main.yml

on:
  push:
    branches:
      - main
  workflow_dispatch:

jobs:
  my_job:
    name: Harden MongoDB Container
    runs-on: ubuntu-latest
    env:
      REPORT_TO_HEIMDALL: "true"
      HEIMDALL_URL: "https://heimdall-demo.mitre.org/evaluations"
      HEIMDALL_API_KEY: ${{ secrets.SAF_HEIMDALL_UPLOAD_KEY }}
    steps:
      - name: Add Dependencies
        run: |
          sudo apt-get update
          curl -fsSL https://get.docker.com -o get-docker.sh
          curl -fsSL https://apt.releases.hashicorp.com/gpg | sudo apt-key add -
          sudo apt-add-repository "deb [arch=amd64] https://apt.releases.hashicorp.com $(lsb_release -cs) main"
          sudo apt-get update && sudo apt-get install packer
          python3 -m pip install --user ansible
          python3 -m pip install --upgrade --user ansible
          npm install -g @mitre/saf
          curl -L https://omnitruck.cinc.sh/install.sh | sudo bash -s -- -P cinc-auditor

      - name: Clone Repository
        uses: actions/checkout@v4

      - name: Run Packer
        run: |
          packer init mongo-hardening.pkr.hcl
          packer build mongo-hardening.pkr.hcl
          packer build -var "report_to_heimdall=${{env.REPORT_TO_HEIMDALL}}" -var "heimdall_url=${{ env.HEIMDALL_URL }}" -var "heimdall_api_key=${{ env.HEIMDALL_API_KEY }}" mongo-validate.pkr.hcl

      - name: Save Scan Artifacts
        uses: actions/upload-artifact@v4
        with:
          path: reports/*.json
        if: always()