chore: Improve security scanning. Fixes argoproj#7599 (argoproj#7602)

Signed-off-by: Alex Collins <[email protected]>
AlbeeSo · Jan 20, 2022 · 7ca0201 · 7ca0201
1 parent 4901f94
commit 7ca0201
Show file tree

Hide file tree

Showing 3 changed files with 16 additions and 10 deletions.
diff --git a/.github/workflows/snyk.yml b/.github/workflows/snyk.yml
@@ -3,27 +3,38 @@ on:
   schedule:
     - cron: "30 2 * * *"
 jobs:
+  images:
+    if: github.repository == 'argoproj/argo-workflows'
+    runs-on: ubuntu-latest
+    env:
+      SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+    steps:
+      - run: docker scan --severity=high quay.io/argoproj/workflow-controller
+      - run: docker scan --severity=high quay.io/argoproj/argoexec
+      - run: docker scan --severity=high quay.io/argoproj/argocli
+
   golang:
     if: github.repository == 'argoproj/argo-workflows'
     runs-on: ubuntu-latest
+    env:
+      SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
     steps:
       - uses: actions/checkout@master
       - name: Run Snyk to check for vulnerabilities
         uses: snyk/actions/golang@master
-        env:
-          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
         with:
           args: --severity-threshold=high
+
   node:
     if: github.repository == 'argoproj/argo-workflows'
     runs-on: ubuntu-latest
+    env:
+      SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
     steps:
       - uses: actions/checkout@master
       - run: yarn --cwd ui install
       - name: Run Snyk to check for vulnerabilities
         uses: snyk/actions/node@master
-        env:
-          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
         with:
           args: --file=ui/package.json --severity-threshold=high
 
diff --git a/Dockerfile b/Dockerfile
@@ -66,7 +66,7 @@ COPY hack/nsswitch.conf /etc/
 
 ####################################################################################################
 
-FROM node:14.0.0 as argo-ui
+FROM node:16 as argo-ui
 
 COPY ui/package.json ui/yarn.lock ui/
 

diff --git a/Makefile b/Makefile
@@ -236,11 +236,6 @@ argoexec-image:
 	if [ $(K3D) = true ]; then k3d image import -c $(K3D_CLUSTER_NAME) $(IMAGE_NAMESPACE)/$*:$(VERSION); fi
 	if [ $(DOCKER_PUSH) = true ] && [ $(IMAGE_NAMESPACE) != argoproj ] ; then docker push $(IMAGE_NAMESPACE)/$*:$(VERSION) ; fi
 
-scan-images: scan-workflow-controller scan-argoexec scan-argocli
-
-scan-%:
-	docker scan --severity=high $(IMAGE_NAMESPACE)/$*:$(VERSION)
-
 # generation
 
 .PHONY: codegen