Skip to content

Commit 9d86ef2

Browse files
duckhawkduckhawk
authored
[CI] Add images check with Trivy (#34)
Signed-off-by: v.oleynikov <[email protected]>
1 parent cb6fa9f commit 9d86ef2

File tree

8 files changed

+119
-15
lines changed

8 files changed

+119
-15
lines changed

‎.github/workflows/trivy_check.yaml

Lines changed: 30 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,34 @@ jobs:
1515
- name: Checkout repository
1616
uses: actions/checkout@v2
1717

18+
- name: Check and Install Latest Trivy
19+
run: |
20+
mkdir -p $HOME/bin
21+
22+
LATEST_VERSION=$(curl -sL https://api.github.com/repos/aquasecurity/trivy/releases/latest | jq -r ".tag_name")
23+
CLEAN_VERSION=${LATEST_VERSION#v}
24+
25+
INSTALL_TRIVY=true
26+
27+
if [[ -f "$HOME/bin/trivy" ]]; then
28+
INSTALLED_VERSION=$("$HOME/bin/trivy" --version | grep -oE 'Version: [0-9]+\.[0-9]+\.[0-9]+' | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')
29+
if [ "$INSTALLED_VERSION" == "$CLEAN_VERSION" ]; then
30+
echo "Trivy is already up-to-date (version $INSTALLED_VERSION)."
31+
INSTALL_TRIVY=false
32+
else
33+
echo "Updating Trivy from version $INSTALLED_VERSION to $CLEAN_VERSION."
34+
fi
35+
else
36+
echo "Trivy is not installed. Installing version $CLEAN_VERSION."
37+
fi
38+
39+
if [ "$INSTALL_TRIVY" = true ]; then
40+
wget https://github.com/aquasecurity/trivy/releases/download/$LATEST_VERSION/trivy_${CLEAN_VERSION}_Linux-64bit.tar.gz -O trivy.tar.gz
41+
tar zxvf trivy.tar.gz -C $HOME/bin
42+
fi
43+
44+
echo "$HOME/bin" >> $GITHUB_PATH
45+
1846
- name: Prepare sub repo
1947
run: |
2048
version=v`grep "version :=" images/csi-nfs/werf.inc.yaml | awk -F'"' '{ print $2}'`
@@ -25,8 +53,5 @@ jobs:
2553
cd ..
2654
2755
- name: Run Trivy vulnerability scanner in fs mode
28-
uses: aquasecurity/trivy-action@master
29-
with:
30-
scan-type: 'fs'
31-
scan-ref: '.'
32-
trivy-config: trivy.yaml
56+
run: |
57+
trivy fs . --quiet --config trivy.yaml

