Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: update security scanners #3295

Merged
merged 6 commits into from
May 30, 2023
Merged

chore: update security scanners #3295

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
0d22749
chore: update security scanners
Demonsthere May 30, 2023
5308f44
chore: format
Demonsthere May 30, 2023
078d124
chore: update sha format
Demonsthere May 30, 2023
e4e940c
fix: use real image
Demonsthere May 30, 2023
341f215
chore: lint dockerfile
Demonsthere May 30, 2023
bacb88f
u
Demonsthere May 30, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
chore: lint dockerfile
  • Loading branch information
@Demonsthere
Demonsthere committed May 30, 2023
commit 341f215d78ab57626cb3eb94f5841ce26f3ee30e
10 changes: 5 additions & 5 deletions .docker/Dockerfile-build
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,18 +5,18 @@ RUN apk --update upgrade && apk --no-cache --update-cache --upgrade --latest add

WORKDIR /go/src/github.com/ory/kratos

ADD go.mod go.mod
ADD go.sum go.sum
ADD internal/httpclient/go.* internal/httpclient/
ADD internal/client-go/go.* internal/client-go/
COPY go.mod go.mod
COPY go.sum go.sum
COPY internal/httpclient/go.* internal/httpclient/
COPY internal/client-go/go.* internal/client-go/

ENV GO111MODULE on
ENV CGO_ENABLED 1
ENV CGO_CPPFLAGS -DSQLITE_DEFAULT_FILE_PERMISSIONS=0600

RUN go mod download

ADD . .
COPY . .

ARG VERSION
ARG COMMIT
Expand Down
13 changes: 9 additions & 4 deletions .github/workflows/cve-scan.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,19 +15,24 @@ jobs:
steps:
- name: Checkout
uses: actions/checkout@v3
- name: Setup Env
id: vars
shell: bash
run: |
echo "SHA_SHORT=$(git rev-parse --short HEAD)" >> "${GITHUB_ENV}"
- name: Set up QEMU
uses: docker/setup-qemu-action@v2
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v2
- name: Build images
shell: bash
run: |
make docker
IMAGE_TAG="${{ env.SHA_SHORT }}" make docker
- name: Anchore Scanner
uses: anchore/scan-action@v3
id: grype-scan
with:
image: oryd/kratos:latest
image: oryd/kratos:${{ env.SHA_SHORT }}
fail-build: true
severity-cutoff: high
add-cpes-if-none: true
Expand All @@ -47,7 +52,7 @@ jobs:
uses: aquasecurity/trivy-action@master
if: ${{ always() }}
with:
image-ref: oryd/kratos:latest
image-ref: oryd/kratos:${{ env.SHA_SHORT }}
format: "table"
exit-code: "42"
ignore-unfixed: true
Expand All @@ -58,7 +63,7 @@ jobs:
uses: erzz/dockle-action@v1.3.2
if: ${{ always() }}
with:
image: oryd/kratos:latest
image: oryd/kratos:${{ env.SHA_SHORT }}
exit-code: 42
failure-threshold: high
- name: Hadolint
Expand Down
3 changes: 2 additions & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ export PWD := $(shell pwd)
export BUILD_DATE := $(shell date -u +"%Y-%m-%dT%H:%M:%SZ")
export VCS_REF := $(shell git rev-parse HEAD)
export QUICKSTART_OPTIONS ?= ""
export IMAGE_TAG := $(if $(IMAGE_TAG),$(IMAGE_TAG),latest)

GO_DEPENDENCIES = github.com/ory/go-acc \
github.com/golang/mock/mockgen \
Expand Down Expand Up @@ -162,7 +163,7 @@ format: .bin/goimports .bin/ory node_modules
# Build local docker image
.PHONY: docker
docker:
DOCKER_BUILDKIT=1 docker build -f .docker/Dockerfile-build --build-arg=COMMIT=$(VCS_REF) --build-arg=BUILD_DATE=$(BUILD_DATE) -t oryd/kratos:latest .
DOCKER_BUILDKIT=1 docker build -f .docker/Dockerfile-build --build-arg=COMMIT=$(VCS_REF) --build-arg=BUILD_DATE=$(BUILD_DATE) -t oryd/kratos:${IMAGE_TAG} .

# Runs the documentation tests
.PHONY: test-docs
Expand Down