actions-audit-cage

A GitHub Action that runs cage audit on AWS ECS services and creates or updates GitHub issues with the audit results.

Usage

Basic Example

name: Cage Audit
on:
  schedule:
    - cron: '0 0 * * *'  # Run daily at midnight
  workflow_dispatch:

jobs:
  audit:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      issues: write
    steps:
      - uses: loilo-inc/actions-setup-cage@v7
      - uses: loilo-inc/actions-audit-cage@v1
        with:
          region: us-east-1
          github-token: ${{ secrets.GITHUB_TOKEN }}
          audit-services: |
            my-cluster/my-service

Inputs

Input	Description	Required	Default
region	AWS region to scan	Yes	-
github-token	GitHub token used to create/update the issue	Yes	-
audit-contexts	Newline-separated directory(ies) containing audit context JSON files (cluster, service)	No	-
audit-services	Newline-separated ECS service(s) to audit in the format <cluster>/<service>	No	-
cage-options	Newline-separated extra options passed to cage audit	No	-
issue-title	Custom issue title. If not provided, the title will be "Cage audit report"	No	Cage audit report
dry-run	If true, do not create/update the issue; only log the summary	No	false

Advanced Examples

Multiple Services

- uses: loilo-inc/actions-setup-cage@v7
- uses: loilo-inc/actions-audit-cage@v1
  with:
    region: us-west-2
    github-token: ${{ secrets.GITHUB_TOKEN }}
    audit-services: |
      production-cluster/api-service
      production-cluster/web-service
      staging-cluster/api-service

Using Audit Contexts

- uses: loilo-inc/actions-setup-cage@v7
- uses: loilo-inc/actions-audit-cage@v1
  with:
    region: eu-west-1
    github-token: ${{ secrets.GITHUB_TOKEN }}
    audit-contexts: |
      config/prod
      config/staging

With Custom Cage Options

- uses: loilo-inc/actions-setup-cage@v7
- uses: loilo-inc/actions-audit-cage@v1
  with:
    region: ap-northeast-1
    github-token: ${{ secrets.GITHUB_TOKEN }}
    audit-services: my-cluster/my-service
    cage-options: |
      --foo
      --bar

Dry Run Mode

- uses: loilo-inc/actions-setup-cage@v7
- uses: loilo-inc/actions-audit-cage@v1
  with:
    region: us-east-1
    github-token: ${{ secrets.GITHUB_TOKEN }}
    audit-services: my-cluster/my-service
    dry-run: "true"

Custom Issue Title

- uses: loilo-inc/actions-setup-cage@v7
- uses: loilo-inc/actions-audit-cage@v1
  with:
    region: us-east-1
    github-token: ${{ secrets.GITHUB_TOKEN }}
    audit-services: my-cluster/my-service
    issue-title: "Security Audit Report - Production"

License

MIT