Don't block releases on CVEs of k3s/k0s (on sarif scan)

Signed-off-by: Dimitris Karakasilis <dimitris@karakasilis.me>

Author: jimmykarily

.github/workflows/image-master-arm.yaml

@@ -17,7 +17,7 @@ concurrency:
 jobs:
   build:
     name: ${{ matrix.image_name }}
-    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@84ea9b020bdd470081b235a1a99147a98d32c989 # v1.1.1
+    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@d8ac83e6ed2f143e5a4351f67fcfbceac9cb96c6 # v1.1.2
     secrets:
       registry_username: ${{ secrets.QUAY_USERNAME }}
       registry_password: ${{ secrets.QUAY_PASSWORD }}

.github/workflows/image-master.yaml

@@ -16,7 +16,7 @@ concurrency:
 jobs:
   build:
     name: ${{ matrix.image_name }}
-    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@84ea9b020bdd470081b235a1a99147a98d32c989 # v1.1.1
+    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@d8ac83e6ed2f143e5a4351f67fcfbceac9cb96c6 # v1.1.2
     secrets:
       registry_username: ${{ secrets.QUAY_USERNAME }}
       registry_password: ${{ secrets.QUAY_PASSWORD }}

.github/workflows/image-pr-arm.yaml

@@ -14,7 +14,7 @@ concurrency:
 jobs:
   build:
     name: ${{ matrix.image_name }}
-    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@84ea9b020bdd470081b235a1a99147a98d32c989 # v1.1.1
+    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@d8ac83e6ed2f143e5a4351f67fcfbceac9cb96c6 # v1.1.2
     secrets:
       registry_username: ${{ secrets.QUAY_USERNAME }}
       registry_password: ${{ secrets.QUAY_PASSWORD }}

.github/workflows/image-pr.yaml

@@ -14,7 +14,7 @@ concurrency:
 jobs:
   build:
     name: ${{ matrix.image_name }}
-    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@84ea9b020bdd470081b235a1a99147a98d32c989 # v1.1.1
+    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@d8ac83e6ed2f143e5a4351f67fcfbceac9cb96c6 # v1.1.2
     secrets:
       registry_username: ${{ secrets.QUAY_USERNAME }}
       registry_password: ${{ secrets.QUAY_PASSWORD }}

.github/workflows/release-arm.yaml

@@ -8,7 +8,7 @@ permissions: read-all
 jobs:
   core:
     name: ${{ matrix.image_name }}
-    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@84ea9b020bdd470081b235a1a99147a98d32c989 # v1.1.1
+    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@d8ac83e6ed2f143e5a4351f67fcfbceac9cb96c6 # v1.1.2
     secrets:
       registry_username: ${{ secrets.QUAY_USERNAME }}
       registry_password: ${{ secrets.QUAY_PASSWORD }}
@@ -70,6 +70,9 @@ jobs:
       trivy: true
       trivy_sarif: true
       security_scan_mode: ${{ matrix.security_scan_mode }}
+      # Don't let the SARIF step fail report-only builds (e.g. upstream k3s
+      # CVEs we can't control); enforce builds still fail on criticals.
+      grype_sarif_fail_build: ${{ matrix.security_scan_mode != 'report-only' }}
       custom_job_name_format: ${{ matrix.custom_job_name_format }}
       list_release_artifacts: true
       cosign: true
@@ -104,7 +107,7 @@ jobs:
           echo "kubernetes_versions=$kubernetes_versions" >> $GITHUB_OUTPUT
   standard:
     name: ${{ matrix.image_name }}
-    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@84ea9b020bdd470081b235a1a99147a98d32c989 # v1.1.1
+    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@d8ac83e6ed2f143e5a4351f67fcfbceac9cb96c6 # v1.1.2
     secrets:
       registry_username: ${{ secrets.QUAY_USERNAME }}
       registry_password: ${{ secrets.QUAY_PASSWORD }}
@@ -170,6 +173,9 @@ jobs:
       trivy: true
       trivy_sarif: true
       security_scan_mode: ${{ matrix.security_scan_mode }}
+      # Don't let the SARIF step fail report-only builds (e.g. upstream k3s
+      # CVEs we can't control); enforce builds still fail on criticals.
+      grype_sarif_fail_build: ${{ matrix.security_scan_mode != 'report-only' }}
       custom_job_name_format: ${{ matrix.custom_job_name_format }}
       list_release_artifacts: true
       cosign: true

.github/workflows/release.yaml

@@ -8,7 +8,7 @@ permissions: read-all
 jobs:
   core:
     name: ${{ matrix.image_name }}
-    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@84ea9b020bdd470081b235a1a99147a98d32c989 # v1.1.1
+    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@d8ac83e6ed2f143e5a4351f67fcfbceac9cb96c6 # v1.1.2
     permissions:
       id-token: write  # OIDC support
       contents: write
@@ -108,7 +108,7 @@ jobs:
 
   standard-k3s:
     name: ${{ matrix.image_name }}
-    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@84ea9b020bdd470081b235a1a99147a98d32c989 # v1.1.1
+    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@d8ac83e6ed2f143e5a4351f67fcfbceac9cb96c6 # v1.1.2
     needs:
       - get-k3s-versions
     permissions:
@@ -145,13 +145,16 @@ jobs:
       trivy: true
       trivy_sarif: true
       security_scan_mode: "report-only"
+      # k3s CVEs come from upstream and are out of our control; the SARIF
+      # step must not fail the release. Gating is left to security_scan_mode.
+      grype_sarif_fail_build: false
       custom_job_name_format: "standard-amd64-generic-k3s"
       list_release_artifacts: true
       cosign: true
       release: true
   standard-k0s:
     name: ${{ matrix.image_name }}
-    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@84ea9b020bdd470081b235a1a99147a98d32c989 # v1.1.1
+    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@d8ac83e6ed2f143e5a4351f67fcfbceac9cb96c6 # v1.1.2
     needs:
       - get-k0s-versions
     permissions:
@@ -188,6 +191,9 @@ jobs:
       trivy: true
       trivy_sarif: true
       security_scan_mode: "report-only"
+      # k0s CVEs come from upstream and are out of our control; the SARIF
+      # step must not fail the release. Gating is left to security_scan_mode.
+      grype_sarif_fail_build: false
       custom_job_name_format: "standard-amd64-generic-k0s"
       list_release_artifacts: true
       cosign: true

.github/workflows/uki.yaml

@@ -16,7 +16,7 @@ concurrency:
 jobs:
   build:
     name: ${{ matrix.image_name }}
-    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@84ea9b020bdd470081b235a1a99147a98d32c989 # v1.1.1
+    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@d8ac83e6ed2f143e5a4351f67fcfbceac9cb96c6 # v1.1.2
     secrets:
       registry_username: ${{ secrets.QUAY_USERNAME }}
       registry_password: ${{ secrets.QUAY_PASSWORD }}