fixes krkn source dependencies cves and introduces grype scan in GH Action (#1336)

* adding member request information Signed-off-by: Paige Patton <prubenda@redhat.com> Assisted By: Claude Code: fixes krkn source dependencies cves Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> introduced grype scan on github images Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> golang downgrade Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> golang dependency pinning Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> golang dependency pinning Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> setuptools downgrade Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> go-ntlmssp downgrade Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> security scan in summary Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> setuptools downgrade Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> upgrade to fedora 45 Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> golang dependencies Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> removed pinned dependencies Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> pinned dependency for oc latest Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> golang stdlib stable version Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> upgrading oc release Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> upgrading yq Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> yq build in pipeline Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> pinned transitive dependencies Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> removed not working Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> buildkit unpinned Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> other pinned dependencies Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> other pinned Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> other pinned Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> go work vendor Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> other pinned Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> pin buildkit and distribution Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> reinstated distribution Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> nit Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> SECURITY.md Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> feat: add Grype security scanning badge and comprehensive security policy - Add security badge job to docker-image workflow - Generates detailed badge showing C:X H:Y M:Z vulnerability counts - Runs on every push to main branch - Publishes badge to krkn-lib-docs repository - Uses Grype to scan container image for CVEs - Dynamic color based on severity (green/yellow/orange/red) - Add security badge to README.md - Displays current vulnerability baseline - Placed after coverage badge for visibility - Enhance SECURITY.md with CNCF-ready security policy - Document proactive security approach with Grype CI/CD integration - Define security baseline: 0 Critical, 7 High, 3 Medium, 0 Low (12 total) - Detail accepted risks with mitigation strategies - Document all 12 known CVEs in transitive dependencies - Explain why each CVE cannot be fixed (dependency constraints) - Establish quarterly review process for accepted risks - Add SLA commitments for vulnerability remediation Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> fix: remove moby/buildkit v0.28.1 pin that breaks oc build The moby/buildkit v0.28.1 upgrade has breaking API changes (undefined: archive.Compression) that are incompatible with docker/docker v28.5.2 vendored in oc. This CVE is documented as accepted risk in SECURITY.md. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com> DCO krkn-lib update krkn-lib update * increased krkn-lib version Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> --------- Signed-off-by: Tullio Sebastiani <tsebasti@redhat.com> Co-authored-by: Paige Patton <prubenda@redhat.com>
2026-08-25 09:27:36 +00:00 · 2026-05-20 14:21:51 -04:00
parent 66651e97ca
commit 7c94a307d0
8 changed files with 430 additions and 68 deletions
@@ -2,9 +2,60 @@ name: Docker Image CI
 on:
  push:
    tags: ['v[0-9].[0-9]+.[0-9]+']
+    branches:
+      - main
  pull_request:

 jobs:
+  security-scan-source:
+    name: Security Scan - Source Code & Dependencies
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    steps:
+    - name: Check out code
+      uses: actions/checkout@v3
+
+    - name: Install Grype
+      run: |
+        curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin
+
+    - name: Scan source code and dependencies
+      run: |
+        echo "🔍 Scanning source code and dependencies for vulnerabilities..."
+        grype dir:. --only-fixed -o table > /tmp/grype-source.txt || true
+
+        SCAN_OUTPUT=$(grype dir:. --only-fixed -o json)
+        CRITICAL=$(echo "$SCAN_OUTPUT" | jq '[.matches[] | select(.vulnerability.severity == "Critical")] | length')
+        HIGH=$(echo "$SCAN_OUTPUT" | jq '[.matches[] | select(.vulnerability.severity == "High")] | length')
+        MEDIUM=$(echo "$SCAN_OUTPUT" | jq '[.matches[] | select(.vulnerability.severity == "Medium")] | length')
+
+        # Create Job Summary with table
+        echo "## 🔒 Security Scan - Source Code & Dependencies" >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
+        echo "| Severity | Count | Status |" >> $GITHUB_STEP_SUMMARY
+        echo "|----------|-------|--------|" >> $GITHUB_STEP_SUMMARY
+        echo "| 🔴 Critical | $CRITICAL | $([ $CRITICAL -eq 0 ] && echo '✅' || echo '⚠️') |" >> $GITHUB_STEP_SUMMARY
+        echo "| 🟠 High | $HIGH | $([ $HIGH -eq 0 ] && echo '✅' || echo '⚠️') |" >> $GITHUB_STEP_SUMMARY
+        echo "| 🟡 Medium | $MEDIUM | $([ $MEDIUM -eq 0 ] && echo '✅' || echo '⚠️') |" >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
+
+        if [ "$CRITICAL" -gt 0 ] || [ "$HIGH" -gt 0 ]; then
+          echo "⚠️ **Found $CRITICAL Critical and $HIGH High vulnerabilities with available fixes**" >> $GITHUB_STEP_SUMMARY
+        else
+          echo "✅ **No Critical or High vulnerabilities found**" >> $GITHUB_STEP_SUMMARY
+        fi
+
+        # Add collapsible full scan results
+        echo "" >> $GITHUB_STEP_SUMMARY
+        echo "<details>" >> $GITHUB_STEP_SUMMARY
+        echo "<summary>📋 Full Scan Results</summary>" >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
+        echo '```' >> $GITHUB_STEP_SUMMARY
+        cat /tmp/grype-source.txt >> $GITHUB_STEP_SUMMARY
+        echo '```' >> $GITHUB_STEP_SUMMARY
+        echo "</details>" >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
+
  build:
    runs-on: ${{ matrix.runner }}
    strategy:
@@ -27,10 +78,55 @@ jobs:
        ./containers/compile_dockerfile.sh
        docker buildx build --no-cache \
          --platform linux/${{ matrix.platform }} \
-          -t quay.io/krkn-chaos/krkn \
-          -t quay.io/redhat-chaos/krkn  \
+          -t quay.io/krkn-chaos/krkn:pr-${{ github.event.pull_request.number }}-${{ matrix.platform }} \
+          -t quay.io/redhat-chaos/krkn:pr-${{ github.event.pull_request.number }}-${{ matrix.platform }} \
          containers/ \
-          --build-arg PR_NUMBER=${{ github.event.pull_request.number }}
+          --build-arg PR_NUMBER=${{ github.event.pull_request.number }} \
+          --load
+
+    - name: Install Grype
+      if: github.event_name == 'pull_request'
+      run: |
+        curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin
+
+    - name: Scan Docker image for vulnerabilities
+      if: github.event_name == 'pull_request'
+      run: |
+        IMAGE_NAME="quay.io/krkn-chaos/krkn:pr-${{ github.event.pull_request.number }}-${{ matrix.platform }}"
+        echo "🔍 Scanning Docker image: $IMAGE_NAME"
+        grype "$IMAGE_NAME" --only-fixed -o table > /tmp/grype-image-${{ matrix.platform }}.txt || true
+
+        SCAN_OUTPUT=$(grype "$IMAGE_NAME" --only-fixed -o json)
+        CRITICAL=$(echo "$SCAN_OUTPUT" | jq '[.matches[] | select(.vulnerability.severity == "Critical")] | length')
+        HIGH=$(echo "$SCAN_OUTPUT" | jq '[.matches[] | select(.vulnerability.severity == "High")] | length')
+        MEDIUM=$(echo "$SCAN_OUTPUT" | jq '[.matches[] | select(.vulnerability.severity == "Medium")] | length')
+
+        # Create Job Summary with table
+        echo "## 🐳 Docker Image Security Scan - ${{ matrix.platform }}" >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
+        echo "| Severity | Count | Status |" >> $GITHUB_STEP_SUMMARY
+        echo "|----------|-------|--------|" >> $GITHUB_STEP_SUMMARY
+        echo "| 🔴 Critical | $CRITICAL | $([ $CRITICAL -eq 0 ] && echo '✅' || echo '⚠️') |" >> $GITHUB_STEP_SUMMARY
+        echo "| 🟠 High | $HIGH | $([ $HIGH -eq 0 ] && echo '✅' || echo '⚠️') |" >> $GITHUB_STEP_SUMMARY
+        echo "| 🟡 Medium | $MEDIUM | $([ $MEDIUM -eq 0 ] && echo '✅' || echo '⚠️') |" >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
+
+        if [ "$CRITICAL" -gt 0 ] || [ "$HIGH" -gt 0 ]; then
+          echo "⚠️ **Found $CRITICAL Critical and $HIGH High vulnerabilities with available fixes**" >> $GITHUB_STEP_SUMMARY
+        else
+          echo "✅ **No Critical or High vulnerabilities found**" >> $GITHUB_STEP_SUMMARY
+        fi
+
+        # Add collapsible full scan results
+        echo "" >> $GITHUB_STEP_SUMMARY
+        echo "<details>" >> $GITHUB_STEP_SUMMARY
+        echo "<summary>📋 Full Scan Results</summary>" >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
+        echo '```' >> $GITHUB_STEP_SUMMARY
+        cat /tmp/grype-image-${{ matrix.platform }}.txt >> $GITHUB_STEP_SUMMARY
+        echo '```' >> $GITHUB_STEP_SUMMARY
+        echo "</details>" >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY

