From 4fcdeaf4bf360f1e602736d435fbc5b6ee673885 Mon Sep 17 00:00:00 2001 From: niravparikh05 Date: Tue, 16 May 2023 13:17:28 +0530 Subject: [PATCH] added security vulnerability scanning using trivy and updated release workflow Signed-off-by: niravparikh05 --- .github/workflows/release.yml | 19 ++++--- .github/workflows/security.yml | 97 ++++++++++++++++++++++++++++++++++ 2 files changed, 106 insertions(+), 10 deletions(-) create mode 100644 .github/workflows/security.yml diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5f40b39..0f08073 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -2,8 +2,8 @@ name: Create, publish container image on: push: - branches: [ main ] tags: [ 'v*.*.*' ] + env: REGISTRY: docker.io IMAGE_NAME: paralusio/paralus @@ -13,7 +13,6 @@ jobs: build-push: strategy: matrix: - go-version: [1.17.x] os: [ubuntu-latest] runs-on: ${{ matrix.os }} @@ -30,7 +29,7 @@ jobs: - name: Set up Go uses: actions/setup-go@v4 with: - go-version: ${{ matrix.go-version }} + go-version-file: 'go.mod' # Sanity check before publishing - name: Create k8s Kind Cluster @@ -40,7 +39,7 @@ jobs: run: go test -v ./... - name: Log in to the Container registry - uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a + uses: docker/login-action@v2 with: registry: ${{ env.REGISTRY }} username: ${{ secrets.REGISTRY_USERNAME }} @@ -48,7 +47,7 @@ jobs: - name: Extract metadata (tags, labels) for Docker id: meta - uses: docker/metadata-action@c4ee3adeed93b1fa6a762f209fb01608c1a22f1e + uses: docker/metadata-action@v4 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} tags: | @@ -58,7 +57,7 @@ jobs: type=sha - name: Build and push Docker image - uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671 + uses: docker/build-push-action@v4 with: context: . platforms: linux/amd64,linux/arm64 @@ -68,7 +67,7 @@ jobs: - name: Extract metadata (tags, labels) for Docker (paralus-init) id: meta-init - uses: docker/metadata-action@c4ee3adeed93b1fa6a762f209fb01608c1a22f1e + uses: docker/metadata-action@v4 with: images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-init tags: | @@ -78,7 +77,7 @@ jobs: type=sha - name: Build and push Docker image (paralus-init) - uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671 + uses: docker/build-push-action@v4 with: context: . file: ./Dockerfile.initialize @@ -89,7 +88,7 @@ jobs: - name: Extract metadata (tags, labels) for Docker (kratos-sync) id: meta-sync - uses: docker/metadata-action@c4ee3adeed93b1fa6a762f209fb01608c1a22f1e + uses: docker/metadata-action@v4 with: images: ${{ env.REGISTRY }}/paralusio/kratos-synchronizer tags: | @@ -99,7 +98,7 @@ jobs: type=sha - name: Build and push Docker image (kratos-sync) - uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671 + uses: docker/build-push-action@v4 with: context: . file: ./Dockerfile.synchronizer diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml new file mode 100644 index 0000000..5e41f53 --- /dev/null +++ b/.github/workflows/security.yml @@ -0,0 +1,97 @@ +name: Scan container images + +on: + push: + branches: [ main ] + pull_request: + branches: [ main ] + +env: + REGISTRY: docker.io + IMAGE_NAME: paralusio/paralus + TAG: latest + +jobs: + + build: + strategy: + matrix: + os: [ubuntu-latest] + runs-on: ${{ matrix.os }} + + steps: + - name: Checkout repository + uses: actions/checkout@v3 + + - name: Set up QEMU + uses: docker/setup-qemu-action@v2 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v2 + + - name: Set up Go + uses: actions/setup-go@v4 + with: + go-version-file: 'go.mod' + + # Sanity check before publishing + - name: Create k8s Kind Cluster + uses: helm/kind-action@v1.2.0 + + - name: Test all + run: go test -v ./... + + - name: Build docker image + uses: docker/build-push-action@v4 + with: + context: . + platforms: linux/amd64,linux/arm64 + tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.TAG }} + + - name: Run Trivy vulnerability scanner + uses: aquasecurity/trivy-action@0.10.0 + with: + image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.TAG }} + format: 'table' + exit-code: '1' + ignore-unfixed: true + vuln-type: 'os,library' + severity: 'CRITICAL,HIGH' + + - name: Build Docker image (paralus-init) + uses: docker/build-push-action@3b5e8027fcad23fda98b2e3ac259d8d67585f671 + with: + context: . + file: ./Dockerfile.initialize + platforms: linux/amd64,linux/arm64 + push: true + tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-init:${{ env.TAG }} + + - name: Run Trivy vulnerability scanner + uses: aquasecurity/trivy-action@0.10.0 + with: + image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-init:${{ env.TAG }} + format: 'table' + exit-code: '1' + ignore-unfixed: true + vuln-type: 'os,library' + severity: 'CRITICAL,HIGH' + + - name: Build and push Docker image (kratos-sync) + uses: docker/build-push-action@v4 + with: + context: . + file: ./Dockerfile.synchronizer + platforms: linux/amd64,linux/arm64 + push: true + tags: ${{ env.REGISTRY }}/paralusio/kratos-synchronizer:${{ env.TAG }} + + - name: Run Trivy vulnerability scanner + uses: aquasecurity/trivy-action@0.10.0 + with: + image-ref: ${{ env.REGISTRY }}/paralusio/kratos-synchronizer:${{ env.TAG }} + format: 'table' + exit-code: '1' + ignore-unfixed: true + vuln-type: 'os,library' + severity: 'CRITICAL,HIGH' \ No newline at end of file