azure-ci.yml

name: CIS-AZURE-CI

on:
  workflow_dispatch:
    inputs:
  pull_request_target:
    branches:
      - main
      - "[0-9]+.[0-9]+"
    types: [opened, synchronize, reopened]

jobs:
  Run-CSPM-AZURE-Tests:
    name: CIS AZURE integration test
    if: false
    runs-on: ubuntu-22.04
    timeout-minutes: 60
    permissions:
      contents: 'read'
      id-token: 'write'
    steps:
      - name: Check out the repo
        uses: actions/checkout@v4

      - name: Init Hermit
        run: ./bin/hermit env -r >> $GITHUB_ENV

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.9'

      - name: Install Poetry
        run: |
          curl -sSL https://install.python-poetry.org | python3 -
          poetry --version

      - name: Build cloudbeat binary
        uses: magefile/mage-action@v3
        with:
          version: latest
          args: build

      - name: Run Elasticsearch
        uses: elastic/elastic-github-actions/elasticsearch@master
        with:
          stack-version: ${{ env.ELK_VERSION }}
          security-enabled: false

      - name: Run cloudbeat in background
        env:
          ES_HOST: http://localhost:9200
          ES_USERNAME: elastic
          ES_PASSWORD: changeme
          AZURE_ACCOUNT_TYPE: single-account
          AZURE_CREDENTIALS_TYPE: service_principal_with_client_secret
          AZURE_CLIENT_ID: ${{ secrets.AZURE_CREDENTIALS.clientId }}
          AZURE_TENANT_ID: ${{ secrets.AZURE_CREDENTIALS.tenantId }}
          AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CREDENTIALS.clientSecret }}
        run: |
          ./cloudbeat -c deploy/azure/cloudbeat-azure.yml -d '*' &

      - name: Check for findings
        working-directory: ./tests
        env:
          USE_K8S: false
        run: |
          poetry install
          poetry run pytest -k "azure" --alluredir=./allure/results/ --clean-alluredir --maxfail=4

      - name: Print cloudbeat logs
        if: always()
        run: |
          cat logs/cloudbeat*