Skip to content

fix(COD-6066): hide the Lacework credentials from the running commands #251

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jeremydubreil merged 1 commit into from
Mar 25, 2026
Merged

fix(COD-6066): hide the Lacework credentials from the running commands #251

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/integration-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ on:
workflow_dispatch:

env:
LW_ACCOUNT_NAME: ${{ secrets.LW_ACCOUNT_CAT }}
LW_ACCOUNT: ${{ secrets.LW_ACCOUNT_CAT }}
LW_API_KEY: ${{ secrets.LW_API_KEY_CAT }}
LW_API_SECRET: ${{ secrets.LW_API_SECRET_CAT }}
DEBUG: true
Expand Down
4 changes: 2 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,8 +23,8 @@ permissions:
pull-requests: write

env:
LW_ACCOUNT_NAME: ${{ secrets.LW_ACCOUNT_NAME }}
LW_SUBACCOUNT_NAME: ${{ secrets.LW_SUBACCOUNT_NAME }}
LW_ACCOUNT: ${{ secrets.LW_ACCOUNT }}
LW_SUBACCOUNT: ${{ secrets.LW_SUBACCOUNT }}
LW_API_KEY: ${{ secrets.LW_API_KEY }}
LW_API_SECRET: ${{ secrets.LW_API_SECRET }}

Expand Down
10 changes: 8 additions & 2 deletions action.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,11 +69,17 @@ runs:
if: ${{ inputs.debug == 'true' }}
run: |
echo "LW_LOG=debug" >> $GITHUB_ENV
- name: Set Lacework account environment variable
Copy link
Copy Markdown
Contributor

@baltoiteodor baltoiteodor Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is for backward compatibility?

Copy link
Copy Markdown
Contributor Author

@jeremydubreil jeremydubreil Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, and it seems to work now. I am testing this on WebGoat.

shell: bash
run: |
if [ -n "$LW_ACCOUNT_NAME" ]; then
echo "LW_ACCOUNT=$LW_ACCOUNT_NAME" >> $GITHUB_ENV
fi
- name: Install Lacework CLI component
shell: bash
run: |
lacework --noninteractive -a "${LW_ACCOUNT_NAME}" -k "${LW_API_KEY}" -s "${LW_API_SECRET}" component install sca
lacework --noninteractive -a "${LW_ACCOUNT_NAME}" -k "${LW_API_KEY}" -s "${LW_API_SECRET}" version
lacework --noninteractive component install sca
lacework --noninteractive version
env:
CDK_DOWNLOAD_TIMEOUT_MINUTES: 2
- uses: actions/setup-node@v4
Expand Down
2 changes: 0 additions & 2 deletions src/index.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,8 +41,6 @@ async function runAnalysis() {
await callLaceworkCli(...args)
toUpload.push(sarifReportPath)

const uploadStart = Date.now()

await uploadArtifact(getArtifactName(target), ...toUpload)
setOutput(`${target}-completed`, true)
}
Expand Down
23 changes: 4 additions & 19 deletions src/util.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,22 +60,7 @@ export function getOptionalEnvVariable(name: string, defaultValue: string) {
}

export async function callLaceworkCli(...args: string[]) {
const accountName = getRequiredEnvVariable('LW_ACCOUNT_NAME')
const apiKey = getRequiredEnvVariable('LW_API_KEY')
const apiSecret = getRequiredEnvVariable('LW_API_SECRET')
const expandedArgs = [
'--noninteractive',
'--account',
accountName,
'--api_key',
apiKey,
'--api_secret',
apiSecret,
'sca',
...args,
]
info('Calling lacework ' + expandedArgs.join(' '))
await callCommand('lacework', ...expandedArgs)
await callCommand('lacework', '--noninteractive', 'sca', ...args)
Copy link
Copy Markdown
Contributor

@baltoiteodor baltoiteodor Mar 25, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

how come the credentials no longer need passing?

Copy link
Copy Markdown
Contributor Author

@jeremydubreil jeremydubreil Mar 25, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Because they are passed as environment. Before the changes, the workflow was setting the environment environment variables but not using them as such as it was overriding them with the -a, -k, and -s of the lacework CLI.

}

export function getOrDefault(name: string, defaultValue: string) {
Expand All @@ -93,7 +78,7 @@ export function generateUILink() {

if (targetBranch !== defaultBranch) return ''

let lwAccountName = process.env.LW_ACCOUNT_NAME
let lwAccountName = process.env.LW_ACCOUNT
lwAccountName = lwAccountName?.replace(/\.lacework\.net$/, '')

let url =
Expand All @@ -102,8 +87,8 @@ export function generateUILink() {
`github.com%2F${context.repo.owner}%2F${context.repo.repo}` +
`/${defaultBranch}`

if (process.env.LW_SUBACCOUNT_NAME) {
url += '?accountName=' + process.env.LW_SUBACCOUNT_NAME
if (process.env.LW_SUBACCOUNT) {
url += '?accountName=' + process.env.LW_SUBACCOUNT
}

return url
Expand Down
Loading