-detection:
    runs-on: ubuntu-latest

    strategy:
      fail-fast: true
      matrix:
        node-version: [24.x]

    steps:
      - name: Checkout code
        uses: actions/checkout@v6

      - name: Validate required secrets
        run: |
          [ -n "${{ secrets.INVENTORY_REPO_PAT }}" ] || { echo "INVENTORY_REPO_PAT secret is missing"; exit 1; }
          [ -n "${{ secrets.SLACK_OAUTH_TOKEN }}" ] || { echo "SLACK_OAUTH_TOKEN secret is missing"; exit 1; }
          [ -n "${{ vars.INVENTORY_REPO_URL }}" ] || { echo "INVENTORY_REPO_URL variable is missing"; exit 1; }

      - name: Use Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v6
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'npm'

      - name: Install dependencies
        run: |
          echo "📦 Installing dependencies..."
          npm ci
          echo "✅ Dependencies installed successfully"

      - name: Install Chrome dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y \
            ca-certificates \
            fonts-liberation \
            libappindicator3-1 \
            libatk-bridge2.0-0 \
            libatk1.0-0 \
            libc6 \
            libcairo2 \
            libcups2 \
            libdbus-1-3 \
            libexpat1 \
            libfontconfig1 \
            libgbm1 \
            libgcc1 \
            libglib2.0-0 \
            libgtk-3-0 \
            libnspr4 \
            libnss3 \
            libpango-1.0-0 \
            libpangocairo-1.0-0 \
            libstdc++6 \
            libx11-6 \
            libx11-xcb1 \
            libxcb1 \
            libxcomposite1 \
            libxcursor1 \
            libxdamage1 \
            libxext6 \
            libxfixes3 \
            libxi6 \
            libxrandr2 \
            libxrender1 \
            libxss1 \
            libxtst6 \
            lsb-release \
            wget \
            xdg-utils

      - name: Run PCI DSS detection
        timeout-minutes: 30
        run: |
          echo "▶️ Running PCI DSS Page Tampering Detection..."

          # Build CLI arguments
          CLI_ARGS="--repo ${{ vars.INVENTORY_REPO_URL }}"
          CLI_ARGS="$CLI_ARGS --git-token ${{ secrets.INVENTORY_REPO_PAT }}"
          CLI_ARGS="$CLI_ARGS --slack-token ${{ secrets.SLACK_OAUTH_TOKEN }}"
          CLI_ARGS="$CLI_ARGS --git-user-name '${{ vars.GIT_USER_NAME }}'"
          CLI_ARGS="$CLI_ARGS --git-user-email '${{ vars.GIT_USER_EMAIL }}'"

          # Add mode (default: all for scheduled runs)
          MODE="${{ github.event.inputs.mode || 'all' }}"
          CLI_ARGS="$CLI_ARGS --mode $MODE"

          # Add target if specified (for workflow_dispatch)
          TARGET="${{ github.event.inputs.target }}"
          if [ -n "$TARGET" ]; then
            CLI_ARGS="$CLI_ARGS --target $TARGET"
          fi

          echo "Executing: npm start -- $CLI_ARGS"
          npm start -- $CLI_ARGS

          echo "✅ PCI DSS detection completed successfully"