[Release-1.30] - [Maintenance] Ingress Nginx image version bump #576
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: PR Comment Triggered Trivy Scan | |
| on: | |
| issue_comment: | |
| types: [created] | |
| jobs: | |
| trivy_scan: | |
| if: github.event.issue.pull_request && github.event.comment.body == '/trivy' && github.event.issue.state == 'open' | |
| runs-on: runs-on,runner=8cpu-linux-x64,run-id=${{ github.run_id }} | |
| permissions: | |
| pull-requests: read | |
| steps: | |
| - name: Check if comment author is a public member of rancher organization | |
| uses: actions/github-script@v7 | |
| with: | |
| # Catch 404 errors if user is not a member of the organization | |
| # 302 is expected as the GHA is not a member of the organization | |
| # Users must be set their membership to public for this to work | |
| # https://github.com/orgs/rancher/people | |
| script: | | |
| const org = context.repo.owner; | |
| const username = context.payload.comment.user.login; | |
| try { | |
| const result = await github.rest.orgs.checkMembershipForUser({ | |
| org, | |
| username, | |
| }); | |
| } catch (error) { | |
| core.setFailed(`User ${username} is not an public member of the ${org} organization`); | |
| } | |
| - name: Checkout PR code | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: refs/pull/${{ github.event.issue.number }}/head | |
| # We don't care about the go version, as we only use it to capture ENV vars | |
| - name: Install Go | |
| uses: ./.github/actions/setup-go | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Build RKE2 Image | |
| id: build-image | |
| run: | | |
| SKIP_WINDOWS=true make build-image-runtime | |
| TAG=$(docker images --format "{{.Repository}}:{{.Tag}} {{.CreatedAt}}" | grep "rancher/rke2-runtime" | sort -k2 -r | head -n1 | awk '{print $1}') | |
| echo "TAG=${TAG}" >> "$GITHUB_OUTPUT" | |
| - name: Download Rancher's VEX Hub report | |
| run: curl -fsSO https://raw.githubusercontent.com/rancher/vexhub/refs/heads/main/reports/rancher.openvex.json | |
| - name: Run Trivy on image | |
| uses: aquasecurity/trivy-action@0.28.0 | |
| with: | |
| image-ref: '${{ steps.build-image.outputs.TAG }}' | |
| format: 'table' | |
| severity: "HIGH,CRITICAL" | |
| output: "trivy-image-report.txt" | |
| env: | |
| TRIVY_VEX: rancher.openvex.json | |
| TRIVY_SHOW_SUPPRESSED: true | |
| - name: Run Trivy on filesystem | |
| uses: aquasecurity/trivy-action@0.28.0 | |
| with: | |
| scan-type: 'fs' | |
| scan-ref: '.' | |
| severity: "HIGH,CRITICAL" | |
| output: "trivy-fs-report.txt" | |
| env: | |
| TRIVY_VEX: rancher.openvex.json | |
| TRIVY_SHOW_SUPPRESSED: true | |
| - name: Upload Trivy Reports | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: trivy-report | |
| path: | | |
| trivy-image-report.txt | |
| trivy-fs-report.txt | |
| retention-days: 2 | |
| if-no-files-found: error | |
| trivy_report: | |
| needs: trivy_scan | |
| runs-on: runs-on,runner=8cpu-linux-x64,run-id=${{ github.run_id }} | |
| permissions: | |
| pull-requests: write | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| GH_REPO: ${{ github.repository }} | |
| steps: | |
| - name: Download Trivy Report | |
| uses: actions/download-artifact@v4 | |
| with: | |
| name: trivy-report | |
| - name: Add Trivy Report to PR | |
| run: | | |
| cat trivy-image-report.txt trivy-fs-report.txt > trivy-report.txt | |
| if [ -s trivy-report.txt ] && [ -n "$(grep -v '^\s*$' trivy-report.txt)" ]; then | |
| echo '```' | cat - trivy-report.txt > temp && mv temp trivy-report.txt | |
| echo '```' >> trivy-report.txt | |
| gh issue comment ${{ github.event.issue.number }} -F trivy-report.txt | |
| else | |
| echo ':star2: No High or Critical CVEs Found :star2:' > trivy-report.txt | |
| gh issue comment ${{ github.event.issue.number }} -F trivy-report.txt | |
| fi | |
| trivy_failure: | |
| needs: trivy_scan | |
| runs-on: runs-on,runner=8cpu-linux-x64,run-id=${{ github.run_id }} | |
| if: always() && needs.trivy_scan.result == 'failure' | |
| permissions: | |
| pull-requests: write | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| GH_REPO: ${{ github.repository }} | |
| steps: | |
| - name: Report Failure | |
| run: | | |
| gh issue comment ${{ github.event.issue.number }} -b ":x: Trivy scan action failed, check logs :x:" |