CVE Scan - Container Images #19
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-FileCopyrightText: SUSE LLC | |
| # SPDX-License-Identifier: Apache-2.0 | |
| name: CVE Scan - Container Images | |
| on: | |
| push: | |
| branches: | |
| - "main" | |
| workflow_dispatch: | |
| schedule: | |
| - cron: '47 2 * * *' # every day at 2:47 AM | |
| timezone: "Europe/Madrid" | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| HELM_VERSION: v4.2.0 # https://github.com/helm/helm/releases | |
| SEMVER_VERSION: 1a547a75f946717223fb7ca821ba6f3f337e9aca # https://api.github.com/repos/fsaintjacques/semver-tool/commits?per_page=1 | |
| CYCLONEDX_VERSION: sha256:dc5a886c592c49076ce09079433e961be94f1bb8521f837c1467b585b33f67e1 # v0.32.0 - https://hub.docker.com/r/cyclonedx/cyclonedx-cli/tags | |
| TRIVY_VERSION: v0.71.2 # https://github.com/aquasecurity/trivy/releases | |
| jobs: | |
| extract-images: | |
| name: Extract Container Images | |
| runs-on: ubuntu-24.04 | |
| outputs: | |
| images: ${{ steps.extract.outputs.images }} | |
| chart-name: ${{ steps.metadata.outputs.name }} | |
| chart-version: ${{ steps.metadata.outputs.version }} | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - name: Install Helm | |
| uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5 | |
| with: | |
| version: ${{ env.HELM_VERSION }} | |
| - name: Extract chart metadata | |
| id: metadata | |
| shell: bash | |
| run: | | |
| source "${{ github.workspace }}/.github/scripts/helpers.sh" | |
| extract_chart_metadata "$DEFAULT_CHART_PATH" | |
| - name: Extract images from Helm chart | |
| id: extract | |
| shell: bash | |
| run: | | |
| source "${{ github.workspace }}/.github/scripts/helpers.sh" | |
| IMAGES=$(extract_all_images "$DEFAULT_CHART_PATH") | |
| echo "images=${IMAGES}" >> $GITHUB_OUTPUT | |
| log_info "Extracted images:" | |
| echo "$IMAGES" | jq '.[]' | |
| setup-trivy-db: | |
| name: Setup Trivy Database | |
| needs: extract-images | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: Download Trivy DBs | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| scan-type: image | |
| image-ref: registry.suse.com/bci/bci-micro # dummy image to trigger DB download | |
| version: ${{ env.TRIVY_VERSION }} | |
| cache: true | |
| scan-images: | |
| name: Scan Image for CVEs | |
| needs: [extract-images, setup-trivy-db] | |
| runs-on: ubuntu-24.04 | |
| strategy: | |
| matrix: | |
| image: ${{ fromJson(needs.extract-images.outputs.images) }} | |
| permissions: | |
| contents: read | |
| security-events: write | |
| env: | |
| TRIVY_SKIP_DB_UPDATE: "true" | |
| TRIVY_SKIP_JAVA_DB_UPDATE: "true" | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| sparse-checkout: .github | |
| sparse-checkout-cone-mode: false | |
| - name: Sanitize image name for filename | |
| id: sanitize | |
| shell: bash | |
| run: | | |
| source "${{ github.workspace }}/.github/scripts/helpers.sh" | |
| generate_image_info "${{ matrix.image }}" | |
| - name: Run Trivy vulnerability scanner | |
| id: trivy-scan | |
| continue-on-error: true | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| image-ref: ${{ matrix.image }} | |
| format: "sarif" | |
| output: "${{ steps.sanitize.outputs.safe_name }}-trivy-results.sarif" | |
| severity: "CRITICAL,HIGH" | |
| version: ${{ env.TRIVY_VERSION }} | |
| cache: true | |
| - name: Alert on scan failure | |
| if: steps.trivy-scan.outcome == 'failure' | |
| run: | | |
