Don't block PRs on grype reports #505
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release ARM artifacts | |
| on: | |
| push: | |
| tags: | |
| - v* | |
| permissions: read-all | |
| jobs: | |
| core: | |
| name: ${{ matrix.image_name }} | |
| uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@d8ac83e6ed2f143e5a4351f67fcfbceac9cb96c6 # v1.1.2 | |
| secrets: | |
| registry_username: ${{ secrets.QUAY_USERNAME }} | |
| registry_password: ${{ secrets.QUAY_PASSWORD }} | |
| permissions: | |
| id-token: write # OIDC support | |
| contents: write | |
| security-events: write | |
| actions: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| base_image: | |
| - "ghcr.io/kairos-io/hadron:v0.3.0" | |
| model: | |
| - "generic" | |
| - "rpi4" | |
| # Report-only: the scan still runs and reports, but criticals from the | |
| # upstream base image must not block releases. Mirrors master builds. | |
| security_scan_mode: ["report-only"] | |
| cleanup: [true] | |
| grype: [true] | |
| include: | |
| - image_name: "hadron" | |
| base_image: "ghcr.io/kairos-io/hadron:v0.3.0" | |
| model: "generic" | |
| cleanup: true | |
| grype: true | |
| custom_job_name_format: "core-arm64-generic" | |
| - image_name: "hadron" | |
| base_image: "ghcr.io/kairos-io/hadron:v0.3.0" | |
| model: "rpi4" | |
| cleanup: true | |
| grype: true | |
| custom_job_name_format: "core-arm64-rpi4" | |
| - model: "nvidia-jetson-agx-orin" | |
| image_name: "ubuntu:22.04" | |
| base_image: "ubuntu:22.04" | |
| security_scan_mode: "report-only" | |
| cleanup: true | |
| grype: true | |
| custom_job_name_format: "" | |
| - model: "nvidia-jetson-orin-nx" | |
| image_name: "ubuntu:22.04" | |
| base_image: "ubuntu:22.04" | |
| security_scan_mode: "report-only" | |
| cleanup: true | |
| grype: false # too many vulns under the L4T rootfs | |
| custom_job_name_format: "" | |
| with: | |
| auroraboot_version: "v0.19.4" | |
| dockerfile_path: "images/Dockerfile" | |
| base_image: ${{ matrix.base_image }} | |
| arch: "arm64" | |
| model: ${{ matrix.model }} | |
| version: "auto" | |
| no_cache: true | |
| registry_domain: "quay.io" | |
| registry_namespace: "kairos" | |
| grype: ${{ matrix.grype }} | |
| grype_sarif: ${{ matrix.grype }} | |
| trivy: true | |
| trivy_sarif: true | |
| security_scan_mode: ${{ matrix.security_scan_mode }} | |
| # Don't let the SARIF step fail report-only builds (e.g. upstream k3s | |
| # CVEs we can't control); enforce builds still fail on criticals. | |
| grype_sarif_fail_build: ${{ matrix.security_scan_mode != 'report-only' }} | |
| custom_job_name_format: ${{ matrix.custom_job_name_format }} | |
| list_release_artifacts: true | |
| cosign: true | |
| release: true | |
| iso: ${{ matrix.model == 'generic' }} # only produce ISOs for generic | |
| cleanup: ${{ matrix.cleanup }} | |
| get-k3s-versions: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| kubernetes_versions: ${{ steps.get-k3s-releases.outputs.kubernetes_versions }} | |
| steps: | |
| - run: | | |
| sudo apt update && sudo apt install -y jq curl | |
| - name: Get latest k3s releases | |
| id: get-k3s-releases | |
| run: | | |
| kubernetes_versions=$(curl -s https://api.github.com/repos/k3s-io/k3s/releases | jq -r ' | |
| [.[] | select(.prerelease == false and .draft == false and (.tag_name | test("rc") | not)) | .tag_name] | |
| | map({ | |
| version: ., | |
| minor: (split(".")[1:2]|join("")), | |
| patch: (split(".")[2:3]|join("")|split("+")[0]), | |
| revision: (split("+k3s")[1]) | |
| }) | |
| | group_by(.minor) | |
| | map(sort_by([(.patch | tonumber), (.revision | tonumber)]) | reverse | .[0]) | |
| | sort_by(.minor | tonumber) | |
| | reverse | |
| | .[0:3] | |
| | map(.version) | |
| ' | jq -c '.') | |
| echo "kubernetes_versions=$kubernetes_versions" >> $GITHUB_OUTPUT | |
| standard: | |
| name: ${{ matrix.image_name }} | |
| uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@d8ac83e6ed2f143e5a4351f67fcfbceac9cb96c6 # v1.1.2 | |
| secrets: | |
| registry_username: ${{ secrets.QUAY_USERNAME }} | |
| registry_password: ${{ secrets.QUAY_PASSWORD }} | |
| needs: | |
| - get-k3s-versions | |
| permissions: | |
| id-token: write # OIDC support | |
| contents: write | |
| security-events: write | |
| actions: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| kubernetes_version: ${{ fromJson(needs.get-k3s-versions.outputs.kubernetes_versions) }} | |
| base_image: | |
| - "ghcr.io/kairos-io/hadron:v0.3.0" | |
| model: | |
| - "generic" | |
| - "rpi4" | |
| image_name: | |
| - "hadron" | |
| security_scan_mode: ["report-only"] | |
| cleanup: [false] | |
| grype: [true] | |
| custom_job_name_format: | |
| - "standard-arm64-generic-k3s" | |
| - "standard-arm64-rpi4-k3s" | |
| exclude: | |
| - model: "generic" | |
| custom_job_name_format: "standard-arm64-rpi4-k3s" | |
| - model: "rpi4" | |
| custom_job_name_format: "standard-arm64-generic-k3s" | |
| include: | |
| - model: "nvidia-jetson-agx-orin" | |
| image_name: "ubuntu:22.04" | |
| base_image: "ubuntu:22.04" | |
| security_scan_mode: "report-only" | |
| cleanup: true | |
| grype: true | |
| custom_job_name_format: "" | |
| - model: "nvidia-jetson-orin-nx" | |
| image_name: "ubuntu:22.04" | |
| base_image: "ubuntu:22.04" | |
| security_scan_mode: "report-only" | |
| cleanup: true | |
| grype: false # too many vulns under the L4T rootfs | |
| custom_job_name_format: "" | |
| with: | |
| auroraboot_version: "v0.19.4" | |
| dockerfile_path: "images/Dockerfile" | |
| base_image: ${{ matrix.base_image }} | |
| arch: "arm64" | |
| model: ${{ matrix.model }} | |
| kubernetes_version: ${{ matrix.kubernetes_version }} | |
| kubernetes_distro: "k3s" | |
| version: "auto" | |
| no_cache: true | |
| registry_domain: "quay.io" | |
| registry_namespace: "kairos" | |
| iso: ${{ matrix.model == 'generic' }} # only produce ISOs for generic | |
| grype: ${{ matrix.grype }} | |
| grype_sarif: ${{ matrix.grype }} | |
| trivy: true | |
| trivy_sarif: true | |
| security_scan_mode: ${{ matrix.security_scan_mode }} | |
| # Don't let the SARIF step fail report-only builds (e.g. upstream k3s | |
| # CVEs we can't control); enforce builds still fail on criticals. | |
| grype_sarif_fail_build: ${{ matrix.security_scan_mode != 'report-only' }} | |
| custom_job_name_format: ${{ matrix.custom_job_name_format }} | |
| list_release_artifacts: true | |
| cosign: true | |
| release: true | |
| cleanup: ${{ matrix.cleanup }} |