Skip to content
CI

build: Upload SAST results #2801

Sign in to view logs

build: Upload SAST results

build: Upload SAST results #2801

Workflow file for this run

.github/workflows/ci.yaml at 3e1a58d
name: CI
on:
schedule:
- cron: '0 */3 * * *'
push:
branches:
- master
- 'release-*'
tags:
- '**'
pull_request:
types:
- opened
- reopened
- synchronize
jobs:
define-scanner-job-matrix:
outputs:
matrix: ${{ steps.define-scanner-job-matrix.outputs.matrix }}
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
with:
ref: ${{ github.event.pull_request.head.sha }}
- name: Define the matrix for build jobs
id: define-scanner-job-matrix
run: |
# If goarch is updated, be sure to update architectures in push-manifests below.
matrix='{ "build_and_push": { "goos":["linux"], "goarch":["amd64", "arm64", "ppc64le", "s390x"] } }'
jq <<< "$matrix"
condensed="$(jq -c <<< "$matrix")"
echo "matrix=$condensed" >> "$GITHUB_OUTPUT"
pre-build-updater:
runs-on: ubuntu-latest
container:
image: quay.io/stackrox-io/apollo-ci:scanner-test-0.4.1
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: 0
ref: ${{ github.event.pull_request.head.sha }}
- uses: ./.github/actions/job-preamble
- name: Cache Go dependencies
uses: ./.github/actions/cache-go-dependencies
- uses: ./.github/actions/handle-tagged-build
- name: Build updater (amd64)
run: make build-updater
- name: Archive the build to preserve permissions
run: tar -cvzf updater-build.tgz bin/updater
- uses: actions/upload-artifact@v4
with:
name: updater-build
path: updater-build.tgz
pre-build-scanner:
needs: define-scanner-job-matrix
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix: ${{ fromJson(needs.define-scanner-job-matrix.outputs.matrix).build_and_push }}
container:
image: quay.io/stackrox-io/apollo-ci:scanner-test-0.4.1
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: 0
ref: ${{ github.event.pull_request.head.sha }}
- uses: ./.github/actions/job-preamble
- name: Cache Go dependencies
uses: ./.github/actions/cache-go-dependencies
- uses: ./.github/actions/handle-tagged-build
- name: Build Scanner
run: make GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }} scanner-build-nodeps
- name: Archive the build to preserve permissions
run: tar -cvzf scanner-build-${{ matrix.goos }}-${{ matrix.goarch }}.tgz image/scanner/bin/scanner
- uses: actions/upload-artifact@v4
with:
name: scanner-build-${{ matrix.goos }}-${{ matrix.goarch }}
path: scanner-build-${{ matrix.goos }}-${{ matrix.goarch }}.tgz
style-check:
runs-on: ubuntu-latest
container:
image: quay.io/stackrox-io/apollo-ci:scanner-test-0.4.1
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: 0
ref: ${{ github.event.pull_request.head.sha }}
- uses: ./.github/actions/job-preamble
- name: Cache Go dependencies
uses: ./.github/actions/cache-go-dependencies
- name: Run style checks (amd64)
run: ./scripts/ci/jobs/style-checks.sh
unit-tests:
runs-on: ubuntu-latest
container:
image: quay.io/stackrox-io/apollo-ci:scanner-test-0.4.1
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: 0
ref: ${{ github.event.pull_request.head.sha }}
- uses: ./.github/actions/job-preamble
- name: Cache Go dependencies
uses: ./.github/actions/cache-go-dependencies
- name: Run unit tests (amd64)
run: ./scripts/ci/jobs/unit-tests.sh
db-integration-tests:
runs-on: ubuntu-latest
container:
image: quay.io/stackrox-io/apollo-ci:scanner-test-0.4.1
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: 0
ref: ${{ github.event.pull_request.head.sha }}
- uses: ./.github/actions/job-preamble
- name: Cache Go dependencies
uses: ./.github/actions/cache-go-dependencies
- name: Run db integration tests (amd64)
run: ./scripts/ci/jobs/db-integration-tests.sh
generate-genesis-dump:
# Run this job if it's not a PR or the PR contains the `generate-dumps-on-pr` label
if: |
