Bump actions/checkout from 7.0.0 to 7.0.1 #144
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-FileCopyrightText: SUSE LLC | |
| # SPDX-License-Identifier: Apache-2.0 | |
| name: CVE Scan - Pull Requests | |
| on: | |
| pull_request: | |
| branches: [main] | |
| types: [opened, synchronize, reopened] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| HELM_VERSION: v4.2.0 | |
| jobs: | |
| detect-changed-images: | |
| name: Detect Changed Images | |
| runs-on: ubuntu-24.04 | |
| outputs: | |
| images: ${{ steps.extract.outputs.images }} | |
| has_changes: ${{ steps.extract.outputs.has_changes }} | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install Helm | |
| uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5 | |
| with: | |
| version: ${{ env.HELM_VERSION }} | |
| - name: Set up Trivy | |
| uses: aquasecurity/setup-trivy@81e514348e19b6112ce2a7e3ecbafe19c1e1f567 # v0.3.1 | |
| - name: Detect changed images | |
| id: extract | |
| run: ${{ github.workspace }}/.github/scripts/cve-scan-pr-helper.sh detect | |
| - name: Upload image metadata | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| if: success() | |
| with: | |
| name: image-metadata | |
| path: changed_images.json | |
| scan-changed-images: | |
| name: Scan Changed Images | |
| needs: detect-changed-images | |
| if: needs.detect-changed-images.outputs.has_changes == 'true' | |
| runs-on: ubuntu-24.04 | |
| strategy: | |
| matrix: | |
| image: ${{ fromJson(needs.detect-changed-images.outputs.images) }} | |
| fail-fast: false | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| sparse-checkout: .github | |
| sparse-checkout-cone-mode: false | |
| - name: Sanitize image name for filename | |
| id: sanitize | |
| shell: bash | |
| run: | | |
| source "${{ github.workspace }}/.github/scripts/helpers.sh" | |
| SAFE_NAME=$(sanitize_image_name "${{ matrix.image }}") | |
| echo "safe_name=${SAFE_NAME}" >> $GITHUB_OUTPUT | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| image-ref: ${{ matrix.image }} | |
| format: "json" | |
| output: "${{ steps.sanitize.outputs.safe_name }}-trivy-results.json" | |
| severity: "CRITICAL,HIGH,MEDIUM" | |
| - name: Upload scan results | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: trivy-scan-${{ steps.sanitize.outputs.safe_name }} | |
| path: ${{ steps.sanitize.outputs.safe_name }}-trivy-results.json | |
| comment-pr: | |
| name: Comment PR with CVE Results | |
| needs: [detect-changed-images, scan-changed-images] | |
| if: needs.detect-changed-images.outputs.has_changes == 'true' && needs.scan-changed-images.result == 'success' | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| - name: Download image metadata | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | |
| with: | |
| name: image-metadata | |
| - name: Download all scan results | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | |
| with: | |
| pattern: trivy-scan-* | |
| path: scan-results | |
| - name: Validate downloaded artifacts | |
| run: | | |
| EXPECTED_COUNT=$(echo '${{ needs.detect-changed-images.outputs.images }}' | jq 'length') | |
| ACTUAL_COUNT=$(find scan-results -name '*-trivy-results.json' | wc -l) | |
| echo "Expected $EXPECTED_COUNT scan(s), found $ACTUAL_COUNT" | |
| if [ "$ACTUAL_COUNT" -ne "$EXPECTED_COUNT" ]; then | |
| echo "Error: Artifact count mismatch!" >&2 | |
| find scan-results -type f | |
| exit 1 | |
| fi | |
| echo "Artifact structure:" | |
| find scan-results -type f | sort | |
| - name: Generate PR comment | |
| run: ${{ github.workspace }}/.github/scripts/cve-scan-pr-helper.sh comment | |
| - name: Post comment on PR | |
| if: success() | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| run: ${{ github.workspace }}/.github/scripts/cve-scan-pr-helper.sh post | |
| - name: Report comment generation failure | |
| if: failure() | |
| run: | | |
| echo "Failed to generate or post PR comment" | |
| exit 1 | |
| - name: Cleanup artifacts | |
| if: always() | |
| uses: geekyeggo/delete-artifact@176a747ab7e287e3ff4787bf8a148716375ca118 # v6 | |
| with: | |
| name: | | |
| image-metadata | |
| trivy-scan-* |