Skip to content

Add HAB_AUTH_TOKEN support to automate-container-scan action #52

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
peter-at-progress wants to merge 3 commits into
base: main
Choose a base branch
from
+31 −2
Open

Add HAB_AUTH_TOKEN support to automate-container-scan action #52

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2cd9328
passing hab token with dev packages for automate
peter-at-progress Apr 22, 2026
c5274db
Fix HAB_AUTH_TOKEN for systemd-spawned Habitat processes
peter-at-progress Apr 22, 2026
a711c73
Merge branch 'main' into peter-at-progress/hab-auth-token
brianLoomis Apr 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions .github/actions/automate-container-scan/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,8 @@ This action provides automated vulnerability scanning for Chef Automate's embedd
uses: chef/common-github-actions/.github/actions/automate-container-scan@main
with:
channel: current
license_id: ${{ secrets.GA_DOWNLOAD_GRYPE_LICENSE_ID }}
hab_auth_token: ${{ secrets.HAB_AUTH_TOKEN }} # Required for dev channel
out_dir: out
```

Expand Down Expand Up @@ -48,6 +50,8 @@ jobs:
uses: ./common-github-actions/.github/actions/automate-container-scan
with:
channel: current
license_id: ${{ secrets.GA_DOWNLOAD_GRYPE_LICENSE_ID }}
hab_auth_token: ${{ secrets.HAB_AUTH_TOKEN }}
out_dir: out

- name: Upload scan results
Expand All @@ -66,8 +70,12 @@ jobs:
| Input | Description | Required | Default |
|-------|-------------|----------|---------|
| `channel` | Release channel for Chef Automate (`stable` or `current`) | No | `current` |
| `license_id` | Chef download license ID (required for commercial downloads) | Yes | N/A |
| `hab_auth_token` | Habitat Builder Personal Access Token for protected channels (pass via secrets) | No | `""` |
| `out_dir` | Output directory for scan results and logs | No | `out` |

**Note on `hab_auth_token`**: This parameter is **required for the `dev` channel** and other protected Habitat channels that contain packages requiring authentication. The `current` and `stable` channels typically have public packages that don't require authentication. If you see `401 Unauthorized` errors during deployment, ensure you've provided a valid HAB_AUTH_TOKEN.

## Outputs

### Directory Structure
Expand Down
5 changes: 5 additions & 0 deletions .github/actions/automate-container-scan/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,10 @@ inputs:
license_id:
description: "Chef download license ID (required for commercial downloads)"
required: true
hab_auth_token:
description: "Habitat Builder Personal Access Token for protected channels (pass via secrets)"
required: false
default: ""
out_dir:
description: "Output directory for scan results and logs"
required: false
Expand All @@ -33,6 +37,7 @@ runs:
CHANNEL: ${{ inputs.channel }}
OUT_DIR: ${{ inputs.out_dir }}
ACTION_DIR: ${{ github.action_path }}
HAB_AUTH_TOKEN: ${{ inputs.hab_auth_token }}

branding:
icon: "shield"
Expand Down
20 changes: 18 additions & 2 deletions .github/actions/automate-container-scan/run.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,17 +109,33 @@ deploy_automate() {
fail "sysctl configuration failed"
fi

# Configure Habitat authentication if token provided
if [[ -n "${HAB_AUTH_TOKEN:-}" ]]; then
log "HAB_AUTH_TOKEN provided - configuring Habitat authentication"
# Create Habitat CLI config directory and config file with auth token
# This ensures the token is available to all hab processes, including those spawned by systemd
docker exec -w /root "${CONTAINER_ID}" bash -c "mkdir -p /hab/etc && cat > /hab/etc/cli.toml <<EOF
auth_token = \"${HAB_AUTH_TOKEN}\"
EOF" > "${LOGS_DIR}/hab-config.log" 2>&1 || log "WARNING: Failed to configure Habitat auth (may not be critical)"

# Also set as environment variable for immediate processes
docker exec -w /root "${CONTAINER_ID}" bash -c "echo 'export HAB_AUTH_TOKEN=${HAB_AUTH_TOKEN}' >> /root/.bashrc" \
>> "${LOGS_DIR}/hab-config.log" 2>&1 || true
fi

# Deploy Automate (this takes 10-15 minutes)
log "Deploying Automate (this may take 10-15 minutes)..."
log "Progress will be logged to ${LOGS_DIR}/deploy.log"

# Run deploy command
local docker_exec_cmd="docker exec -w /root ${CONTAINER_ID} timeout 1800 chef-automate deploy --channel ${CHANNEL} --skip-preflight config.toml --accept-terms-and-mlsa"

# Run deploy with timeout and capture output
# tee streams output to Actions log in real-time while also writing to file
# --skip-preflight: the CLI is always downloaded from the 'current' channel (no 'dev' download URL
# exists), so when deploying --channel dev the preflight CLI version check will always fail because
# dev has a newer build than current. The skip is safe: the CLI is still fully capable of deploying.
if docker exec -w /root "${CONTAINER_ID}" timeout 1800 chef-automate deploy --channel ${CHANNEL} --skip-preflight config.toml --accept-terms-and-mlsa \
2>&1 | tee "${LOGS_DIR}/deploy.log"; then
if eval "${docker_exec_cmd}" 2>&1 | tee "${LOGS_DIR}/deploy.log"; then
log "Automate deployment completed successfully"
else
log "ERROR: Automate deployment failed or timed out"
Expand Down