# Harness pipeline YAML for running Boost Scanner in a Kubernetes environment.

# Setup:
# 1. Ensure that the Kubernetes cluster has the necessary permissions and resources to run the pipeline
# 2. Create a connector in Harness to connect to your Kubernetes cluster and update the "connectorRef" value in the pipeline accordingly.
# 3. Change the connectorRef values to point to the appropriate container registry if you are using custom images for docker-in-docker and the Boost Scanner.
# 4. Provide the required variables and secrets when triggering the pipeline.
pipeline:
  name: boost
  identifier: boost
  variables:
    - name: scan_params
      type: String
      required: true
      value: <+input>
  stages:
    - stage:
        name: Boost Scanner
        identifier: boost_scanner
        type: CI
        spec:
          cloneCodebase: false
          platform:
            os: Linux
            arch: Amd64
          runtime:
            type: Cloud
            spec: {}
          execution:
            infrastructure:
              type: KubernetesDirect
              spec:
                connectorRef: kube
                namespace: harness-runners
                automountServiceAccountToken: true
                nodeSelector: {}
                os: Linux
            sharedPaths:
              - /var/run/
              - /var/lib/docker
              - /tmp
            steps:
              - step:
                  type: Background
                  name: docker-in-docker
                  identifier: dockerindocker
                  spec:
                    connectorRef: account.harnessImage
                    # To run docker-in-docker, we need to use a privileged image. The default image is set to docker:29-dnd, but it can be overridden by providing a value for the "docker_dnd" variable in the pipeline.
                    image: <+pipeline.variables.get("docker_dnd").default(docker:29-dnd)>
                    shell: Sh
                    privileged: true
              - step:
                  type: Run
                  name: Run Boost Scanner                   
                  connectorRef: account.harnessImage
                  # To run the Boost Scanner, we need to use a docker image that has the necessary tools installed. The default image is set to docker:29-cli, but it can be overridden by providing a value for the "docker_cli" variable in the pipeline.
                  image:  <+pipeline.variables.get("docker_cli").default(docker:29-cli)> docker:29-cli
                  identifier: run_boost_scanner
                  spec:
                    shell: Sh
                    envVariables:
                      BOOST_API_TOKEN: <+secrets.getValue('BOOST_API_TOKEN')>
                      SCAN_PARAMS: <+pipeline.variables.scan_params>
                    command: |-
                      set -e
                      apk add --no-cache bash curl git openssh-client coreutils
                      curl -s https://assets.build.boostsecurity.io/boost-cli/get-boost-cli | sh
                      TRIGGER_ID=$(printf '%s' "$SCAN_PARAMS" | jq -r .trigger_id)
                      /tmp/boost-cli/latest scan trigger --trigger-id "$TRIGGER_ID"
