Skip to content

Commit 5b1978c

Browse files
pdabelf5pdabelf5
authored
Run Trivy & DockerScout on main & release branches (#5818)
1 parent c718c3e commit 5b1978c

File tree

2 files changed

+272
-1
lines changed

2 files changed

+272
-1
lines changed

‎.github/workflows/build-plus.yml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,6 @@ jobs:
4949
build:
5050
permissions:
5151
contents: read # for docker/build-push-action to read repo content
52-
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
5352
id-token: write # for OIDC login to AWS
5453
pull-requests: write # for scout report
5554
runs-on: ubuntu-22.04

‎.github/workflows/image-promotion.yml

Lines changed: 272 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ name: Image Promotion
55
# - tag edge for main workflows
66
# - tag release branch name for release branch workflows
77
# - release edge images & helm charts for edge
8+
# - run Trivy & dockerscout scans for main & release branch images
9+
# & upload results to Github security & Github Artifacts
810

911
on:
1012
push:
@@ -338,3 +340,273 @@ jobs:
338340
image: quay.io/nginx/nginx-ingress:edge-ubi
339341
project_id: ${{ secrets.CERTIFICATION_PROJECT_ID }}
340342
pyxis_token: ${{ secrets.PYXIS_API_TOKEN }}
343+
344+
scan-docker-oss:
345+
name: Scan Docker OSS
346+
runs-on: ubuntu-22.04
347+
needs: [checks]
348+
permissions:
349+
contents: read
350+
id-token: write
351+
security-events: write
352+
if: ${{ !cancelled() && !failure() }}
353+
strategy:
354+
fail-fast: false
355+
matrix: ${{ fromJSON( needs.checks.outputs.image_matrix_oss ) }}
356+
steps:
357+
- name: Checkout Repository
358+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
359+
360+
- name: Make directory for security scan results
361+
id: directory
362+
run: |
363+
directory=${{ matrix.image }}-${{ matrix.target }}-results
364+
echo "directory=${directory}" >> $GITHUB_OUTPUT
365+
mkdir -p "${directory}"
366+
367+
- name: Docker meta
368+
id: meta
369+
uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
370+
with:
371+
context: workflow
372+
images: |
373+
name=gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic/nginx-ingress
374+
flavor: |
375+
suffix=${{ contains(matrix.image, 'ubi') && '-ubi' || '' }}${{ contains(matrix.image, 'alpine') && '-alpine' || '' }}
376+
tags: |
377+
type=raw,value=${{ github.ref_name == github.event.repository.default_branch && 'edge' || github.ref_name }}
378+
379+
- name: Authenticate to Google Cloud
380+
id: auth
381+
uses: google-github-actions/auth@71fee32a0bb7e97b4d33d548e7d957010649d8fa # v2.1.3
382+
with:
383+
token_format: access_token
384+
workload_identity_provider: ${{ secrets.GCR_WORKLOAD_IDENTITY }}
385+
service_account: ${{ secrets.GCR_SERVICE_ACCOUNT }}
386+
387+
- name: Login to GCR
388+
uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3.2.0
389+
with:
390+
registry: gcr.io
391+
username: oauth2accesstoken
392+
password: ${{ steps.auth.outputs.access_token }}
393+
394+
- name: Run Trivy vulnerability scanner
395+
uses: aquasecurity/trivy-action@7c2007bcb556501da015201bcba5aa14069b74e2 # 0.23.0
396+
continue-on-error: true
397+
with:
398+
image-ref: ${{ steps.meta.outputs.tags }}
399+
format: "sarif"
400+
output: "${{ steps.directory.outputs.directory }}/trivy.sarif"
401+
ignore-unfixed: "true"
402+
403+
- name: DockerHub Login for Docker Scount
404+
uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3.2.0
405+
with:
406+
username: ${{ secrets.DOCKER_USERNAME }}
407+
password: ${{ secrets.DOCKER_PASSWORD }}
408+
409+
- name: Run Docker Scout vulnerability scanner
410+
id: docker-scout
411+
uses: docker/scout-action@fc749439af4870e8f6feb592250ab728600d10a6 # v1.10.0
412+
with:
413+
command: cves,recommendations
414+
image: ${{ steps.meta.outputs.tags }}
415+
ignore-base: true
416+
only-fixed: true
417+
