jit-security.yml

name: Workflows generated by the MVS plan
on:
  workflow_dispatch:
    inputs:
       client_payload:
          description: The Client payload
          required: true
jobs:
  enrich:
    if: fromJSON(github.event.inputs.client_payload).payload.workflow_job_name == 'enrich'
    runs-on: ubuntu-20.04
    steps:
    - name: enrichment
      uses: jitsecurity-controls/jit-github-action@v2.2
      with:
        docker_user: jit-bot
        docker_password: ${{fromJSON(github.event.inputs.client_payload).payload.container_registry_token}}
        
        security_control: ghcr.io/jitsecurity-controls/control-enrichment-slim:latest
        security_control_args: --path \${WORK_DIR:-.}
        
        dispatch_type: workflow
        context: ${{toJSON(fromJSON(github.event.inputs.client_payload).context)}}
        runner_setup: ${{toJSON(fromJSON(github.event.inputs.client_payload).context.job.runner.setup)}}

  secret-detection:
    if: fromJSON(github.event.inputs.client_payload).payload.workflow_job_name == 'secret-detection'
    runs-on: ubuntu-20.04
    steps:
    - name: gitleaks
      uses: jitsecurity-controls/jit-github-action@v2.2
      with:
        docker_user: jit-bot
        docker_password: ${{fromJSON(github.event.inputs.client_payload).payload.container_registry_token}}
        
        security_control: ghcr.io/jitsecurity-controls/control-gitleaks-alpine:latest
        security_control_args: detect --config \$GITLEAKS_CONFIG_FILE_PATH --source \${WORK_DIR:-.} -v --report-format json --report-path \$REPORT_FILE --redact --no-git --exit-code 0
        security_control_output_file: /tmp/report.json
        dispatch_type: workflow
        context: ${{toJSON(fromJSON(github.event.inputs.client_payload).context)}}
        runner_setup: ${{toJSON(fromJSON(github.event.inputs.client_payload).context.job.runner.setup)}}