Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: update security scanners #3295

Merged
merged 6 commits into from
May 30, 2023
Merged

chore: update security scanners #3295

Changes from 1 commit
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
0d22749
chore: update security scanners
Demonsthere May 30, 2023
5308f44
chore: format
Demonsthere May 30, 2023
078d124
chore: update sha format
Demonsthere May 30, 2023
e4e940c
fix: use real image
Demonsthere May 30, 2023
341f215
chore: lint dockerfile
Demonsthere May 30, 2023
bacb88f
u
Demonsthere May 30, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
fix: use real image
  • Loading branch information
@Demonsthere
Demonsthere committed May 30, 2023
commit e4e940c912ada06348074a448544e68f5066b327
18 changes: 5 additions & 13 deletions .github/workflows/cve-scan.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,29 +15,21 @@ jobs:
steps:
- name: Checkout
uses: actions/checkout@v3
- name: Setup Env
id: vars
shell: bash
run: |
echo "SHA_SHORT=$(git rev-parse --short HEAD)" >> "${GITHUB_ENV}"
- name: Set up QEMU
uses: docker/setup-qemu-action@v2
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v2
- name: Build images
shell: bash
run: |
touch kratos
DOCKER_BUILDKIT=1 docker build -f .docker/Dockerfile-alpine --build-arg=COMMIT=${{ env.SHA_SHORT }} -t oryd/kratos:${{ env.SHA_SHORT }} .
rm kratos
make docker
- name: Anchore Scanner
uses: anchore/scan-action@v3
id: grype-scan
with:
image: oryd/kratos:${{ env.SHA_SHORT }}
image: oryd/kratos:latest
fail-build: true
severity-cutoff: high
acs-report-enable: true
add-cpes-if-none: true
- name: Inspect action SARIF report
shell: bash
Expand All @@ -55,7 +47,7 @@ jobs:
uses: aquasecurity/trivy-action@master
if: ${{ always() }}
with:
image-ref: oryd/kratos:${{ env.SHA_SHORT }}
image-ref: oryd/kratos:latest
format: "table"
exit-code: "42"
ignore-unfixed: true
Expand All @@ -66,15 +58,15 @@ jobs:
uses: erzz/dockle-action@v1.3.2
if: ${{ always() }}
with:
image: oryd/kratos:${{ env.SHA_SHORT }}
image: oryd/kratos:latest
exit-code: 42
failure-threshold: high
- name: Hadolint
uses: hadolint/hadolint-action@v3.1.0
id: hadolint
if: ${{ always() }}
with:
dockerfile: .docker/Dockerfile-alpine
dockerfile: .docker/Dockerfile-build
verbose: true
format: "json"
failure-threshold: "error"
Expand Down