sarif-file: "${{ steps.directory.outputs.directory }}/scout.sarif"
418+
write-comment: false
419+
github-token: ${{ secrets.GITHUB_TOKEN }} # to be able to write the comment
420+
summary: true
421+
422+
- name: Upload Scan Results to Github Artifacts
423+
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
424+
with:
425+
name: "${{ github.ref_name }}-${{ steps.directory.outputs.directory }}"
426+
path: "${{ steps.directory.outputs.directory }}/"
427+
overwrite: true
428+
429+
- name: Upload Scan results to GitHub Security tab
430+
uses: github/codeql-action/upload-sarif@3ab4101902695724f9365a384f86c1074d94e18c # v3.24.7
431+
with:
432+
sarif_file: "${{ steps.directory.outputs.directory }}/"
433+
434+
scan-docker-plus:
435+
name: Scan Docker Plus
436+
runs-on: ubuntu-22.04
437+
needs: [checks]
438+
permissions:
439+
contents: read
440+
id-token: write
441+
security-events: write
442+
if: ${{ !cancelled() && !failure() }}
443+
strategy:
444+
fail-fast: false
445+
matrix: ${{ fromJSON( needs.checks.outputs.image_matrix_plus ) }}
446+
steps:
447+
- name: Checkout Repository
448+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
449+
450+
- name: Make directory for security scan results
451+
id: directory
452+
run: |
453+
directory=${{ matrix.image }}-${{ matrix.target }}-results
454+
echo "directory=${directory}" >> $GITHUB_OUTPUT
455+
mkdir -p "${directory}"
456+
457+
- name: Docker meta
458+
id: meta
459+
uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
460+
with:
461+
context: workflow
462+
images: |
463+
name=gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic/nginx-plus-ingress
464+
flavor: |
465+
suffix=${{ contains(matrix.image, 'ubi') && '-ubi' || '' }}${{ contains(matrix.image, 'alpine') && '-alpine' || '' }}${{ contains(matrix.target, 'aws') && '-mktpl' || '' }}${{ contains(matrix.image, 'fips') && '-fips' || ''}}
466+
tags: |
467+
type=raw,value=${{ github.ref_name == github.event.repository.default_branch && 'edge' || github.ref_name }}
468+
469+
- name: Authenticate to Google Cloud
470+
id: auth
471+
uses: google-github-actions/auth@71fee32a0bb7e97b4d33d548e7d957010649d8fa # v2.1.3
472+
with:
473+
token_format: access_token
474+
workload_identity_provider: ${{ secrets.GCR_WORKLOAD_IDENTITY }}
475+
service_account: ${{ secrets.GCR_SERVICE_ACCOUNT }}
476+
477+
- name: Login to GCR
478+
uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3.2.0
479+
with:
480+
registry: gcr.io
481+
username: oauth2accesstoken
482+
password: ${{ steps.auth.outputs.access_token }}
483+
484+
- name: Run Trivy vulnerability scanner
485+
uses: aquasecurity/trivy-action@7c2007bcb556501da015201bcba5aa14069b74e2 # 0.23.0
486+
continue-on-error: true
487+
with:
488+
image-ref: ${{ steps.meta.outputs.tags }}
489+
format: "sarif"
490+
output: "${{ steps.directory.outputs.directory }}/trivy.sarif"
491+
ignore-unfixed: "true"
492+
493+
- name: DockerHub Login for Docker Scount
494+
uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3.2.0
495+
with:
496+
username: ${{ secrets.DOCKER_USERNAME }}
497+
password: ${{ secrets.DOCKER_PASSWORD }}
498+
499+
- name: Run Docker Scout vulnerability scanner
500+
id: docker-scout
501+
uses: docker/scout-action@fc749439af4870e8f6feb592250ab728600d10a6 # v1.10.0
502+
with:
503+
command: cves,recommendations
504+
image: ${{ steps.meta.outputs.tags }}
505+
ignore-base: true
506+
only-fixed: true
507+
sarif-file: "${{ steps.directory.outputs.directory }}/scout.sarif"
508+
write-comment: false
509+
github-token: ${{ secrets.GITHUB_TOKEN }} # to be able to write the comment
510+
summary: true
511+
512+
- name: Upload Scan Results to Github Artifacts
513+
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
514+
with:
515+
name: "${{ github.ref_name }}-${{ steps.directory.outputs.directory }}"
516+
path: "${{ steps.directory.outputs.directory }}/"
517+