github.event_name != 'pull_request' ||
contains(github.event.pull_request.labels.*.name, 'generate-dumps-on-pr')
env:
NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
ROX_LEGACY_NVD_LOADER: true
runs-on: ubuntu-latest
needs:
- pre-build-updater
container:
image: quay.io/stackrox-io/apollo-ci:scanner-test-0.4.1
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: 0
ref: ${{ github.event.pull_request.head.sha }}
- uses: ./.github/actions/job-preamble
- uses: actions/download-artifact@v4
with:
name: updater-build
- name: Unpack updater build
run: |
tar xvzf updater-build.tgz
- name: genesis-dump
run: |
source ./scripts/ci/lib.sh
generate_genesis_dump
- uses: actions/upload-artifact@v4
with:
name: genesis-dump
path: /tmp/genesis-dump/genesis-dump.zip
- uses: actions/upload-artifact@v4
with:
name: vuln-dump
path: /tmp/vuln-dump
generate-db-dump:
# Run this job if it's not a PR or the PR contains the `generate-dumps-on-pr` label
if: |
github.event_name != 'pull_request' ||
contains(github.event.pull_request.labels.*.name, 'generate-dumps-on-pr')
runs-on: ubuntu-latest
needs:
- generate-genesis-dump
container:
image: quay.io/stackrox-io/apollo-ci:scanner-test-0.4.1
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: 0
ref: ${{ github.event.pull_request.head.sha }}
- uses: ./.github/actions/job-preamble
- uses: actions/download-artifact@v4
with:
name: updater-build
- name: Unpack updater build
run: |
tar xvzf updater-build.tgz
- uses: actions/download-artifact@v4
with:
name: genesis-dump
path: /tmp/genesis-dump
- name: db-dump
run: |
source ./scripts/ci/lib.sh
generate_db_dump
- uses: actions/upload-artifact@v4
with:
name: db-dump
path: /tmp/postgres/pg-definitions.sql.gz
generate-scanner-bundle:
# Run this job even if the generate-genesis-dump job was skipped, i.e., only skip this job if
# generate-genesis-dump failed
if: |
always() &&
(needs.generate-genesis-dump.result == 'success' || needs.generate-genesis-dump.result == 'skipped')
runs-on: ubuntu-latest
needs:
- define-scanner-job-matrix
- pre-build-scanner
- generate-genesis-dump
strategy:
fail-fast: false
matrix: ${{ fromJson(needs.define-scanner-job-matrix.outputs.matrix).build_and_push }}
container:
image: quay.io/stackrox-io/apollo-ci:scanner-test-0.4.1
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: 0
ref: ${{ github.event.pull_request.head.sha }}
- uses: ./.github/actions/job-preamble
- uses: actions/download-artifact@v4
with:
name: scanner-build-${{ matrix.goos }}-${{ matrix.goarch }}
- name: Unpack scanner build
run: |
tar xvzf scanner-build-${{ matrix.goos }}-${{ matrix.goarch }}.tgz
- uses: actions/download-artifact@v4
# Run this step if it's not a PR or the PR contains the `generate-dumps-on-pr` label
# When this step is skipped `get_genesis_dump` will pull the vulnerability data from our GCS bucket
if: |
github.event_name != 'pull_request' ||
contains(github.event.pull_request.labels.*.name, 'generate-dumps-on-pr')
with:
name: vuln-dump
path: /tmp/vuln-dump
- name: Generate OSS notice
run: make ossls-notice
- name: Get genesis dump
run: |
source ./scripts/ci/lib.sh
get_genesis_dump
- name: Make bundle
run: image/scanner/rhel/create-bundle.sh image/scanner image/scanner/rhel
- name: Archive the bundle to preserve permissions
run: tar -cvzf scanner-bundle-${{ matrix.goos }}-${{ matrix.goarch }}.tgz image/scanner/rhel
- uses: actions/upload-artifact@v4
with:
name: scanner-bundle-${{ matrix.goos }}-${{ matrix.goarch }}
path: scanner-bundle-${{ matrix.goos }}-${{ matrix.goarch }}.tgz
generate-scanner-db-bundle:
# Run this job even if the generate-db-dump job was skipped, i.e., only skip this job if
# generate-db-dump failed
if: |
always() &&
(needs.generate-db-dump.result == 'success' || needs.generate-db-dump.result == 'skipped')
runs-on: ubuntu-latest
