Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

🌱 Add OSV scanner PR and schedule workflows #492

Merged
merged 1 commit into from
May 16, 2024
Merged

🌱 Add OSV scanner PR and schedule workflows #492

merged 1 commit into from
May 16, 2024

Conversation

kashifest
Copy link
Member

@kashifest kashifest commented Apr 15, 2024 •
edited
Loading

This PR adds OSV scanner PR and schedule workflows. Workflow files are adapted from https://github.com/google/osv-scanner

@metal3-io-bot metal3-io-bot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Apr 15, 2024
@kashifest
Copy link
Member Author

/hold
Lets check first what is running here

@metal3-io-bot metal3-io-bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Apr 15, 2024
@github-advanced-security
Copy link

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

@kashifest
Copy link
Member Author

@tuminoid how do you feel about this specially the uploading the artifacts about the analysis results ?

@kashifest
Copy link
Member Author

@tuminoid how do you feel about this specially the uploading the artifacts about the analysis results ?

Although those are empty now, I wonder why?

@kashifest kashifest closed this Apr 15, 2024
@kashifest kashifest reopened this Apr 15, 2024
@kashifest
Copy link
Member Author

/test ?

@metal3-io-bot
Copy link
Contributor

@kashifest: The following commands are available to trigger required jobs:

  • /test generate
  • /test gomod
  • /test manifestlint
  • /test markdownlint
  • /test metal3-centos-e2e-integration-test-main
  • /test shellcheck
  • /test test
  • /test unit

The following commands are available to trigger optional jobs:

  • /test metal3-centos-e2e-basic-test-main
  • /test metal3-centos-e2e-feature-test-main
  • /test metal3-e2e-1-26-1-27-upgrade-test-main
  • /test metal3-e2e-1-27-1-28-upgrade-test-main
  • /test metal3-e2e-1-28-1-29-upgrade-test-main
  • /test metal3-e2e-clusterctl-upgrade-test-main
  • /test metal3-keep-clusterctl-upgrade-test-main
  • /test metal3-keep-e2e-1-26-1-27-upgrade-test-main
  • /test metal3-keep-e2e-1-27-1-28-upgrade-test-main
  • /test metal3-keep-e2e-1-28-1-29-upgrade-test-main
  • /test metal3-ubuntu-e2e-basic-test-main
  • /test metal3-ubuntu-e2e-feature-test-main
  • /test metal3-ubuntu-e2e-integration-test-main

Use /test all to run the following jobs that were automatically triggered:

  • generate
  • gomod
  • manifestlint
  • unit

In response to this:

/test ?

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@kashifest
Copy link
Member Author

/test metal3-centos-e2e-integration-test-main

@tuminoid
Copy link
Member

I'll take look on the artifacts this week.

@kashifest
Copy link
Member Author

/test metal3-centos-e2e-integration-test-main

smoshiur1237
smoshiur1237 reviewed Apr 29, 2024
View reviewed changes
Copy link
Member

@smoshiur1237 smoshiur1237 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@metal3-io-bot metal3-io-bot added the lgtm Indicates that a PR is ready to be merged. label Apr 29, 2024
@mboukhalfa
Copy link
Member

_ No description provided. _

Can you please describe more !

lentzi90
lentzi90 reviewed Apr 29, 2024
View reviewed changes
Copy link
Member

@lentzi90 lentzi90 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@metal3-io-bot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: lentzi90

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@metal3-io-bot metal3-io-bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 29, 2024
tuminoid
tuminoid reviewed May 8, 2024
View reviewed changes
Copy link
Member

@tuminoid tuminoid left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is one weird setup... I guess it is organized such that the first workflow with workflow_call is reusable, and is being called by the second workflow. IMO it has issues with naming, pinning etc.

Second, with osv-scanner, we have issues with golang stdlib. We don't specify a patch version in our go directive, which means it'll assume it as 0. This leads to failures. If this is failing in a PR, we can never merge a thing, nothing will ever pass.