overwrite: true
518+
519+
- name: Upload Scan results to GitHub Security tab
520+
uses: github/codeql-action/upload-sarif@3ab4101902695724f9365a384f86c1074d94e18c # v3.24.7
521+
with:
522+
sarif_file: "${{ steps.directory.outputs.directory }}/"
523+
524+
scan-docker-nap:
525+
name: Scan Docker Plus + NAP WAF/DOS
526+
runs-on: ubuntu-22.04
527+
needs: [checks]
528+
permissions:
529+
contents: read
530+
id-token: write
531+
security-events: write
532+
if: ${{ !cancelled() && !failure() }}
533+
strategy:
534+
fail-fast: false
535+
matrix: ${{ fromJSON( needs.checks.outputs.image_matrix_nap ) }}
536+
steps:
537+
- name: Checkout Repository
538+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
539+
540+
- name: Make directory for security scan results
541+
id: directory
542+
run: |
543+
directory=${{ matrix.image }}-${{ matrix.target }}-results
544+
echo "directory=${directory}" >> $GITHUB_OUTPUT
545+
mkdir -p "${directory}"
546+
547+
- name: Docker meta
548+
id: meta
549+
uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
550+
with:
551+
context: workflow
552+
images: |
553+
name=gcr.io/f5-gcs-7899-ptg-ingrss-ctlr/dev/nginx-ic${{ contains(matrix.nap_modules, 'dos') && '-dos' || '' }}${{ contains(matrix.nap_modules, 'waf') && '-nap' || '' }}${{ contains(matrix.image, 'v5') && '-v5' || '' }}/nginx-plus-ingress
554+
flavor: |
555+
suffix=${{ contains(matrix.image, 'ubi') && '-ubi' || '' }}${{ contains(matrix.image, 'alpine') && '-alpine' || '' }}${{ contains(matrix.target, 'aws') && '-mktpl' || '' }}${{ contains(matrix.image, 'fips') && '-fips' || ''}}
556+
tags: |
557+
type=raw,value=${{ github.ref_name == github.event.repository.default_branch && 'edge' || github.ref_name }}
558+
559+
- name: Authenticate to Google Cloud
560+
id: auth
561+
uses: google-github-actions/auth@71fee32a0bb7e97b4d33d548e7d957010649d8fa # v2.1.3
562+
with:
563+
token_format: access_token
564+
workload_identity_provider: ${{ secrets.GCR_WORKLOAD_IDENTITY }}
565+
service_account: ${{ secrets.GCR_SERVICE_ACCOUNT }}
566+
567+
- name: Login to GCR
568+
uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3.2.0
569+
with:
570+
registry: gcr.io
571+
username: oauth2accesstoken
572+
password: ${{ steps.auth.outputs.access_token }}
573+
574+
- name: Run Trivy vulnerability scanner
575+
uses: aquasecurity/trivy-action@7c2007bcb556501da015201bcba5aa14069b74e2 # 0.23.0
576+
continue-on-error: true
577+
with:
578+
image-ref: ${{ steps.meta.outputs.tags }}
579+
format: "sarif"
580+
output: "${{ steps.directory.outputs.directory }}/trivy.sarif"
581+
ignore-unfixed: "true"
582+
583+
- name: DockerHub Login for Docker Scount
584+
uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3.2.0
585+
with:
586+
username: ${{ secrets.DOCKER_USERNAME }}
587+
password: ${{ secrets.DOCKER_PASSWORD }}
588+
589+
- name: Run Docker Scout vulnerability scanner
590+
id: docker-scout
591+
uses: docker/scout-action@fc749439af4870e8f6feb592250ab728600d10a6 # v1.10.0
592+
with:
593+
command: cves,recommendations
594+
image: ${{ steps.meta.outputs.tags }}
595+
ignore-base: true
596+
only-fixed: true
597+
sarif-file: "${{ steps.directory.outputs.directory }}/scout.sarif"
598+
write-comment: false
599+
github-token: ${{ secrets.GITHUB_TOKEN }} # to be able to write the comment
600+
summary: true
601+
602+
- name: Upload Scan Results to Github Artifacts
603+
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
604+
with:
605+
name: "${{ github.ref_name }}-${{ steps.directory.outputs.directory }}"
606+
path: "${{ steps.directory.outputs.directory }}/"
607+
overwrite: true
608+
609+
- name: Upload Scan results to GitHub Security tab
610+
uses: github/codeql-action/upload-sarif@3ab4101902695724f9365a384f86c1074d94e18c # v3.24.7
611+
with:
612+
sarif_file: "${{ steps.directory.outputs.directory }}/"

0 commit comments

Comments
 (0)