‎.github/workflows/trivy_image_check.yaml

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
name: Trivy images check
2+
3+
env:
4+
MODULES_MODULE_NAME: ${{ vars.MODULE_NAME }}
5+
MODULES_MODULE_SOURCE: ${{ vars.DEV_MODULE_SOURCE }}
6+
PR_NUMBER: ${{ github.event.pull_request.number }}
7+
MODULES_REGISTRY: ${{ vars.DEV_REGISTRY }}
8+
MODULES_REGISTRY_LOGIN: ${{ vars.DEV_MODULES_REGISTRY_LOGIN }}
9+
MODULES_REGISTRY_PASSWORD: ${{ secrets.DEV_MODULES_REGISTRY_PASSWORD }}
10+
11+
on:
12+
pull_request:
13+
14+
jobs:
15+
test:
16+
name: Trivy images check
17+
runs-on: [self-hosted, regular]
18+
19+
steps:
20+
- uses: actions/checkout@v4
21+
- uses: deckhouse/modules-actions/setup@v1
22+
23+
- name: Check and Install Latest Trivy
24+
run: |
25+
mkdir -p $HOME/bin
26+
27+
LATEST_VERSION=$(curl -sL https://api.github.com/repos/aquasecurity/trivy/releases/latest | jq -r ".tag_name")
28+
CLEAN_VERSION=${LATEST_VERSION#v}
29+
30+
INSTALL_TRIVY=true
31+
32+
if [[ -f "$HOME/bin/trivy" ]]; then
33+
INSTALLED_VERSION=$("$HOME/bin/trivy" --version | grep -oE 'Version: [0-9]+\.[0-9]+\.[0-9]+' | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')
34+
if [ "$INSTALLED_VERSION" == "$CLEAN_VERSION" ]; then
35+
echo "Trivy is already up-to-date (version $INSTALLED_VERSION)."
36+
INSTALL_TRIVY=false
37+
else
38+
echo "Updating Trivy from version $INSTALLED_VERSION to $CLEAN_VERSION."
39+
fi
40+
else
41+
echo "Trivy is not installed. Installing version $CLEAN_VERSION."
42+
fi
43+
44+
if [ "$INSTALL_TRIVY" = true ]; then
45+
wget https://github.com/aquasecurity/trivy/releases/download/$LATEST_VERSION/trivy_${CLEAN_VERSION}_Linux-64bit.tar.gz -O trivy.tar.gz
46+
tar zxvf trivy.tar.gz -C $HOME/bin
47+
fi
48+
49+
echo "$HOME/bin" >> $GITHUB_PATH
50+
51+
- name: Run Trivy vulnerability scanner in image mode
52+
run: |
53+
exit_code=0
54+
image_name=$MODULES_MODULE_SOURCE/$MODULES_MODULE_NAME
55+
image_name_with_tag=$MODULES_MODULE_SOURCE/$MODULES_MODULE_NAME:pr$PR_NUMBER
56+
57+
crane_output=$(crane export $image_name_with_tag | tar -xOf - images_digests.json | jq -c 'to_entries[]')
58+
59+
while read -r item; do
60+
key=$(echo "$item" | jq -r '.key')
61+
value=$(echo "$item" | jq -r '.value')
62+
63+
echo 'Checking image '$key' '$value
64+
65+
trivy image --quiet --config trivy-silent.yaml --format table $image_name@$value
66+
67+
result=$(trivy image --quiet --config trivy-silent.yaml --format json $image_name@$value)
68+
69+
vulnerabilities=$(echo "$result" | jq '[.Results[]? | select(has("Vulnerabilities")) | .Vulnerabilities | length] | add // 0')
70+
71+
if [ "$vulnerabilities" -gt 0 ]; then
72+
echo "There are vulnerabilities in image"
73+
exit_code=1
74+
else
75+
echo "There are no vulnerabilities in image"
76+
fi
77+
done <<< "$crane_output"
78+
79+
exit $exit_code

‎.golangci.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ linters:
2424
- gci
2525
- gocritic
2626
- gofmt
27-
- goimports
27+
# - goimports
2828
- gosimple
2929
- govet
3030
- ineffassign

‎.werf/images-digests.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55

66
{{- range $ImageManifest := regexSplit "\n?---[ \t]*\n" $Images -1 }}
77
{{- $ImageManifest := $ImageManifest | fromYaml }}
8-
{{- if $ImageManifest.image }}
8+
{{- if and $ImageManifest.image (ne ($ImageManifest.final | toJson) "false") }}
99
{{- $ImagesIDList = append $ImagesIDList $ImageManifest.image }}
1010
{{- end }}
1111
{{- end }}

‎images/controller/werf.inc.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
1-
{{- $_ := set . "BASE_GOLANG_22_ALPINE" "registry.deckhouse.io/base_images/golang:1.22.3-alpine@sha256:dbf216b880b802c22e3f4f2ef0a78396b4a9a6983cb9b767c5efc351ebf946b0" }}
1+
{{- $_ := set . "BASE_GOLANG" "registry.deckhouse.io/base_images/golang:1.22.6-bullseye@sha256:260918a3795372a6d33225d361fe5349723be9667de865a23411b50fbcc76c5a" }}
22
{{- $_ := set . "BASE_SCRATCH" "registry.deckhouse.io/base_images/scratch@sha256:b054705fcc9f2205777d80a558d920c0b4209efdc3163c22b5bfcb5dda1db5fc" }}
33

