security_tests_python_v1.yml

name: V1 Security Tests Python Images

on:
  push:
    branches:
      - master
      - release-1.19.0-prep
  pull_request:
    # TODO revert before merge to master
    branches: [ master, release-1.19.0-prep ]
  workflow_dispatch:

jobs:
  build-upload-scan-base-images:
    runs-on: ubuntu-latest
    outputs:
      python_base_image_tag: ${{ steps.export-docker-tag.outputs.python_base_image_tag }}
      conda_base_image_tag: ${{ steps.export-docker-tag.outputs.conda_base_image_tag }}
    steps:
      - uses: actions/checkout@v4

      - name: Free up disk space (android, haskell, dotnet)
        run: |
          sudo rm -rf /usr/local/lib/android || true
          sudo rm -rf /opt/ghc || true
          sudo rm -rf /usr/share/dotnet || true
          df -h

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      # Build and scan the Conda base image
      - name: Generate and set docker Conda image tag
        id: export-docker-tag
        run: |
          TAG_CONDA="sec-tests/conda-base-$(date +%s)-$(openssl rand -hex 4)"
          echo "CONDA_BASE_IMAGE=$TAG_CONDA" >> $GITHUB_ENV
          TAG_PYTHON="sec-tests/python-base-$(date +%s)-$(openssl rand -hex 4)"
          echo "PYTHON_BASE_IMAGE=$TAG_PYTHON" >> $GITHUB_ENV
          
          echo "conda_base_image_tag=$TAG_CONDA" >> $GITHUB_OUTPUT
          echo "python_base_image_tag=$TAG_PYTHON" >> $GITHUB_OUTPUT
          
          echo "Generated Conda Base Image tag: $CONDA_BASE_IMAGE"
          echo "Generated Python Wrapper Image tag: $PYTHON_BASE_IMAGE"
      - name: Build (Conda Base Image)
        working-directory: ./wrappers/s2i/python
        run: |
          make CONDA_BASE_IMAGE=${{ env.CONDA_BASE_IMAGE}} VERSION=test docker-build-conda-base
          docker save -o /tmp/conda-image.tar ${{ env.CONDA_BASE_IMAGE}}:test
      - name: Scan Conda image
        id: scan-conda
        uses: snyk/actions/docker@master
        continue-on-error: true
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          image: ${{ env.CONDA_BASE_IMAGE}}:test
          args:  --fail-on=upgradable --app-vulns --severity-threshold=high --file=wrappers/s2i/python/Dockerfile.conda

      - name: Save Snyk result for Conda image to file
        run: echo "conda_RESULT=${{ steps.scan-conda.outcome }}" > "report-conda.txt"

      - name: Upload file
        uses: actions/upload-artifact@v4
        with:
          name: report-conda
          path: report-conda.txt

      # Build and scan the Python Wrapper base image
      - name: Build (Base Wrapper)
        working-directory: ./wrappers/s2i/python
        run: |
          make CONDA_BASE_IMAGE=${{ env.CONDA_BASE_IMAGE}} VERSION=test IMAGE_NAME=${{ env.PYTHON_BASE_IMAGE}} docker-build PYTHON_VERSION=3.12.12 CONDA_VERSION=25.3.1 BASE_IMAGE=$${{ env.CONDA_BASE_IMAGE }}
          docker save -o /tmp/python-wrapper-image.tar ${{ env.PYTHON_BASE_IMAGE}}:test
      - name: Scan Python base image
        id: scan-python-base
        uses: snyk/actions/docker@master
        continue-on-error: true
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          image: ${{ env.PYTHON_BASE_IMAGE}}:test
          args: --fail-on=upgradable --app-vulns --severity-threshold=high

      - name: Save Snyk result for Python Wrapper image to file
        run: echo "python_wrapper_RESULT=${{ steps.scan-python-base.outcome }}" > "report-python-wrapper.txt"

      - name: Upload file
        uses: actions/upload-artifact@v4
        with:
          name: report-python-wrapper
          path: report-python-wrapper.txt

      - name: Upload Conda base image
        uses: actions/upload-artifact@v4
        with:
          name: conda-base-image
          path: /tmp/conda-image.tar

      - name: Upload Python Wrapper image
        uses: actions/upload-artifact@v4
        with:
          name: python-wrapper-image
          path: /tmp/python-wrapper-image.tar

  build-servers:
    needs: build-upload-scan-base-images
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        server:
          - tfserving_proxy
          - sklearnserver
          - mlflowserver
          - xgboostserver
    steps:
      - uses: actions/checkout@v4

      # Download Conda base image
      - uses: actions/download-artifact@v4
        with:
          name: conda-base-image
      # Download Python Wrapper image
      - uses: actions/download-artifact@v4
        with:
          name: python-wrapper-image
      - name: Load images
        run: |
          docker load -i conda-image.tar
          docker load -i python-wrapper-image.tar

      - name: Remove tarballs
        run: rm -f conda-image.tar python-wrapper-image.tar

      - name: Install s2i CLI - needed for building the server images
        uses: redhat-actions/openshift-tools-installer@v1
        with:
          github_pat: ${{ github.token }}
          source: "github"
          s2i: "latest"

      - name: Build server
        id: build-server
        working-directory: ./servers/${{ matrix.server }}
        run: |
          export SERVER_IMAGE_TAG="sec-tests/${{ matrix.server }}-$(date +%s)-$(openssl rand -hex 4)"
          echo "SERVER_IMAGE_TAG=$SERVER_IMAGE_TAG" >> $GITHUB_ENV
          make IMAGE_NAME=$SERVER_IMAGE_TAG VERSION=test BASE_IMAGE=${{ needs.build-upload-scan-base-images.outputs.python_base_image_tag }}:test docker-build
      