| echo "⚠️ WARNING: Failed to scan image: ${{ matrix.image }}" | |
| echo "This may indicate the image is unavailable or has been removed from the registry." | |
| echo "Please verify the image source and availability." | |
| - name: Scan for SBOM | |
| id: sbom-scan | |
| continue-on-error: true | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| image-ref: ${{ matrix.image }} | |
| format: "cyclonedx" | |
| output: "${{ steps.sanitize.outputs.safe_name }}-sbom.json" | |
| version: ${{ env.TRIVY_VERSION }} | |
| cache: true | |
| - name: Alert on SBOM scan failure | |
| if: steps.sbom-scan.outcome == 'failure' | |
| run: | | |
| echo "⚠️ WARNING: Failed to generate SBOM for image: ${{ matrix.image }}" | |
| echo "This may indicate the image is unavailable or has been removed from the registry." | |
| echo "Please verify the image source and availability." | |
| - name: Upload SBOM artifact | |
| if: steps.sbom-scan.outcome == 'success' | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: sbom-${{ steps.sanitize.outputs.safe_name }} | |
| path: ${{ steps.sanitize.outputs.safe_name }}-sbom.json | |
| - name: Upload temporary SARIF artifact | |
| if: steps.trivy-scan.outcome == 'success' | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: sarif-${{ steps.sanitize.outputs.safe_name }} | |
| path: | | |
| ${{ steps.sanitize.outputs.safe_name }}-trivy-results.sarif | |
| ${{ steps.sanitize.outputs.safe_name }}-image-info.json | |
| - name: Upload SARIF to GitHub Security | |
| if: steps.trivy-scan.outcome == 'success' | |
| uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 | |
| with: | |
| sarif_file: ${{ steps.sanitize.outputs.safe_name }}-trivy-results.sarif | |
| category: container/${{ steps.sanitize.outputs.base_name }} | |
| generate-reports: | |
| name: Generate Reports | |
| needs: [scan-images, extract-images] | |
| runs-on: ubuntu-24.04 | |
| strategy: | |
| matrix: | |
| report: [sbom, imageslock] | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | |
| with: | |
| pattern: sbom-* | |
| path: reports | |
| merge-multiple: true | |
| - name: Generate ${{ matrix.report }} | |
| env: | |
| CYCLONEDX_VERSION: ${{ env.CYCLONEDX_VERSION }} | |
| run: ${{ github.workspace }}/.github/scripts/cve-scan-helper.sh ${{ matrix.report }} "reports" "${{ needs.extract-images.outputs.chart-name }}" "${{ needs.extract-images.outputs.chart-version }}" | |
| - name: Upload ${{ matrix.report }} report | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: ${{ matrix.report == 'sbom' && 'sbom.cyclonedx' || 'images.lock' }} | |
| path: reports/${{ matrix.report == 'sbom' && 'sbom.cyclonedx.json' || 'images-lock.yaml' }} | |
| if-no-files-found: warn | |
| check-vulnerabilities: | |
| name: Check for Vulnerabilities | |
| needs: [generate-reports, extract-images] | |
| runs-on: ubuntu-24.04 | |
| outputs: | |
| vulnerable_images: ${{ steps.check-vulns.outputs.vulnerable_images }} | |
| permissions: | |
| actions: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | |
| with: | |
| pattern: sarif-* | |
| path: sarif-results | |
| - name: Check for vulnerabilities | |
| id: check-vulns | |
| run: | | |
| source "${{ github.workspace }}/.github/scripts/helpers.sh" | |
| check_vulnerabilities sarif-results | |
| create-remediation-prs: | |
| name: Create/Update Fix PRs | |
| needs: check-vulnerabilities | |
| if: fromJson(needs.check-vulnerabilities.outputs.vulnerable_images)[0] != null | |
| runs-on: ubuntu-24.04 | |