    - name: Login to krkn-chaos quay
      if: startsWith(github.ref, 'refs/tags')
@@ -122,3 +218,81 @@ jobs:
        QUAY_USER: ${{ secrets.QUAY_USERNAME }}
        QUAY_TOKEN: ${{ secrets.QUAY_PASSWORD }}
        AUTOPUSH: ${{ secrets.AUTOPUSH }}
+
+  security-badge:
+    permissions:
+      contents: write
+    name: Generate Security Badge
+    runs-on: ubuntu-latest
+    needs:
+      - build
+    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v3
+
+      - name: Check out doc repo
+        uses: actions/checkout@master
+        with:
+          repository: krkn-chaos/krkn-lib-docs
+          path: krkn-lib-docs
+          ssh-key: ${{ secrets.KRKN_LIB_DOCS_PRIV_KEY }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build image for security scan
+        run: |
+          ./containers/compile_dockerfile.sh
+          docker buildx build --no-cache \
+            --platform linux/amd64 \
+            -t krkn-chaos/krkn:security-scan \
+            containers/ \
+            --load
+
+      - name: Install Grype
+        run: |
+          curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh -s -- -b /usr/local/bin
+
+      - name: Scan and generate security badge
+        run: |
+          # Scan with grype (no --only-fixed to get all CVEs for baseline)
+          SCAN_OUTPUT=$(grype krkn-chaos/krkn:security-scan -o json)
+
+          # Count vulnerabilities by severity
+          CRITICAL=$(echo "$SCAN_OUTPUT" | jq '[.matches[] | select(.vulnerability.severity == "Critical")] | length')
+          HIGH=$(echo "$SCAN_OUTPUT" | jq '[.matches[] | select(.vulnerability.severity == "High")] | length')
+          MEDIUM=$(echo "$SCAN_OUTPUT" | jq '[.matches[] | select(.vulnerability.severity == "Medium")] | length')
+          TOTAL=$(echo "$SCAN_OUTPUT" | jq '[.matches[]] | length')
+
+          # Determine badge color based on severity
+          if [ $CRITICAL -gt 0 ]; then
+            COLOR="critical"
+          elif [ $HIGH -gt 10 ]; then
+            COLOR="important"
+          elif [ $HIGH -gt 5 ]; then
+            COLOR="orange"
+          elif [ $HIGH -gt 0 ]; then
+            COLOR="yellow"
+          else
+            COLOR="brightgreen"
+          fi
+
+          echo "Security Scan Results:"
+          echo "  Critical: $CRITICAL"
+          echo "  High: $HIGH"
+          echo "  Medium: $MEDIUM"
+          echo "  Total: $TOTAL"
+          echo "  Badge Color: $COLOR"
+
+          # Generate detailed badge: "C:0 H:7 M:3"
+          curl "https://img.shields.io/badge/security-C:$CRITICAL%20H:$HIGH%20M:$MEDIUM-$COLOR" > ./krkn-lib-docs/security_badge_krkn.svg
+
+      - name: Push updated Security Badge
+        run: |
+          cd krkn-lib-docs
+          git add .
+          git config user.name "krkn-chaos"
+          git config user.email "krkn-actions@users.noreply.github.com"
+          git commit -m "[KRKN] Security Badge ${GITHUB_REF##*/}" || echo "no changes to commit"
+          git push
@@ -1,16 +0,0 @@
-name: Needs DCO Signoff
-
-on:
-  pull_request_target:
-    types: [opened, synchronize, reopened]
-  push:
-    branches: [main]
-
-permissions:
-  pull-requests: write
-  issues: write
-  contents: read
-
-jobs:
-  dco:
-    uses: krkn-chaos/actions/.github/workflows/needs-dco.yml@main
@@ -40,6 +40,8 @@ jobs:
          pip install --upgrade pip
          pip install -r requirements.txt
          pip install coverage
+          # Force setuptools==81.0.0 after all deps (some may try to upgrade it to 82+, which removes pkg_resources)
+          pip install --force-reinstall --no-deps setuptools==81.0.0

      - name: Deploy test workloads
        run: |
@@ -35,6 +35,8 @@ jobs:
          pip install --upgrade pip
          pip install -r requirements.txt
          pip install -r CI/tests_v2/requirements.txt
+          # Force setuptools==81.0.0 after all deps (some may try to upgrade it to 82+, which removes pkg_resources)
+          pip install --force-reinstall --no-deps setuptools==81.0.0

      - name: Run tests_v2
        run: |