Initial action

LICENSE.md

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2016-2021 Stelligent
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,54 @@
+# cfn-nag-sarif GitHub Action
+
+This action executes cfn_nag_scan linter against the repo for which the workflow is run and uploads the result to GitHub's Code Scanning
+
+For more background on the tool, chechout [cfn_nag repo](https://github.com/stelligent/cfn_nag).
+
+## Usage
+Scan all the cloudformation templates in `templates` on the default branch. Replace `$default-branch` with the name of the default branch in your repo.
+
+```
+name: cfn-nag
+
+on:
+  push:
+    branches: [ $default-branch ]
+  pull_request:
+    branches: [ $default-branch ]
+  schedule:
+    -cron: $cron-weekly
+
+jobs:
+  cfn-nag:
+    name: Run cfn-nag scan
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+
+    steps:
+      - name: Clone repo
+        uses: actions/checkout@v2
+
+      - name: Run cfn-nag
+        uses: stelligent/cfn-nag-sarif-action@v1
+        with:
+          input_path: templates
+```
+
+## Inputs
+
+### `input_path`
+
+The directory of the repo to search for violations. Default: `$GITHUB_WORKSPACE`
+
+### `extra_args`
+
+Additional arguments to pass to `cfn_nag_scan`. See the [usage for `cfn_nag_scan`](https://github.com/stelligent/cfn_nag#usage) for details. Default: ``
+
+## Support
+
+To report a bug or request a feature, submit an issue through the GitHub repository via: https://github.com/stelligent/cfn-nag-sarif-action/issues/new
+
+Pull requests are welcome as well: https://github.com/stelligent/cfn-nag-sarif-action/pulls

action.yml

@@ -0,0 +1,25 @@
+---
+name: 'cfn-nag-sarif-upload'
+author: 'Kevin Formsma'
+description: Execute cfn_nag_scan against the code in the repository and upload sarif results to code scanning.
+branding:
+  icon: search
+  color: orange
+inputs:
+  input_path:
+    description: 'Where cfn_nag_scan should scan for violations (default: $GITHUB_WORKSPACE).'
+    default: '.'
+  extra_args:
+    description: 'Additional arguments to pass to cfn_nag_scan, separated by space (default: "").'
+    default: ''
+runs:
+  using: "composite"
+  steps:
+    - uses: stelligent/cfn_nag@master
+      with:
+        input_path: '${{ inputs.input_path }}'
+        extra_args: '${{ inputs.extra_args }} -o sarif'
+        output_path: cfn_nag.sarif
+    - uses: github/codeql-action/upload-sarif@v1
+      with:
+        sarif_file: cfn_nag.sarif