Skip to content

Commit 906a750

Browse files
vtaskowvtaskow
authored
chore(ci-snyk): Refactor Snyk workflows to avoid 'no disk space' issues for Snyk (#7002)
* Remove security scans for v1 and v2; v1 will be split into 2 files * Add Snyk scans for python images * Add Snyk scans for go images + Rclone * Add Snyk scan for go.mod operator and executor, and the python package
1 parent 5e7aad0 commit 906a750

File tree

5 files changed

+423
-367
lines changed

5 files changed

+423
-367
lines changed

‎.github/workflows/security_code_tests_v1.yml‎

Lines changed: 36 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -4,54 +4,53 @@ on:
44
push:
55
branches: [ master ]
66
pull_request:
7-
branches: [ master ]
7+
# TODO remove release-1.19.0-prep before merge to master
8+
branches:
9+
- master
10+
- release-1.19.0-prep
811
workflow_dispatch:
912

1013
jobs:
1114
security-python:
1215
runs-on: ubuntu-latest
13-
container: snyk/snyk:python-3.8
16+
container: snyk/snyk:python-3.12-preview
1417
steps:
15-
- uses: actions/checkout@v2
16-
- name: security-python
17-
env:
18-
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
19-
run: |
20-
pip install -e python/.
21-
snyk test --file=python/setup.py --fail-on=upgradable --severity-threshold=high
18+
- uses: actions/checkout@v4
19+
- name: security-python
20+
# NOTE: [all] installs tensorflow as well as an extra
21+
run: |
22+
pip install -e python/.[all]
23+
snyk test --file=python/setup.py --fail-on=upgradable --severity-threshold=high
24+
env:
25+
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
2226

2327
security-operator:
2428
runs-on: ubuntu-latest
2529
steps:
26-
- uses: actions/checkout@v2
27-
- name: security-operator
28-
# NOTE: We use the Snyk action (instead of the Snyk base image) so that
29-
# it respects the Go version we use.
30-
uses: snyk/actions/golang@master
31-
with:
32-
args: --fail-on=upgradable
33-
--severity-threshold=high
34-
--file=operator/go.mod
35-
env:
36-
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
30+
- uses: actions/checkout@v4
31+
- uses: snyk/actions/setup@master
32+
- uses: actions/setup-go@v3
33+
with:
34+
go-version: '1.24.7'
35+
- name: security-operator
36+
run: snyk test --file=operator/go.mod --fail-on=upgradable --severity-threshold=high
37+
env:
38+
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
3739

3840
security-executor:
3941
runs-on: ubuntu-latest
4042
steps:
41-
- uses: actions/checkout@v2
42-
- uses: snyk/actions/setup@master
43-
- uses: actions/setup-go@v3
44-
with:
45-
go-version: '^1.24.7'
46-
- name: Set up executor's environment
47-
# NOTE: The executor needs a couple extra steps before we can build it,
48-
# like copying the operator's package into the executor's folder so that
49-
# it's accessible.
50-
run: make -C executor/ executor
51-
- name: security-executor
52-
run: snyk test \
53-
--fail-on=upgradable
54-
--severity-threshold=high
55-
--file=executor/go.mod
56-
env:
57-
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
43+
- uses: actions/checkout@v4
44+
- uses: snyk/actions/setup@master
45+
- uses: actions/setup-go@v3
46+
with:
47+
go-version: '1.24.7'
48+
- name: Set up executor's environment
49+
# NOTE: The executor needs a couple extra steps before we can build it,
50+
# like copying the operator's package into the executor's folder so that
51+
# it's accessible.
52+
run: make -C executor/ executor
53+
- name: security-executor
54+
run: snyk test --file=executor/go.mod --fail-on=upgradable --severity-threshold=high
55+
env:
56+
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

‎.github/workflows/security_tests_go_v1.yml‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
name: V1 Security Tests Go Images
2+
3+
on:
4+
push:
5+
branches: [ master ]
6+
pull_request:
7+
# TODO remove release-1.19.0-prep before merge to master
8+
branches:
9+
- master
10+
- release-1.19.0-prep
11+
workflow_dispatch:
12+
13+
jobs:
14+
image-executor:
15+
runs-on: ubuntu-latest
16+
steps:
17+
- uses: actions/checkout@v4
18+
- name: Set up Docker Buildx
19+
uses: docker/setup-buildx-action@v3
20+
- name: Generate and set docker image tag
21+
run: |
22+
TAG="executor-test-$(date +%s)-$(openssl rand -hex 4)"
23+
echo "SELDON_EXECUTOR_IMG=$TAG" >> $GITHUB_ENV
24+
echo "Generated tag: SELDON_EXECUTOR_IMG"
25+
- name: Build docker image
26+
working-directory: ./executor/
27+
env:
28+
VERSION: ${{ steps.docker-tag.outputs.value }}
29+
run: |
30+
make docker-build
31+
- name: Scan docker image for CVEs
32+
uses: snyk/actions/docker@master
33+
continue-on-error: false
34+
env:
35+
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
36+
with:
37+
image: ${{ env.SELDON_EXECUTOR_IMG }}
38+
args: --app-vulns --severity-threshold=high --file=executor/Dockerfile.executor --fail-on=upgradable
39+
40+
image-operator:
41+
runs-on: ubuntu-latest
42+
steps:
43+
- uses: actions/checkout@v4
44+
- name: Set up Docker Buildx
45+
uses: docker/setup-buildx-action@v3
46+
- name: Generate and set docker image tag
47+
run: |
48+
TAG="operator-test-$(date +%s)-$(openssl rand -hex 4)"
49+
echo "SELDON_OPERATOR_IMG=$TAG" >> $GITHUB_ENV
50+
echo "Generated tag: SELDON_OPERATOR_IMG"
51+
- name: Build docker image
52+
working-directory: ./operator/
53+
env:
54+
VERSION: ${{ steps.docker-tag.outputs.value }}
55+
run: |
56+
make docker-build
57+
- name: Scan docker image for CVEs
58+
uses: snyk/actions/docker@master
59+
continue-on-error: false
60+
env:
61+
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
62+
with:
63+
image: ${{ env.SELDON_OPERATOR_IMG }}
64+
args: --app-vulns --severity-threshold=high --file=operator/Dockerfile --fail-on=upgradable
65+
66+
image-rclone-storage-initializer:
67+
runs-on: ubuntu-latest
68+
steps:
69+
- uses: actions/checkout@v4
70+
- name: Build (rclone initializer)
71+
working-directory: ./components/rclone-storage-initializer
72+
run: |
73+
export RCLONE_IMAGE_TAG="sec-tests.io/rclone-$(date +%s)-$(openssl rand -hex 4):test"
74+
echo "RCLONE_IMAGE_TAG=$RCLONE_IMAGE_TAG" >> $GITHUB_ENV
75+
make IMAGE_TAG=$RCLONE_IMAGE_TAG docker-build
76+
- name: Scan rclone
77+
uses: snyk/actions/docker@master
78+
env:
79+
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
80+
with:
81+
image: ${{ env.RCLONE_IMAGE_TAG }}
82+
args: --app-vulns --severity-threshold=high --file=components/rclone-storage-initializer/Dockerfile --fail-on=upgradable

0 commit comments

Comments
 (0)