needs:
- generate-db-dump
container:
image: quay.io/stackrox-io/apollo-ci:scanner-test-0.4.1
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: 0
ref: ${{ github.event.pull_request.head.sha }}
- uses: ./.github/actions/job-preamble
- uses: actions/download-artifact@v4
if: |
github.event_name != 'pull_request' ||
contains(github.event.pull_request.labels.*.name, 'generate-dumps-on-pr')
with:
name: db-dump
path: /tmp/postgres
- name: Get db dump
run: |
source ./scripts/ci/lib.sh
get_db_dump
- name: Make db bundle
run: image/db/rhel/create-bundle.sh image/db image/db/rhel
- uses: actions/upload-artifact@v4
with:
name: scanner-db-bundle
path: image/db/rhel
build-images:
# Run this job even if previous jobs were skipped, i.e., only skip this job if one of the previous jobs failed
# or was cancelled
if: always() && !contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled')
env:
QUAY_RHACS_ENG_RO_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RO_USERNAME }}
QUAY_RHACS_ENG_RO_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RO_PASSWORD }}
QUAY_RHACS_ENG_RW_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RW_USERNAME }}
QUAY_RHACS_ENG_RW_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RW_PASSWORD }}
QUAY_STACKROX_IO_RW_USERNAME: ${{ secrets.QUAY_STACKROX_IO_RW_USERNAME }}
QUAY_STACKROX_IO_RW_PASSWORD: ${{ secrets.QUAY_STACKROX_IO_RW_PASSWORD }}
runs-on: ubuntu-latest
needs:
- define-scanner-job-matrix
- generate-scanner-bundle
- generate-scanner-db-bundle
strategy:
fail-fast: false
matrix: ${{ fromJson(needs.define-scanner-job-matrix.outputs.matrix).build_and_push }}
container:
image: quay.io/stackrox-io/apollo-ci:scanner-test-0.4.1
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: 0
ref: ${{ github.event.pull_request.head.sha }}
- uses: ./.github/actions/job-preamble
- uses: ./.github/actions/handle-tagged-build
- name: Set up QEMU
uses: docker/setup-qemu-action@v3
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- uses: actions/download-artifact@v4
with:
name: scanner-bundle-${{ matrix.goos }}-${{ matrix.goarch }}
- name: Unpack bundle
run: |
tar xvzf scanner-bundle-${{ matrix.goos }}-${{ matrix.goarch }}.tgz
- uses: actions/download-artifact@v4
with:
name: scanner-db-bundle
path: image/db/rhel
- name: Build scanner image
run: |
docker buildx build --platform "${{ matrix.goos }}/${{ matrix.goarch }}" --load -t stackrox/scanner:"$(make --no-print-directory --quiet tag)" $(make GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }} image-build-args) -f image/scanner/rhel/Dockerfile image/scanner/rhel
- name: Build scanner-slim image
run: |
docker buildx build --platform "${{ matrix.goos }}/${{ matrix.goarch }}" --load -t stackrox/scanner-slim:"$(make --no-print-directory --quiet tag)" $(make GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }} image-build-args) -f image/scanner/rhel/Dockerfile.slim image/scanner/rhel
- name: Build scanner-db image
run: |
docker buildx build --platform "${{ matrix.goos }}/${{ matrix.goarch }}" --load -t stackrox/scanner-db:"$(make --no-print-directory --quiet tag)" $(make GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }} db-image-build-args) -f image/db/rhel/Dockerfile image/db/rhel
- name: Build scanner-db-slim image
run: |
docker buildx build --platform "${{ matrix.goos }}/${{ matrix.goarch }}" --load -t stackrox/scanner-db-slim:"$(make --no-print-directory --quiet tag)" $(make GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }} db-image-build-args) -f image/db/rhel/Dockerfile.slim image/db/rhel
- name: Docker login
# Skip for external contributions.
if: |
github.event_name == 'push' || !github.event.pull_request.head.repo.fork
run: |
docker login -u "${QUAY_RHACS_ENG_RO_USERNAME}" --password-stdin quay.io <<<"${QUAY_RHACS_ENG_RO_PASSWORD}"
