From 2f008e84ae6462c1ad3f554c2ad74437d958431b Mon Sep 17 00:00:00 2001 From: Paco Gomez Date: Wed, 26 Aug 2026 13:36:34 +0200 Subject: [PATCH] ci: scan release images with the official CrowdStrike fcs-action The shared action pinned FCS CLI 2.0.2, which CrowdStrike no longer serves from the downloads endpoint, so the release build died with an opaque curl exit 6 before the image was pushed. The official action resolves the current CLI itself and reports the policy result through its exit-code output. Also load the built image into the daemon so the scan inspects the image from this build rather than pulling the previous :latest from the registry. Co-authored-by: Cursor --- .github/workflows/build.yml | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 22b1fc1..75db36a 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -31,17 +31,29 @@ jobs: context: . file: ./Dockerfile push: false + load: true cache-from: type=gha cache-to: type=gha,mode=max tags: ghcr.io/bigdata-com/bigdata-risk-analyzer:latest,ghcr.io/bigdata-com/bigdata-risk-analyzer:${{ github.event.release.tag_name }} - name: Run security scan - uses: Bigdata-com/security-scan-containers@master + id: security-scan + uses: crowdstrike/fcs-action@v5.0.2 with: - image_name: ghcr.io/bigdata-com/bigdata-risk-analyzer:latest + scan_type: image + image: ghcr.io/bigdata-com/bigdata-risk-analyzer:latest falcon_client_id: ${{ secrets.FALCON_CLIENT_ID }} - falcon_client_secret: ${{ secrets.FALCON_CLIENT_SECRET }} falcon_region: ${{ secrets.FALCON_REGION }} - fcs_version: "2.0.2" + upload_results: true + no_color: true + show_full_description: true + show_full_detection_details: true + env: + FALCON_CLIENT_SECRET: ${{ secrets.FALCON_CLIENT_SECRET }} + - name: Fail on security scan findings + if: steps.security-scan.outputs.exit-code != 0 + run: | + echo "Image assessment policy not met (FCS CLI exit code ${{ steps.security-scan.outputs.exit-code }})." + exit 1 - name: Push Docker image uses: docker/build-push-action@v6 with: