Trivy Periodic Image Scan #177
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| # | |
| # This workflow scans the published container images | |
| # for new vulnerabilities daily, publishing findings. | |
| # | |
| name: Trivy Periodic Image Scan | |
| on: | |
| schedule: | |
| # run daily | |
| - cron: "0 0 * * *" | |
| jobs: | |
| get-image-reference: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Convert repo' name to lower case | |
| id: to_lower_case | |
| run: | | |
| # While GitHub repo's can be mixed (upper and lower) case, | |
| # Docker images can only be lower case | |
| repo_name=$(echo ${{ github.repository }} | tr '[:upper:]' '[:lower:]') | |
| echo "repo_name=$repo_name" >> $GITHUB_ENV | |
| - name: Find current version | |
| id: find_version | |
| uses: mathieudutour/[email protected] | |
| with: | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| dry_run: true # setting to 'true' means no new version is created | |
| outputs: | |
| image_repo: ghcr.io/${{ env.repo_name }} | |
| image_tag: ${{ steps.find_version.outputs.previous_version }} | |
| trivy-matrix: | |
| name: trivy | |
| needs: [get-image-reference] | |
| strategy: | |
| matrix: | |
| notebook_type: | |
| - jupyter | |
| - rstudio | |
| uses: "./.github/workflows/trivy.yml" | |
| with: | |
| NOTEBOOK_TYPE: ${{ matrix.notebook_type }} | |
| SOURCE_TYPE: image | |
| IMAGE_NAME: ghcr.io/${{ needs.get-image-reference.outputs.image_repo | |
| }}-${{ matrix.notebook_type }}:${{ needs.get-image-reference.outputs.image_tag }} | |
| EXIT_CODE: 1 | |
| # If scan failed, bump tag and rebuild the image | |
| bump-tag: | |
| needs: trivy-matrix | |
| runs-on: ubuntu-latest | |
| if: ${{!cancelled() && needs.trivy-matrix.outputs.trivy_conclusion == 'failure' }} | |
| # tag the repo to trigger a new build | |
| steps: | |
| - name: Bump version and push tag | |
| id: tag_version | |
| uses: mathieudutour/[email protected] | |
| with: | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: parse new version | |
| id: parsed | |
| uses: booxmedialtd/ws-action-parse-semver@v1 | |
| with: | |
| input_string: ${{ steps.tag_version.outputs.new_version }} | |
| outputs: | |
| new_tag: ${{ steps.tag_version.outputs.new_tag }} | |
| new_version: ${{ steps.tag_version.outputs.new_version }} | |
| new_major_minor: ${{ steps.parsed.outputs.major }}.${{ steps.parsed.outputs.minor }} | |
| conclusion: ${{ steps.parsed.conclusion }} | |
| tests: | |
| needs: [trivy-matrix, bump-tag] | |
| if: ${{!cancelled() && needs.trivy-matrix.outputs.trivy_conclusion == 'failure' && | |
| needs.bump-tag.outputs.conclusion == 'success' }} | |
| uses: "./.github/workflows/test.yml" | |
| update-image: | |
| needs: [trivy-matrix, bump-tag, tests] | |
| if: ${{!cancelled() && needs.trivy-matrix.outputs.trivy_conclusion == 'failure' && | |
| needs.bump-tag.outputs.conclusion == 'success' && | |
| needs.tests.outputs.conclusion == 'success' }} | |
| strategy: | |
| matrix: | |
| notebook_type: | |
| - jupyter | |
| - rstudio | |
| uses: "./.github/workflows/docker_build_push.yml" | |
| with: | |
| NOTEBOOK_TYPE: ${{ matrix.notebook_type }} | |
| REF_TO_CHECKOUT: ${{ needs.bump-tag.outputs.new_tag }} | |
| TAGS: "${{ needs.bump-tag.outputs.new_version }},\ | |
| ${{ needs.bump-tag.outputs.new_major_minor }}" | |
| ... |