Update dockerfile and workflows

Author: brianwyka

.github/workflows/ci.yml

@@ -0,0 +1,36 @@
+name: CI
+on:
+  push:
+    branches:
+      - main
+      - 'releases/[1-9]+.[0-9]+.x'
+    paths-ignore:
+      - '.github/**'
+      - '.gitignore'
+      - 'CODE_OF_CONDUCT.md'
+      - 'CONTRIBUTING.md'
+      - 'INDIVIDUAL_CONTRIBUTOR_LICENSE.md'
+      - 'LICENSE'
+      - 'NOTICE.txt'
+      - '**/README.md'
+  pull_request:
+    branches:
+      - main
+      - 'releases/[1-9]+.[0-9]+.x'
+    paths-ignore:
+      - '.github/**'
+      - '.gitignore'
+      - 'CODE_OF_CONDUCT.md'
+      - 'CONTRIBUTING.md'
+      - 'INDIVIDUAL_CONTRIBUTOR_LICENSE.md'
+      - 'LICENSE'
+      - 'NOTICE.txt'
+      - '**/README.md'
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: Sourcehawk Scan
+        uses: optum/sourcehawk-scan-github-action@main
+        continue-on-error: true

.github/workflows/release.yml

@@ -49,7 +49,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
           tag_name: ${{ format('v{0}', steps.setup.outputs.RELEASE_VERSION) }}
-          release_name: ${{ format('{0}@v{1}', github.repository_name, github.event.inputs.version) }}
+          release_name: ${{ format('{0}@v{1}', github.repository, github.event.inputs.version) }}
           body_path: CHANGELOG.md
           draft: true
           prerelease: false

Dockerfile

@@ -1,8 +1,15 @@
 # Small Linux based image with sourcehawk installed
 FROM optumopensource/sourcehawk:0.1.3-alpine
 
+# Need root to write
+USER root
+
+# Repository gets mounted to this directory
+WORKDIR /github/workspace
+
 # Copy Entrypoint script into image and make sure its executable
 COPY entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
 
 # Execute the entrypoint
 ENTRYPOINT ["/entrypoint.sh"]

entrypoint.sh

@@ -25,15 +25,15 @@ FAIL_BUILD=${5:-false}
 # Run the scan and output the results
 sourcehawk scan --verbosity MEDIUM --config-file "$CONFIG_FILE" --output-format "$OUTPUT_FORMAT" "$REPOSITORY_ROOT" > "$OUTPUT_FILE"
 
-# Show the scan results
-cat "$OUTPUT_FILE"
-
 # Determine if scan passed
 PASSED=false
 if [ $? -eq 0 ]; then
   PASSED=true
 fi
 
+# Show the scan results
+cat "$OUTPUT_FILE"
+
 # Capture exit code
 echo "::set-output name=scan-passed::$PASSED"
 

sourcehawk.yml

@@ -1,4 +1,3 @@
-api-version: 0.1
 
 config-locations:
-  - https://github.com/raw/optum/sourcehawk-parent/master/.sourcehawk/config.yml
+  - https://raw.githubusercontent.com/optum/sourcehawk-parent/main/.sourcehawk/optum-oss.yml