| strategy: | |
| matrix: | |
| image: ${{ fromJson(needs.check-vulnerabilities.outputs.vulnerable_images) }} | |
| fail-fast: false | |
| permissions: | |
| contents: write | |
| pull-requests: write | |
| security-events: read | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.TRENTOBOT_GH_PAT }} | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6 | |
| - name: Import GPG key | |
| id: import-gpg | |
| uses: crazy-max/ghaction-import-gpg@2dc316deee8e90f13e1a351ab510b4d5bc0c82cd # v7.0.0 | |
| with: | |
| gpg_private_key: ${{ secrets.TRENTOBOT_GPG_KEY }} | |
| git_user_signingkey: true | |
| git_commit_gpgsign: true | |
| git_tag_gpgsign: true | |
| git_committer_name: trentobot | |
| git_committer_email: trentobot@suse.com | |
| - name: Install semver-tool | |
| run: | | |
| sudo wget -O /usr/local/bin/semver https://raw.githubusercontent.com/fsaintjacques/semver-tool/${{ env.SEMVER_VERSION }}/src/semver | |
| sudo chmod +x /usr/local/bin/semver | |
| - name: Sanitize image name for filename | |
| id: sanitize | |
| shell: bash | |
| run: | | |
| source "${{ github.workspace }}/.github/scripts/helpers.sh" | |
| generate_image_info "${{ matrix.image }}" | |
| - name: Download SARIF for this image | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | |
| with: | |
| name: sarif-${{ steps.sanitize.outputs.safe_name }} | |
| path: sarif-results | |
| - name: Analyze SARIF & Extract CVE Info | |
| id: analyze | |
| run: | | |
| ${{ github.workspace }}/.github/scripts/cve-scan-helper-remediation.sh analyze-sarif \ | |
| sarif-results \ | |
| image-analysis.json | |
| - name: Find Upgrade Version | |
| if: steps.analyze.outputs.skip != 'true' | |
| id: upgrade | |
| run: | | |
| ${{ github.workspace }}/.github/scripts/cve-scan-helper-remediation.sh find-upgrade \ | |
| image-analysis.json \ | |
| upgrade-plan.json | |
| - name: Verify Target Image | |
| if: steps.upgrade.conclusion == 'success' && steps.upgrade.outputs.skip != 'true' | |
| run: | | |
| ${{ github.workspace }}/.github/scripts/cve-scan-helper-remediation.sh verify-image \ | |
| image-analysis.json \ | |
| upgrade-plan.json \ | |
| verification.json | |
| - name: Update Values Files | |
| if: steps.upgrade.conclusion == 'success' && steps.upgrade.outputs.skip != 'true' | |
| id: update | |
| run: | | |
| ${{ github.workspace }}/.github/scripts/cve-scan-helper-remediation.sh update-values \ | |
| image-analysis.json \ | |
| upgrade-plan.json \ | |
| charts \ | |
| values-updates.json | |
| - name: Create Pull Request | |
| if: steps.upgrade.conclusion == 'success' && steps.upgrade.outputs.skip != 'true' | |
| id: pr | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| ${{ github.workspace }}/.github/scripts/cve-scan-helper-remediation.sh manage-pr \ | |
| image-analysis.json \ | |
| upgrade-plan.json \ | |
| values-updates.json \ | |
| pr-result.json | |
| if [ -f pr-result.json ]; then | |
| ACTION=$(jq -r '.action_taken' pr-result.json) | |
| if [ "$ACTION" != "no_changes" ]; then | |
| echo "has_updates=true" >> $GITHUB_OUTPUT | |
| fi | |
| fi | |
| cleanup-scan-artifacts: | |
| name: Cleanup Scan Artifacts | |
| needs: [check-vulnerabilities, create-remediation-prs] | |
| if: always() | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| actions: write | |
| steps: | |
| - uses: geekyeggo/delete-artifact@176a747ab7e287e3ff4787bf8a148716375ca118 # v6 | |
| with: | |
| name: | | |
| sbom-* | |
| sarif-* |