44
---
55
image: {{ $.ImageName }}-golang-artifact
6-
from: {{ $.BASE_GOLANG_22_ALPINE }}
6+
from: {{ $.BASE_GOLANG }}
77
final: false
88

99
git:

‎images/csi-nfs/werf.inc.yaml

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
{{- $version := "4.7.0" }}
22

3-
{{- $_ := set . "BASE_GOLANG_22_ALPINE" "registry.deckhouse.io/base_images/golang:1.22.3-alpine@sha256:dbf216b880b802c22e3f4f2ef0a78396b4a9a6983cb9b767c5efc351ebf946b0" }}
3+
{{- $_ := set . "BASE_GOLANG" "registry.deckhouse.io/base_images/golang:1.22.6-bullseye@sha256:260918a3795372a6d33225d361fe5349723be9667de865a23411b50fbcc76c5a" }}
44
{{- $_ := set . "BASE_SCRATCH" "registry.deckhouse.io/base_images/scratch@sha256:b054705fcc9f2205777d80a558d920c0b4209efdc3163c22b5bfcb5dda1db5fc" }}
55
{{- $_ := set . "BASE_ALPINE_DEV" "registry.deckhouse.io/base_images/dev-alpine:3.16.3@sha256:c706fa83cc129079e430480369a3f062b8178cac9ec89266ebab753a574aca8e" }}
66
{{- $_ := set . "BASE_ALT_DEV" "registry.deckhouse.io/base_images/dev-alt:p10@sha256:76e6e163fa982f03468166203488b569e6d9fc10855d6a259c662706436cdcad" }}
77

88
---
99
image: {{ $.ImageName }}-golang-artifact
10-
from: {{ $.BASE_GOLANG_22_ALPINE }}
10+
from: {{ $.BASE_GOLANG }}
1111
final: false
1212

1313
git:
@@ -23,15 +23,14 @@ mount:
2323
- fromPath: ~/go-pkg-cache
2424
to: /go/pkg
2525
shell:
26-
beforeInstall:
27-
- apk add --no-cache ca-certificates make git
2826
install:
2927
- export GO_VERSION={{ env "GOLANG_VERSION" }}
3028
- export GOPROXY={{ env "GOPROXY" }}
3129
- git clone --depth 1 --branch v{{ $version }} {{ env "SOURCE_REPO" }}/kubernetes-csi/csi-driver-nfs.git /csi-driver-nfs
3230
- cd /csi-driver-nfs
3331
- for patchfile in /patches/*.patch ; do echo -n "Apply ${patchfile} ... "; git apply ${patchfile}; done
3432
- cd /csi-driver-nfs/cmd/nfsplugin
33+
- go mod vendor
3534
- GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -ldflags="-s -w" -o /nfsplugin
3635
- chmod +x /nfsplugin
3736

‎images/webhooks/werf.inc.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
1-
{{- $_ := set . "BASE_GOLANG_22_ALPINE" "registry.deckhouse.io/base_images/golang:1.22.3-alpine@sha256:dbf216b880b802c22e3f4f2ef0a78396b4a9a6983cb9b767c5efc351ebf946b0" }}
1+
{{- $_ := set . "BASE_GOLANG" "registry.deckhouse.io/base_images/golang:1.22.6-bullseye@sha256:260918a3795372a6d33225d361fe5349723be9667de865a23411b50fbcc76c5a" }}
22
{{- $_ := set . "BASE_SCRATCH" "registry.deckhouse.io/base_images/scratch@sha256:b054705fcc9f2205777d80a558d920c0b4209efdc3163c22b5bfcb5dda1db5fc" }}
33

44
---
55
image: {{ $.ImageName }}-golang-artifact
6-
from: {{ $.BASE_GOLANG_22_ALPINE }}
6+
from: {{ $.BASE_GOLANG }}
77
final: false
88

99
git:

‎trivy-silent.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
exit-code: 0

0 commit comments

Comments
 (0)