      - name: Capture pip freeze
        run: |
          docker run --rm $SERVER_IMAGE_TAG:test pip freeze > pip-freeze-${{ matrix.server }}.txt
      
      - name: Scan
        id: scan
        uses: snyk/actions/docker@master
        continue-on-error: true
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          image: ${{ env.SERVER_IMAGE_TAG}}:test
          args:  --fail-on=upgradable --app-vulns --severity-threshold=high

      - name: Save scan output to file
        run: echo "${{ matrix.server }}_RESULT=${{ steps.scan.outcome }}" > "report-${{ matrix.server }}.txt"

      - name: Upload file
        uses: actions/upload-artifact@v4
        with:
          name: report-${{ matrix.server }}
          path: report-${{ matrix.server }}.txt
      
      - name: Upload pip freeze
        uses: actions/upload-artifact@v4
        with:
          name: pip-freeze-${{ matrix.server }}
          path: pip-freeze-${{ matrix.server }}.txt

  build-alibi-explain:
    needs: build-upload-scan-base-images
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Free up disk space (android, haskell, dotnet)
        run: |
          sudo rm -rf /usr/local/lib/android || true
          sudo rm -rf /opt/ghc || true
          sudo rm -rf /usr/share/dotnet || true
          df -h

      # Download Conda base image
      - uses: actions/download-artifact@v4
        with:
          name: conda-base-image
      - name: Load images
        run: docker load -i conda-image.tar

      - name: Remove tarballs
        run: rm -f conda-image.tar

      - name: Build Alibi Explain
        id: build-alibi-explain
        working-directory: ./components/alibi-explain-server
        run: |
          export ALIBI_EXPLAIN_IMAGE_TAG="sec-tests/alibi-explain-$(date +%s)-$(openssl rand -hex 4)"
          echo "ALIBI_EXPLAIN_IMAGE_TAG=$ALIBI_EXPLAIN_IMAGE_TAG" >> $GITHUB_ENV
          make IMAGE=$ALIBI_EXPLAIN_IMAGE_TAG VERSION=test BASE_IMAGE=${{ needs.build-upload-scan-base-images.outputs.conda_base_image_tag }} docker-build

      - name: Free space by removing the Conda Base Docker image
        run: docker rmi ${{ needs.build-upload-scan-base-images.outputs.conda_base_image_tag }}:test

      - name: Free up space by removing the Docker Builder caches
        run: docker builder prune -af

      - name: Scan alibi explain
        id: scan-alibi-explain
        if: steps.build-alibi-explain.outcome == 'success'
        uses: snyk/actions/docker@master
        continue-on-error: true
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          image: ${{ env.ALIBI_EXPLAIN_IMAGE_TAG}}:test
          args:  --fail-on=upgradable --app-vulns --severity-threshold=high

      - name: Save scan output to file
        run: echo "alibi_explain_RESULT=${{ steps.scan-alibi-explain.outcome }}" > "report-alibi-explain.txt"

      - name: Upload file
        uses: actions/upload-artifact@v4
        with:
          name: report-alibi-explain
          path: report-alibi-explain.txt

  build-alibi-detect:
    needs: build-upload-scan-base-images
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Free up disk space (android, haskell, dotnet)
        run: |
          sudo rm -rf /usr/local/lib/android || true
          sudo rm -rf /opt/ghc || true
          sudo rm -rf /usr/share/dotnet || true
          df -h

      # Download Conda base image
      - uses: actions/download-artifact@v4
        with:
          name: conda-base-image
      - name: Load image
        run: docker load -i conda-image.tar

      - name: Remove tarballs
        run: rm -f conda-image.tar

      - name: Build Alibi Detect
        id: build-alibi-detect
        working-directory: ./components/alibi-detect-server
        run: |
          export ALIBI_DETECT_IMAGE_TAG="sec-tests/alibi-detect-$(date +%s)-$(openssl rand -hex 4)"
          echo "ALIBI_DETECT_IMAGE_TAG=$ALIBI_DETECT_IMAGE_TAG" >> $GITHUB_ENV
          make IMAGE=$ALIBI_DETECT_IMAGE_TAG VERSION=test BASE_IMAGE=${{ needs.build-upload-scan-base-images.outputs.conda_base_image_tag }} docker-build

      - name: Free space by removing the Conda Base Docker image
        run: docker rmi ${{ needs.build-upload-scan-base-images.outputs.conda_base_image_tag }}:test

      - name: Free up space by removing the Docker Builder caches
        run: docker builder prune -af

      - name: Scan alibi detect
        id: scan-alibi-detect
        if: steps.build-alibi-detect.outcome == 'success'
        uses: snyk/actions/docker@master
        continue-on-error: true
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          image: ${{ env.ALIBI_DETECT_IMAGE_TAG}}:test
          args:  --fail-on=upgradable --app-vulns --severity-threshold=high

      - name: Save scan output to file
        run: echo "alibi_detect_RESULT=${{ steps.scan-alibi-detect.outcome }}" > "report-alibi-detect.txt"

      - name: Upload file
        uses: actions/upload-artifact@v4
        with:
          name: report-alibi-detect
          path: report-alibi-detect.txt

  verify-scans:
    needs: [ build-upload-scan-base-images, build-servers, build-alibi-explain, build-alibi-detect]
    runs-on: ubuntu-latest
    if: always()

    steps:
      - name: Download Snyk results for servers
        uses: actions/download-artifact@v4
        with:
          pattern: report-*
          merge-multiple: true

      - name: Fail if any scan failed
        run: |
          echo "Checking scan results..."
          
          cat report-* > combined.txt
          cat combined.txt
          
          if grep -q "failure" combined.txt; then
            echo "A component reported failure"
            exit 1
          fi