feat(container): update image couchdb ( 3.4.3 → 3.5.0 ) #3
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Scan Images | |
| on: | |
| pull_request: | |
| paths: | |
| - 'docker/**' | |
| - 'kubernetes/**' | |
| jobs: | |
| trivy-scan: | |
| runs-on: self-hosted | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5 | |
| - name: Extract changed images from PR diff | |
| id: images | |
| run: | | |
| # Fetch the base branch with sufficient history | |
| git fetch origin ${{ github.base_ref }}:refs/remotes/origin/${{ github.base_ref }} --depth=100 | |
| # Find merge base and create diff | |
| MERGE_BASE=$(git merge-base HEAD origin/${{ github.base_ref }}) | |
| echo "Using merge base: $MERGE_BASE" | |
| echo "=== Analyzing PR diff for container images ===" | |
| git diff $MERGE_BASE...HEAD --name-only | head -10 | |
| # Look for changes to k8s images | |
| repo=$(git diff $MERGE_BASE...HEAD | grep -E '^\+.*repository:' | sed -E 's/.*repository:[[:space:]]*([^[:space:]]+).*/\1/' | head -n1) | |
| tag=$(git diff $MERGE_BASE...HEAD | grep -E '^\+.*tag:' | sed -E 's/.*tag:[[:space:]]*([^[:space:]]+).*/\1/' | head -n1) | |
| echo "Found k8s repo: '$repo', tag: '$tag'" | |
| if [ -n "$repo" ] && [ -n "$tag" ]; then | |
| image="$repo:$tag" | |
| echo "Using k8s format: $image" | |
| else | |
| # Fall back to plain image: lines (docker-compose) | |
| image=$(git diff $MERGE_BASE...HEAD | grep -E '^\+.*image:' | sed -E 's/.*image:[[:space:]]*([^[:space:]#]+).*/\1/' | head -n1) | |
| echo "Raw image found: '$image'" | |
| # Clean up common prefixes and quotes | |
| image=$(echo "$image" | sed -E 's/^["\x27]//; s/["\x27]$//; s/^[[:space:]]*//; s/[[:space:]]*$//') | |
| echo "Cleaned image: '$image'" | |
| fi | |
| echo "Found image: $image" | |
| echo "image=$image" >> $GITHUB_OUTPUT | |
| # Set a flag to indicate if we should run the scan | |
| if [ -n "$image" ] && [ "$image" != "" ]; then | |
| echo "should_scan=true" >> $GITHUB_OUTPUT | |
| echo "Will scan image: $image" | |
| else | |
| echo "should_scan=false" >> $GITHUB_OUTPUT | |
| echo "No container images found in the diff, skipping Trivy scan" | |
| fi | |
| - name: Scan changed image with Trivy | |
| uses: aquasecurity/trivy-action@0.33.1 | |
| with: | |
| image-ref: ${{ steps.images.outputs.image }} | |
| format: 'sarif' | |
| output: 'trivy-results.sarif' | |
| severity: 'CRITICAL,HIGH' | |
| - name: Upload Trivy scan results to GitHub Security tab | |
| if: steps.images.outputs.should_scan == 'true' | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: 'trivy-results.sarif' |