chore(container): update image ghcr.io/siderolabs/omni ( v1.6.1 → v1.6.2 ) #1140
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Trivy Vulnerability Scan | |
| on: | |
| pull_request: | |
| paths: | |
| - "docker/**" | |
| - "kubernetes/**" | |
| workflow_dispatch: | |
| inputs: | |
| image: | |
| description: "Container image to scan (e.g., nginx:latest)" | |
| required: true | |
| type: string | |
| permissions: | |
| contents: read | |
| security-events: write | |
| pull-requests: write | |
| issues: write | |
| jobs: | |
| trivy-scan: | |
| runs-on: self-hosted | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| - name: Fetch all history for git diff | |
| run: | | |
| if [ "$(git rev-parse --is-shallow-repository)" = "true" ]; then | |
| git fetch --unshallow | |
| else | |
| git fetch --depth=2 | |
| fi | |
| - name: Extract changed images from PR diff | |
| id: images | |
| run: | | |
| # Worflow dispatch triggered manually | |
| if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then | |
| image="${{ inputs.image }}" | |
| echo "Manual scan requested for image: $image" | |
| echo "image=$image" >> $GITHUB_OUTPUT | |
| echo "should_scan=true" >> $GITHUB_OUTPUT | |
| echo "is_manual=true" >> $GITHUB_OUTPUT | |
| exit 0 | |
| fi | |
| echo "=== Analyzing PR diff for container images ===" | |
| # Get all changed files in docker/ and kubernetes/ | |
| changed_files=$(git diff --name-only HEAD~1 HEAD | grep -E '^(docker|kubernetes)/' || true) | |
| echo "Changed files: $changed_files" | |
| if [ -z "$changed_files" ]; then | |
| echo "No docker or kubernetes files changed" | |
| echo "should_scan=false" >> $GITHUB_OUTPUT | |
| exit 0 | |
| fi | |
| # Look for changes to k8s images in the actual diff | |
| repo=$(git diff HEAD~1 HEAD | grep -E '^\+.*repository:' | sed -E 's/.*repository:[[:space:]]*([^[:space:]]+).*/\1/' | head -n1) | |
| tag=$(git diff HEAD~1 HEAD | grep -E '^\+.*tag:' | sed -E 's/.*tag:[[:space:]]*([^[:space:]]+).*/\1/' | head -n1) | |
| echo "Found k8s repo: '$repo', tag: '$tag'" | |
| if [ -n "$repo" ] && [ -n "$tag" ]; then | |
| image="$repo:$tag" | |
| echo "Using k8s format: $image" | |
| else | |
| # Fall back to plain image: lines (docker-compose) | |
| image=$(git diff HEAD~1 HEAD | grep -E '^\+.*image:' | sed -E 's/.*image:[[:space:]]*([^[:space:]#]+).*/\1/' | head -n1) | |
| echo "Raw image found: '$image'" | |
| # Clean up common prefixes and quotes | |
| image=$(echo "$image" | sed -E 's/^["\x27]//; s/["\x27]$//; s/^[[:space:]]*//; s/[[:space:]]*$//') | |
| echo "Cleaned image: '$image'" | |
| fi | |
| echo "Found image: $image" | |
| echo "image=$image" >> $GITHUB_OUTPUT | |
| echo "is_manual=false" >> $GITHUB_OUTPUT | |
| # Set a flag to indicate if we should run the scan | |
| if [ -n "$image" ] && [ "$image" != "" ]; then | |
| echo "should_scan=true" >> $GITHUB_OUTPUT | |
| echo "Will scan image: $image" | |
| else | |
| echo "should_scan=false" >> $GITHUB_OUTPUT | |
| echo "No container images found in the diff, skipping Trivy scan" | |
| fi | |
| - name: Scan changed image with Trivy | |
| if: steps.images.outputs.should_scan == 'true' | |
| uses: aquasecurity/trivy-action@0.35.0 | |
| with: | |
| image-ref: ${{ steps.images.outputs.image }} | |
| format: "sarif" | |
| output: "trivy-results.sarif" | |
| severity: "CRITICAL,HIGH" | |
| scanners: "vuln" | |
| - name: Upload Trivy scan results to GitHub Security tab | |
| if: steps.images.outputs.should_scan == 'true' | |
| uses: github/codeql-action/upload-sarif@v4 | |
| with: | |
| sarif_file: "trivy-results.sarif" | |
| - name: Comment PR with link to security scan | |
| if: steps.images.outputs.should_scan == 'true' && steps.images.outputs.is_manual != 'true' | |
| uses: mshick/add-pr-comment@v3 | |
| with: | |
| message-id: trivy-scan-${{ github.event.pull_request.number }} | |
| message: | | |
| ## 🛡️ Trivy Security Scan Complete | |
| **Scanned Image:** `${{ steps.images.outputs.image }}` | |
| 📊 **[View Security Scan Results](https://github.com/${{ github.repository }}/security/code-scanning?query=pr%3A${{ github.event.pull_request.number }}+tool%3ATrivy+is%3Aopen)** | |
| _Results are available in the Security tab above._ |