I need to do more local testing with gh act but I think we can only take the scheduled part, or on-demand, and not run it on PRs, and even on scheduled ones, it'll pollute the security events with false positives due the golang issue.

/hold
For further testing.

.github/workflows/osv-scanner-schedule-scan.yml Outdated Show resolved Hide resolved
.github/workflows/osv-scanner-pr.yml Outdated Show resolved Hide resolved
.github/workflows/osv-scanner-schedule-scan.yml Outdated Show resolved Hide resolved
.github/workflows/osv-scanner-schedule-scan.yml Outdated Show resolved Hide resolved
.github/workflows/osv-scanner-pr.yml Outdated Show resolved Hide resolved
.github/workflows/osv-scanner-pr.yml Outdated Show resolved Hide resolved
.github/workflows/osv-scanner-pr.yml Outdated Show resolved Hide resolved
.github/workflows/osv-scanner-schedule-scan.yml Outdated Show resolved Hide resolved
.github/workflows/osv-scanner-schedule-scan.yml Outdated Show resolved Hide resolved
@kashifest
Copy link
Member Author

Thanks @tuminoid for the review , I will check it up

@metal3-io-bot metal3-io-bot removed the lgtm Indicates that a PR is ready to be merged. label May 14, 2024
@kashifest kashifest force-pushed the add/OSV-scanner branch 6 times, most recently from 79ca23b to a864b4c Compare May 14, 2024 08:19
@kashifest kashifest force-pushed the add/OSV-scanner branch 4 times, most recently from 6b5cd7b to f4fbee9 Compare May 14, 2024 09:50
tuminoid
tuminoid reviewed May 15, 2024
View reviewed changes
.github/workflows/osv-scanner-pr.yml Outdated Show resolved Hide resolved
.github/workflows/osv-scanner-scan.yml Outdated Show resolved Hide resolved
.github/workflows/osv-scanner-scan.yml Outdated Show resolved Hide resolved
.github/workflows/osv-scanner-scan.yml Show resolved Hide resolved
.github/workflows/osv-scanner-scan.yml Outdated Show resolved Hide resolved
@kashifest
Copy link
Member Author

I think I have answered most of the comments here @tuminoid

@kashifest
Copy link
Member Author

/cc @tuminoid

@metal3-io-bot metal3-io-bot requested a review from tuminoid May 16, 2024 06:30
tuminoid
tuminoid reviewed May 16, 2024
View reviewed changes
Copy link
Member

@tuminoid tuminoid left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

I think we can merge this, and then after a week or so, if no issues are seen, do the same for IPAM and BMO.

@metal3-io-bot metal3-io-bot added the lgtm Indicates that a PR is ready to be merged. label May 16, 2024
@kashifest
Copy link
Member Author

/hold cancel

@metal3-io-bot metal3-io-bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label May 16, 2024
@kashifest
Copy link
Member Author

/override metal3-centos-e2e-integration-test-main metal3-ubuntu-e2e-integration-test-main

@metal3-io-bot
Copy link
Contributor

@kashifest: Overrode contexts on behalf of kashifest: metal3-centos-e2e-integration-test-main, metal3-ubuntu-e2e-integration-test-main

In response to this:

/override metal3-centos-e2e-integration-test-main metal3-ubuntu-e2e-integration-test-main

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@metal3-io-bot metal3-io-bot merged commit 89f47d8 into metal3-io:main May 16, 2024
14 checks passed
@metal3-io-bot metal3-io-bot deleted the add/OSV-scanner branch May 16, 2024 07:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@smoshiur1237 smoshiur1237 smoshiur1237 left review comments

@lentzi90 lentzi90 lentzi90 left review comments

@tuminoid tuminoid tuminoid left review comments

Assignees
No one assigned
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
6 participants
@kashifest @metal3-io-bot @tuminoid @mboukhalfa @lentzi90 @smoshiur1237