aws-inventory.yml

name: AWS Auto Inventory

on:
  workflow_dispatch:
    push:
      paths:
        - '**/*.py'   # Python files
        - '**/*.md'   # Markdown files
        - '**/*.yml'  # YAML files
        - '**/*.json' # JSON files

jobs:
  # Python-specific linting
  python:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v3
      - name: Run Python Linting
        uses: oxsecurity/megalinter/flavors/python@v6.22.2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          APPLY_FIXES: true

  # Mixed documentation linting
  documentation:
    runs-on: ubuntu-latest
    needs: python
    steps:
      - name: Checkout Code
        uses: actions/checkout@v3
      - name: Run Documentation Linting
        uses: oxsecurity/megalinter/flavors/documentation@v6.22.2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          APPLY_FIXES: true

  # Lightweight CI linting
  ci_light:
    runs-on: ubuntu-latest
    needs: documentation
    steps:
      - name: Checkout Code
        uses: actions/checkout@v3
      - name: Run Lightweight CI Linting
        uses: oxsecurity/megalinter/flavors/ci_light@v6.22.2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          APPLY_FIXES: true

jobs:
  aws-scan:
    runs-on: ubuntu-latest
    needs: ci_light
    permissions:
      contents: write
      pull-requests: write
      id-token: write
    env: 
     CI_COMMIT_MESSAGE: Fetched AWS Assets
     AWS_REGION: us-east-1  # Set default AWS region

    steps:
    # Step 1: Checkout the repository
    - name: Checkout Code
      uses: actions/checkout@v3

    - name: Set up Python 3.x
      uses: actions/setup-python@v4
      with:
        python-version: '3.10'
       
    - name: Install System Dependencies and AWS CLI
      run: |
        sudo apt-get update
        sudo apt-get install -y python3-dev libatlas-base-dev gfortran libopenblas-dev liblapack-dev build-essential python3 python3-pip
        python3 -m pip install --upgrade pip
        pip install numpy==1.24.4 pandas==2.1.0 boto3 openpyxl==3.1.2 awscli
        
    # Use AWS OIDC credentials
    - name: Configure AWS credentials with OIDC
      uses: aws-actions/configure-aws-credentials@v3
      with:
       role-to-assume: arn:aws:iam::145023120730:role/elevated-standards
       role-session-name: evidencecollection
       aws-region: ${{ env.AWS_REGION }}
   
    - name: Verify AWS CLI Configuration
      run: |
        if ! aws sts get-caller-identity; then
          echo "Failed to verify AWS credentials." >&2
          exit 1
        fi

    - name: Run AWS Auto Inventory
      run: |
        git clone https://github.com/aws-samples/aws-auto-inventory.git
        cd aws-auto-inventory
        pip install -r requirements.txt
        YEAR=$(date +"%Y")
        MONTH=$(date +"%B")
        TIMESTAMP=$(date +"%Y-%m-%dT%H-%M")
        OUTPUT_DIR="../data/json/aws/${TIMESTAMP}"
        python3 scan.py -s ../config/aws.json -r ${{ env.AWS_REGION }} --output_dir $OUTPUT_DIR


#    - name: Commit and Push Results
#      run: |
#        echo "aws-auto-inventory/" >> .gitignore
#        git config --local user.name "GitHub Actions"
#        git config --local user.email "actions@github.com"
#        mkdir -p data/json/aws
#        git add data/json/aws
#        git commit -m "${{ env.CI_COMMIT_MESSAGE }}" || echo "No changes to commit"
#        git push origin HEAD:${{ github.ref }}

  process-inventory:
    needs: aws-scan
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    env: 
     CI_COMMIT_MESSAGE: Processed FedRAMP AWS Inventory

    steps:
      # Step 1: Checkout the repository
      - name: Checkout Code
        uses: actions/checkout@v3

      # Step 2: Set up Python
      - name: Set up Python 3.x
        uses: actions/setup-python@v4
        with:
          python-version: '3.10'

      # Step 3: Install System Dependencies
      - name: Install System Dependencies
        run: |
          sudo apt-get update
          sudo apt-get install -y python3-dev libatlas-base-dev gfortran libopenblas-dev liblapack-dev build-essential

      # Step 4: Install Python Dependencies
      - name: Install Dependencies
        run: |
          python -m pip install --upgrade pip
          pip install --only-binary=:all: numpy==1.24.4 pandas==2.1.0 openpyxl==3.1.2

      # Step 5: Run Inventory Processing
      - name: Run Inventory Processing
        run: |
          python3 src/main.py
          echo "${{ env.CI_COMMIT_MESSAGE }}"

      # Step 6: Commit and Push Results
      - name: Commit and Push Results
        run: |
          git config --local user.name "GitHub Actions"
          git config --local user.email "actions@github.com"
          mkdir -p output
          git add output
          git commit -m "${{ env.CI_COMMIT_MESSAGE }}"
          git push origin HEAD:${{ github.ref }}