-
Notifications
You must be signed in to change notification settings - Fork 2
124 lines (108 loc) · 3.91 KB
/
vulncheck_periodic.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
name: Vuln check
on:
schedule:
- cron: '0 */6 * * *'
permissions:
contents: read
security-events: write
jobs:
vuln-check:
name: Build & push image
runs-on: ubuntu-latest
permissions:
repository-projects: read
contents: read
actions: read
id-token: write
steps:
- name: Set up Go
uses: actions/setup-go@v5
with:
go-version: "1.21"
- name: Check out code
uses: actions/checkout@v1
- name: Login to Github Packages
uses: docker/login-action@v2
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.RELEASE_GITHUB_TOKEN }}
- name: Set up Docker Buildx
id: buildx
uses: docker/setup-buildx-action@v2
- name: Checkout SolaceDev/maas-build-actions
uses: actions/checkout@v2
with:
repository: SolaceDev/maas-build-actions
ref: refs/heads/master
token: ${{ secrets.RELEASE_GITHUB_TOKEN }}
persist-credentials: false
path: maas-build-actions
- name: Retrieve google container registry secrets
id: docker_registry_secrets
uses: hashicorp/[email protected]
with:
url: "${{ env.VAULT_ADDR }}"
role: github-docker-secrets-read-role
method: jwt
path: jwt-github
jwtGithubAudience: https://github.com/SolaceDev
exportToken: true
secrets: |
secret/data/development/gcp-gcr GCP_SERVICE_ACCOUNT | GCP_DEV_SERVICE_ACCOUNT
- name: Log in to gcr development docker registry
uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9
with:
registry: gcr.io
username: _json_key
password: ${{ steps.docker_registry_secrets.outputs.GCP_DEV_SERVICE_ACCOUNT }}
- name: Build image and push Google Container Registry
uses: docker/build-push-action@v2
with:
context: ./
tags: |
gcr.io/${{ env.GCLOUD_PROJECT_ID_DEV }}/${{ env.IMAGE_NAME }}:${{ env.VERSION }}
push: true
- name: Run Vulnerability PreCheck for Prisma
uses: ./maas-build-actions/.github/actions/prisma-vulnerability-checker
with:
docker_image_to_check: gcr.io/${{ env.GCLOUD_PROJECT_ID_DEV }}/${{ env.IMAGE_NAME }}:${{ env.VERSION }}
prisma_repository_name: "${{ env.GCLOUD_PROJECT_ID_DEV }}/${{ env.IMAGE_NAME }}"
project_squad: "launchpad"
prisma_jira_check: "False"
- name: Build image and push GitHub Container Registry
run: make docker-push
- name: Run Whitesource Action
uses: SolaceDev/[email protected]
with:
wssURL: https://saas.whitesourcesoftware.com/agent
apiKey: ${{ secrets.WSS_API_KEY }}
productName: 'pubsubplus-kubernetes-operator'
projectName: 'pubsubplus-kubernetes-operator'
configFile: 'ci/whitesource/whitesource-agent.config'
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@master
with:
image-ref: ghcr.io/solacedev/${{ env.IMAGE_NAME }}:${{ env.VERSION }}
format: 'sarif'
severity: 'CRITICAL,HIGH'
output: 'trivy-results.sarif'
- name: Uploads Trivy Scan Reports
if: ${{ always() }}
uses: actions/upload-artifact@v2
with:
path: |
trivy-results.sarif
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@master
with:
image-ref: ghcr.io/solacedev/${{ env.IMAGE_NAME }}:${{ env.VERSION }}
format: 'sarif'
severity: 'CRITICAL,HIGH'
output: 'trivy-results.sarif'
- name: Uploads Trivy Scan Reports
if: ${{ !startsWith(github.ref_name, '1.') }}
uses: actions/upload-artifact@v2
with:
path: |
trivy-results.sarif