-
Notifications
You must be signed in to change notification settings - Fork 10
106 lines (94 loc) · 3.6 KB
/
trivy.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
name: Trivy Vulnerability Scanner
on:
push:
branches:
- main
create:
# Publish semver tags as releases.
tags: [ 'v*.*.*' ]
permissions:
contents: read
packages: write
env:
REGISTRY: ghcr.io
HUB_NET_CONTROLLER_MANAGER_IMAGE_NAME : hub-net-controller-manager
MEMBER_NET_CONTROLLER_MANAGER_IMAGE_NAME: member-net-controller-manager
MCS_CONTROLLER_MANAGER_IMAGE_NAME: mcs-controller-manager
GO_VERSION: '1.22.4'
jobs:
export-registry:
runs-on: ubuntu-20.04
outputs:
registry: ${{ steps.export.outputs.registry }}
steps:
- id: export
run: |
# registry must be in lowercase
# store the images under dev
# TODO: need to cleanup dev images periodically
echo "::set-output name=registry::$(echo "${{ env.REGISTRY }}/${{ github.repository }}/dev" | tr [:upper:] [:lower:])"
scan-images:
needs: export-registry
env:
REGISTRY: ${{ needs.export-registry.outputs.registry }}
runs-on: ubuntu-20.04
steps:
- name: Set up Go ${{ env.GO_VERSION }}
uses: actions/setup-go@v5
with:
go-version: ${{ env.GO_VERSION }}
- name: Checkout code
uses: actions/checkout@v4
- name: Login to ${{ env.REGISTRY }}
uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: generate image version
run: echo IMAGE_VERSION=$(git rev-parse --short=7 HEAD) >> $GITHUB_ENV
- name: Build and push controller manager images to registry with tag ${{ env.IMAGE_VERSION }}
run: |
make push
env:
REGISTRY: ${{ env.REGISTRY}}
TAG: ${{ env.IMAGE_VERSION }}
- name: Scan ${{ env.REGISTRY }}/${{ env.HUB_NET_CONTROLLER_MANAGER_IMAGE_NAME }}:${{ env.IMAGE_VERSION }}
uses: aquasecurity/trivy-action@master
with:
image-ref: ${{ env.REGISTRY }}/${{ env.HUB_NET_CONTROLLER_MANAGER_IMAGE_NAME }}:${{ env.IMAGE_VERSION }}
format: 'table'
exit-code: '1'
ignore-unfixed: true
vuln-type: 'os,library'
severity: 'CRITICAL,HIGH'
timeout: '5m0s'
env:
TRIVY_USERNAME: ${{ github.actor }}
TRIVY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
- name: Scan ${{ env.REGISTRY }}/${{ env.MEMBER_NET_CONTROLLER_MANAGER_IMAGE_NAME }}:${{ env.IMAGE_VERSION }}
uses: aquasecurity/trivy-action@master
with:
image-ref: ${{ env.REGISTRY }}/${{ env.MEMBER_NET_CONTROLLER_MANAGER_IMAGE_NAME }}:${{ env.IMAGE_VERSION }}
format: 'table'
exit-code: '1'
ignore-unfixed: true
vuln-type: 'os,library'
severity: 'CRITICAL,HIGH'
timeout: '5m0s'
env:
TRIVY_USERNAME: ${{ github.actor }}
TRIVY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
- name: Scan ${{ env.REGISTRY }}/${{ env.MCS_CONTROLLER_MANAGER_IMAGE_NAME }}:${{ env.IMAGE_VERSION }}
uses: aquasecurity/trivy-action@master
with:
image-ref: ${{ env.REGISTRY }}/${{ env.MCS_CONTROLLER_MANAGER_IMAGE_NAME }}:${{ env.IMAGE_VERSION }}
format: 'table'
exit-code: '1'
ignore-unfixed: true
vuln-type: 'os,library'
severity: 'CRITICAL,HIGH'
timeout: '5m0s'
env:
TRIVY_USERNAME: ${{ github.actor }}
TRIVY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}