- name: Push images
# Skip for external contributions.
if: |
github.event_name == 'push' || !github.event.pull_request.head.repo.fork
run: |
source ./scripts/ci/lib.sh
push_scanner_image_set ${{ matrix.goarch }}
push-manifests:
# Run this job even if previous jobs were skipped, i.e., only skip this job if one of the previous jobs failed
# or was cancelled
if: always() && !contains(needs.*.result, 'failure') && !contains(needs.*.result, 'cancelled')
needs:
- define-scanner-job-matrix
- generate-scanner-bundle
- generate-scanner-db-bundle
- build-images
runs-on: ubuntu-latest
container:
image: quay.io/stackrox-io/apollo-ci:scanner-test-0.4.1
env:
QUAY_RHACS_ENG_RW_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RW_USERNAME }}
QUAY_RHACS_ENG_RW_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RW_PASSWORD }}
QUAY_STACKROX_IO_RW_USERNAME: ${{ secrets.QUAY_STACKROX_IO_RW_USERNAME }}
QUAY_STACKROX_IO_RW_PASSWORD: ${{ secrets.QUAY_STACKROX_IO_RW_PASSWORD }}
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: 0
ref: ${{ github.event.pull_request.head.sha }}
- uses: ./.github/actions/job-preamble
- uses: ./.github/actions/handle-tagged-build
- name: Push Scanner and ScannerDB image manifests
# Skip for external contributions.
if: |
github.event_name == 'push' || !github.event.pull_request.head.repo.fork
run: |
source ./scripts/ci/lib.sh
# If this is updated, be sure to update goarch in define-scanner-job-matrix above.
architectures="amd64,arm64,ppc64le,s390x"
push_scanner_image_manifest_lists "$architectures"
diff-dumps:
# Run this job if:
# - it's running on the master branch OR
# - it's in a PR context and the PR contains the `generate-dumps-on-pr` label
# Note that this doesn't run on tags
if: |
github.ref == 'refs/heads/master' ||
(github.event_name == 'pull_request' &&
contains(github.event.pull_request.labels.*.name, 'generate-dumps-on-pr'))
env:
GOOGLE_SA_STACKROX_HUB_VULN_DUMP_UPLOADER: ${{ secrets.GOOGLE_SA_STACKROX_HUB_VULN_DUMP_UPLOADER }}
SCANNER_GCP_SERVICE_ACCOUNT_CREDS: ${{ secrets.SCANNER_GCP_SERVICE_ACCOUNT_CREDS }}
GOOGLE_SA_CIRCLECI_SCANNER: ${{ secrets.GOOGLE_SA_CIRCLECI_SCANNER }}
runs-on: ubuntu-latest
needs:
- generate-genesis-dump
container:
image: quay.io/stackrox-io/apollo-ci:scanner-test-0.4.1
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: 0
ref: ${{ github.event.pull_request.head.sha }}
- uses: ./.github/actions/job-preamble
- uses: actions/download-artifact@v4
with:
name: updater-build
- name: Unpack updater build
run: |
tar xvzf updater-build.tgz
- uses: actions/download-artifact@v4
with:
name: genesis-dump
path: /tmp/genesis-dump
- name: diff-dumps
run: ./scripts/ci/jobs/diff-dumps.sh
- uses: actions/upload-artifact@v4
with:
name: diff-dumps-inspect
path: /tmp/diff-dumps-inspect
- uses: actions/upload-artifact@v4
with:
name: offline-dump
path: /tmp/offline-dump/scanner-vuln-updates.zip
# TODO(blugo): This job is for a very particular use case. If we want to officially support this image, we should
# bake it into the rest of the build process instead of having it be its own bespoke job.
# This job downloads the vulnerability data we push to the GCS bucket in a previous job and adds it into a container
# image.
build-and-push-vulnerabilities-image:
env:
QUAY_STACKROX_IO_RW_USERNAME: ${{ secrets.QUAY_STACKROX_IO_RW_USERNAME }}
QUAY_STACKROX_IO_RW_PASSWORD: ${{ secrets.QUAY_STACKROX_IO_RW_PASSWORD }}
runs-on: ubuntu-latest
# Only run on master branch
if: github.ref == 'refs/heads/master'
needs:
- diff-dumps
steps:
# Required for making the tag
- name: Checkout repository
uses: actions/checkout@v4
with:
fetch-depth: 0
ref: ${{ github.event.pull_request.head.sha }}
- uses: actions/download-artifact@v4
with:
