other changes

helm/templates/clusterworkflowtemplate.yaml

@@ -1,3 +1,4 @@
+{{- if .Values.pipeline.enabled }}
 apiVersion: argoproj.io/v1alpha1
 kind: ClusterWorkflowTemplate
 metadata:
@@ -47,21 +48,11 @@ spec:
                   value: "{{workflow.parameters.fail-on-cvss}}"
           - name: upload-storage
             dependencies:
-              - scan-trufflehog
-              - scan-semgrep
-              - scan-kics
-              - scan-socketdev
-              - scan-syft-grype
-              - scan-crossguard
+              - scanners
             template: upload-storage
           - name: upload-defectdojo
             dependencies:
-              - scan-trufflehog
-              - scan-semgrep
-              - scan-kics
-              - scan-socketdev
-              - scan-syft-grype
-              - scan-crossguard
+              - scanners
             template: upload-defectdojo
           - name: enforce-policy
             dependencies:
@@ -76,54 +67,6 @@ spec:
             dependencies:
               - scanners
             template: sinks-and-enforcement
-          - name: scan-trufflehog
-            dependencies:
-              - clone
-            template: scan-trufflehog
-            arguments:
-              parameters:
-                - name: working-dir
-                  value: "{{workflow.parameters.working-dir}}"
-          - name: scan-semgrep
-            dependencies:
-              - clone
-            template: scan-semgrep
-            arguments:
-              parameters:
-                - name: working-dir
-                  value: "{{workflow.parameters.working-dir}}"
-          - name: scan-kics
-            dependencies:
-              - clone
-            template: scan-kics
-            arguments:
-              parameters:
-                - name: working-dir
-                  value: "{{workflow.parameters.working-dir}}"
-          - name: scan-socketdev
-            dependencies:
-              - clone
-            template: scan-socketdev
-            arguments:
-              parameters:
-                - name: working-dir
-                  value: "{{workflow.parameters.working-dir}}"
-          - name: scan-syft-grype
-            dependencies:
-              - clone
-            template: scan-syft-grype
-            arguments:
-              parameters:
-                - name: working-dir
-                  value: "{{workflow.parameters.working-dir}}"
-          - name: scan-crossguard
-            dependencies:
-              - clone
-            template: scan-crossguard
-            arguments:
-              parameters:
-                - name: working-dir
-                  value: "{{workflow.parameters.working-dir}}"
     - name: clone-repo
       inputs:
         parameters:
@@ -148,39 +91,60 @@ spec:
         tasks:
           - name: trufflehog
             template: scan-trufflehog
+            arguments:
+              parameters:
+                - name: working-dir
+                  value: "{{inputs.parameters.working-dir}}"
           - name: semgrep
             template: scan-semgrep
+            arguments:
+              parameters:
+                - name: working-dir
+                  value: "{{inputs.parameters.working-dir}}"
           - name: kics
             template: scan-kics
+            arguments:
+              parameters:
+                - name: working-dir
+                  value: "{{inputs.parameters.working-dir}}"
           - name: socketdev
             template: scan-socketdev
+            arguments:
+              parameters:
+                - name: working-dir
+                  value: "{{inputs.parameters.working-dir}}"
           - name: syft-grype
             template: scan-syft-grype
+            arguments:
+              parameters:
+                - name: working-dir
+                  value: "{{inputs.parameters.working-dir}}"
           - name: defectdojo
             template: scan-crossguard
+            arguments:
+              parameters:
+                - name: working-dir
+                  value: "{{inputs.parameters.working-dir}}"
     - name: sinks-and-enforcement
       container:
-        image: alpine:3.20
+        image: curlimages/curl:latest
         command:
           - sh
           - -c
         args:
-          - echo "stub: sinks and enforcement"
-    - name: scan-trufflehog
-      template: scan-trufflehog
-    - name: scan-semgrep
-      template: scan-semgrep
-    - name: scan-kics
-      template: scan-kics
-    - name: scan-socketdev
-      template: scan-socketdev
-    - name: scan-syft-grype
-      template: scan-syft-grype
-    - name: scan-crossguard
-      template: scan-crossguard
-    - name: upload-storage
-      template: upload-storage
-    - name: upload-defectdojo
-      template: upload-defectdojo
-    - name: enforce-policy
-      template: enforce-policy
+          - |
+            set -eu
+            echo "Pipeline complete. You can configure a webhook notification here."
+            if [ -n "${SLACK_WEBHOOK_URL:-}" ]; then
+              curl -X POST -H 'Content-type: application/json' --data '{"text":"Security Pipeline Finished"}' "${SLACK_WEBHOOK_URL}" || true
+            fi
+{{ include "template.scan-syft-grype" . | indent 4 }}
+{{ include "template.scan-socketdev" . | indent 4 }}
+{{ include "template.scan-crossguard" . | indent 4 }}
+{{ include "template.scan-semgrep" . | indent 4 }}
+{{ include "template.scan-trufflehog" . | indent 4 }}
+{{ include "template.scan-kics" . | indent 4 }}
+{{ include "template.upload-defectdojo" . | indent 4 }}
+{{ include "template.upload-storage" . | indent 4 }}
+{{ include "template.enforce-policy" . | indent 4 }}
+{{- end }}