From 02f5a96a723d756ec33684ce8b05aa3567dfd7bd Mon Sep 17 00:00:00 2001 From: JarHMJ <34236536+JarHMJ@users.noreply.github.com> Date: Wed, 11 May 2022 14:09:10 +0800 Subject: [PATCH] Feat: run image scan CI for every pull request and fix CVEs in time (#3855) Signed-off-by: huangminjie --- .github/workflows/codeql-analysis.yml | 24 --------------------- .github/workflows/trivy-scan.yml | 30 +++++++++++++++++++++++++++ go.mod | 2 +- go.sum | 4 +++- 4 files changed, 34 insertions(+), 26 deletions(-) create mode 100644 .github/workflows/trivy-scan.yml diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index cfbc79b3d..91abc4592 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -5,30 +5,6 @@ on: branches: [ master, release-* ] jobs: - images: - name: Image Scan - runs-on: ubuntu-latest - steps: - - name: Checkout code - uses: actions/checkout@v2 - - - name: Build Vela Core image from Dockerfile - run: | - docker build --build-arg GOPROXY=https://proxy.golang.org -t docker.io/oamdev/vela-core:${{ github.sha }} . - - - name: Run Trivy vulnerability scanner for vela core - uses: aquasecurity/trivy-action@master - with: - image-ref: 'docker.io/oamdev/vela-core:${{ github.sha }}' - format: 'sarif' - output: 'trivy-results.sarif' - - - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v1 - if: always() - with: - sarif_file: 'trivy-results.sarif' - analyze: name: Analyze runs-on: ubuntu-latest diff --git a/.github/workflows/trivy-scan.yml b/.github/workflows/trivy-scan.yml new file mode 100644 index 000000000..d19464741 --- /dev/null +++ b/.github/workflows/trivy-scan.yml @@ -0,0 +1,30 @@ +name: "Trivy Scan" + +on: + pull_request: + branches: [ master ] + +jobs: + images: + name: Image Scan + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v2 + + - name: Build Vela Core image from Dockerfile + run: | + docker build --build-arg GOPROXY=https://proxy.golang.org -t docker.io/oamdev/vela-core:${{ github.sha }} . + + - name: Run Trivy vulnerability scanner for vela core + uses: aquasecurity/trivy-action@master + with: + image-ref: 'docker.io/oamdev/vela-core:${{ github.sha }}' + format: 'sarif' + output: 'trivy-results.sarif' + + - name: Upload Trivy scan results to GitHub Security tab + uses: github/codeql-action/upload-sarif@v1 + if: always() + with: + sarif_file: 'trivy-results.sarif' \ No newline at end of file diff --git a/go.mod b/go.mod index 75ff82124..0fa995e50 100644 --- a/go.mod +++ b/go.mod @@ -64,7 +64,7 @@ require ( github.com/wonderflow/cert-manager-api v1.0.3 go.mongodb.org/mongo-driver v1.5.1 go.uber.org/zap v1.19.1 - golang.org/x/crypto v0.0.0-20210921155107-089bfa567519 + golang.org/x/crypto v0.0.0-20220507011949-2cf3adece122 golang.org/x/oauth2 v0.0.0-20220309155454-6242fa91716a golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 golang.org/x/tools v0.1.11-0.20220316014157-77aa08bb151a // indirect diff --git a/go.sum b/go.sum index 6b7b4c5d1..ac7a0032e 100644 --- a/go.sum +++ b/go.sum @@ -2015,8 +2015,9 @@ golang.org/x/crypto v0.0.0-20210513164829-c07d793c2f9a/go.mod h1:P+XmwS30IXTQdn5 golang.org/x/crypto v0.0.0-20210616213533-5ff15b29337e/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= -golang.org/x/crypto v0.0.0-20210921155107-089bfa567519 h1:7I4JAnoQBe7ZtJcBaYHi5UtiO8tQHbUSXxL+pnGRANg= golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= +golang.org/x/crypto v0.0.0-20220507011949-2cf3adece122 h1:NvGWuYG8dkDHFSKksI1P9faiVJ9rayE6l0+ouWVIDs8= +golang.org/x/crypto v0.0.0-20220507011949-2cf3adece122/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20180807140117-3d87b88a115f/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= @@ -2133,6 +2134,7 @@ golang.org/x/net v0.0.0-20210805182204-aaa1db679c0d/go.mod h1:9nx3DQGgdP8bBQD5qx golang.org/x/net v0.0.0-20210825183410-e898025ed96a/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= golang.org/x/net v0.0.0-20211015210444-4f30a5c0130f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= golang.org/x/net v0.0.0-20211029224645-99673261e6eb/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= +golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= golang.org/x/net v0.0.0-20211209124913-491a49abca63/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= golang.org/x/net v0.0.0-20220127200216-cd36cc0744dd/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk= golang.org/x/net v0.0.0-20220325170049-de3da57026de h1:pZB1TWnKi+o4bENlbzAgLrEbY4RMYmUIRobMcSmfeYc=