main.yml

on:
  push:
    branches:
      - main
  workflow_dispatch:

jobs:
  harden_validate_mongodb:
    name: Harden and Validate MongoDB Container

    runs-on: ubuntu-latest

    env:
      REPORT_TO_HEIMDALL: true
      HEIMDALL_URL: https://heimdall-demo.mitre.org/evaluations
      HEIMDALL_API_KEY: ${{ secrets.SAF_HEIMDALL_UPLOAD_KEY }}

      REPORT_DIR: reports
      INSPEC_REPORT_FILENAME: mongo_inspec_results.json
      ATTESTATION_FILE: ${{ vars.ATTESTATION_FILE}}
      ATTESTED_INSPEC_FILE_NAME: mongo_inspec_results.json

      CA_FILE_BASE64_AA: ${{ secrets.CA_FILE_BASE64_AA }}
      CA_FILE_BASE64_AB: ${{ secrets.CA_FILE_BASE64_AB }}
      CERTIFICATE_KEY_FILE: ${{ secrets.CERTIFICATE_KEY_FILE }}
      INSPEC_INPUTS: ${{ secrets.INSPEC_INPUTS }}

    steps:
      - name: Add Dependencies
        run: |
          npm install -g @mitre/saf
          curl -L https://omnitruck.cinc.sh/install.sh | sudo bash -s -- -P cinc-auditor

      - name: Clone Repository
        uses: actions/checkout@v4

      - name: Move Certificates and Input files
        shell: bash
        run: |
          echo "${{ env.CA_FILE_BASE64_AA }}" > CA_FILE
          echo "${{ env.CA_FILE_BASE64_AB }}" >> CA_FILE
          base64 --decode CA_FILE > certificates/dod_CAs.pem
          echo "${{ env.CERTIFICATE_KEY_FILE }}" > certificates/mongodb.pem
          echo "${{ env.INSPEC_INPUTS }}" > spec/mongo-inspec-profile/inputs.yml
          echo '${{ env.ATTESTATION_FILE }}' | jq . > reports/attestation.json

      - name: Run Packer Hardening
        run: |
          packer init mongo-hardening.pkr.hcl
          packer build mongo-hardening.pkr.hcl

      - name: Run Packer Validation
        run: |
          packer build -var 'report={"report_to_heimdall":"${{ env.REPORT_TO_HEIMDALL }}","heimdall_url":"${{ env.HEIMDALL_URL }}","heimdall_api_key":"${{ env.HEIMDALL_API_KEY }}"}' -var 'attestation={"report_dir":"${{ env.REPORT_DIR }}","inspec_report_filename":"${{ env.INSPEC_REPORT_FILENAME }}","attestation_filename":"attestation.json","attested_inspec_filename":"${{ env.ATTESTED_INSPEC_FILE_NAME }}"}' mongo-validate.pkr.hcl

      - name: Get Docker Image Tag
        run: |
          if docker images | grep 'passed'; then
            echo "image_tag=passed" >> $GITHUB_ENV
          elif docker images | grep 'failed'; then
            echo "image_tag=failed" >> $GITHUB_ENV
          else
            echo "No suitable image found"
            exit 1
          fi

      - name: Log in to GitHub Container Registry
        uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Tag and Push Docker Image to GHCR
        run: |
          docker tag mongo-hardened:${{ env.image_tag }} ghcr.io/${{ github.repository_owner }}/mongo-hardened:${{ env.image_tag }}
          docker push ghcr.io/${{ github.repository_owner }}/mongo-hardened:${{ env.image_tag }}
        if: env.image_tag != ''

      - name: Save Scan Artifacts
        uses: actions/upload-artifact@v4
        with:
          path: reports/*.json
        if: always()