name: offline-dump
- name: Set up QEMU
uses: docker/setup-qemu-action@v3
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Docker login
# Skip for external contributions.
if: |
github.event_name == 'push' || !github.event.pull_request.head.repo.fork
run: |
docker login -u "${QUAY_STACKROX_IO_RW_USERNAME}" --password-stdin quay.io <<<"${QUAY_STACKROX_IO_RW_PASSWORD}"
- name: Build and save definitions images
run: |
set -e
TAG="$(make tag)"
QUAY_TAG_EXPIRATION=never
DOCKER_ARGS=(
"--build-arg" "LABEL_VERSION=${TAG}"
"--build-arg" "LABEL_RELEASE=${TAG}"
"--build-arg" "QUAY_TAG_EXPIRATION=${QUAY_TAG_EXPIRATION}"
)
BASE_IMAGE_TAG="quay.io/stackrox-io/vulnerabilities:latest"
architectures=("amd64" "arm64" "ppc64le" "s390x")
image_list=()
for arch in "${architectures[@]}"; do
arch_image_tag="${BASE_IMAGE_TAG}-${arch}"
docker buildx build \
--platform "linux/${arch}" \
--load \
--tag "${arch_image_tag}" \
"${DOCKER_ARGS[@]}" \
-f image/vulnerabilities/Dockerfile .
image_list+=("${arch_image_tag}")
done
for image in "${image_list[@]}"; do
docker push "${image}"
done
docker manifest create "${BASE_IMAGE_TAG}" "${image_list[@]}"
docker manifest push "${BASE_IMAGE_TAG}"
upload-db-dump:
# Only run this step on the master branch
# Note that our scheduled jobs run on the master branch
if: github.ref == 'refs/heads/master'
env:
GOOGLE_SA_CIRCLECI_SCANNER: ${{ secrets.GOOGLE_SA_CIRCLECI_SCANNER }}
runs-on: ubuntu-latest
needs:
- generate-db-dump
container:
image: quay.io/stackrox-io/apollo-ci:scanner-test-0.4.1
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: 0
ref: master
- uses: ./.github/actions/job-preamble
- uses: actions/download-artifact@v4
with:
name: db-dump
path: /tmp/postgres
- name: upload-db-dump
run: ./scripts/ci/jobs/upload-db-dump.sh
upload-dumps-for-downstream:
# Only run this step on the master branch or any tags
# Note that our scheduled jobs run on the master branch
if: github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/tags/')
env:
GOOGLE_SA_STACKROX_HUB_VULN_DUMP_UPLOADER: ${{ secrets.GOOGLE_SA_STACKROX_HUB_VULN_DUMP_UPLOADER }}
runs-on: ubuntu-latest
needs:
- generate-db-dump
container:
image: quay.io/stackrox-io/apollo-ci:scanner-test-0.4.1
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: 0
- uses: ./.github/actions/job-preamble
- uses: ./.github/actions/handle-tagged-build
- uses: actions/download-artifact@v4
with:
name: vuln-dump
path: /tmp/vuln-dump
- uses: actions/download-artifact@v4
with:
name: db-dump
path: /tmp/postgres
- name: upload-dumps-for-downstream
run: ./scripts/ci/jobs/upload-dumps-for-downstream.sh
upload-dumps-for-embedding:
# Only run this step on the master branch
# Note that our scheduled jobs run on the master branch
if: github.ref == 'refs/heads/master'
env:
GOOGLE_SA_CIRCLECI_SCANNER: ${{ secrets.GOOGLE_SA_CIRCLECI_SCANNER }}
runs-on: ubuntu-latest
needs:
- generate-db-dump
container:
image: quay.io/stackrox-io/apollo-ci:scanner-test-0.4.1
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: 0
- uses: ./.github/actions/job-preamble
- uses: actions/download-artifact@v4
with:
name: vuln-dump
path: /tmp/vuln-dump
- name: upload-dumps-for-downstream
run: ./scripts/ci/jobs/upload-dumps-for-embedding.sh
send-notification:
needs:
- diff-dumps
runs-on: ubuntu-latest
if: failure()
steps:
- name: Send Slack notification on workflow failure
run: |
curl -X POST -H 'Content-type: application/json' --data '{"text":"<${{github.server_url}}/${{github.repository}}/actions/runs/${{github.run_id}}|Workflow ${{ github.workflow }}> failed in repository ${{ github.repository }}: Failed to update offline vulnerabilities"}' ${{ secrets.SLACK_ONCALL_SCANNER_WEBHOOK }}