Skip to content

Commit 65ab18e

Browse files
thpiercethpierce
authored
Add image scanning (#136)
In this PR we are adding image scanning workflows. We are adding a daily scanner that we will monitor and alarm on, as well as a scanner that can be run per-PR/build/release. Further, we are adding post-release steps to update the daily scanner to look at the latest released image. Tested `sed` command used in `post_release_version_bump.yml` here: https://github.com/aws-observability/aws-otel-python-instrumentation/actions/runs/8530266063/job/23367719655?pr=137 By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.
1 parent 7b6d067 commit 65ab18e

File tree

6 files changed

+119
-12
lines changed

6 files changed

+119
-12
lines changed

‎.github/actions/artifacts_build/action.yml

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
name: Build and Push aws-opentelemetry-distro
22
description: |
3-
This action assumes that the repo was checked out. Builds and pushes/loads wheel and image files.
3+
This action assumes that the repo was checked out. Builds and pushes/loads wheel and image files. Also performs scan
4+
of the resultant image.
45
56
inputs:
67
aws-region:
@@ -90,4 +91,10 @@ runs:
9091
file: ./Dockerfile
9192
platforms: linux/amd64
9293
tags: ${{ inputs.image_uri_with_tag }}
93-
load: ${{ inputs.load_image }}
94+
load: ${{ inputs.load_image }}
95+
96+
- name: Perform image scan
97+
uses: ./.github/actions/image_scan
98+
with:
99+
image-ref: ${{ inputs.image_uri_with_tag }}
100+
severity: 'CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN'

‎.github/actions/image_scan/action.yml

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
## Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
2+
## SPDX-License-Identifier: Apache-2.0
3+
name: image-scan
4+
description: |
5+
This action performs a scan of a provided (local or public ECR remote) image, using Trivy.
6+
7+
inputs:
8+
image-ref:
9+
required: true
10+
description: "Reference for the image to be scanned"
11+
severity:
12+
required: true
13+
description: "List of severities that will cause a failure"
14+
15+
runs:
16+
using: "composite"
17+
steps:
18+
19+
# Per https://docs.aws.amazon.com/AmazonECR/latest/public/docker-pull-ecr-image.html, it is possible to
20+
# make unauthorized calls to get public ECR images (needed to build the ADOT Python docker image), but
21+
# it can fail if you previously authenticated to a public repo. Adding this step to log out, so we
22+
# ensure we can make unauthenticated call. This is important for making the pr_build workflow run on
23+
# PRs created from forked repos.
24+
- name: Logout of public AWS ECR
25+
shell: bash
26+
run: docker logout public.ecr.aws
27+
28+
- name: Run Trivy vulnerability scanner on image
29+
uses: aquasecurity/trivy-action@master
30+
with:
31+
image-ref: ${{ inputs.image-ref }}
32+
severity: ${{ inputs.severity }}
33+
exit-code: '1'

‎.github/workflows/post_release_version_bump.yml

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,10 @@ jobs:
4040
run: |
4141
DEV_VERSION="${{ github.event.inputs.version }}.dev0"
4242
sed -i 's/__version__ = ".*"/__version__ = "'$DEV_VERSION'"/' aws-opentelemetry-distro/src/amazon/opentelemetry/distro/version.py
43+
VERSION="${{ github.event.inputs.version }}"
44+
sed -i 's/python:v.*"/python:v'$VERSION'"/' .github/workflows/released_image_scan.yml
4345
git add aws-opentelemetry-distro/src/amazon/opentelemetry/distro/version.py
46+
git add .github/workflows/released_image_scan.yml
4447
git commit -m "Prepare main for next development cycle: Update version to $DEV_VERSION"
4548
git push --set-upstream origin "prepare-main-for-next-dev-cycle-${VERSION}"
4649
@@ -50,7 +53,7 @@ jobs:
5053
run: |
5154
DEV_VERSION="${{ github.event.inputs.version }}.dev0"
5255
gh pr create --title "Post release $VERSION: Update version to $DEV_VERSION" \
53-
--body "This PR prepares the main branch for the next development cycle by updating the version to $DEV_VERSION.
56+
--body "This PR prepares the main branch for the next development cycle by updating the version to $DEV_VERSION and updating the image version to be scanned to the latest released.
5457
5558
This PR should only be merge when release for version v$VERSION is success.
5659

‎.github/workflows/pr_build.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ jobs:
2323
- name: Build Wheel and Image Files
2424
uses: ./.github/actions/artifacts_build
2525
with:
26-
image_uri_with_tag: pr_build
26+
image_uri_with_tag: pr_build/${{ matrix.python-version }}
2727
push_image: false
2828
load_image: true
2929
python_version: ${{ matrix.python-version }}

‎.github/workflows/release_build.yml

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -26,18 +26,10 @@ jobs:
2626
- name: Checkout Contrib Repo @ SHA - ${{ github.sha }}
2727
uses: actions/checkout@v4
2828

29-
# NOTE: do not set push_image to true for this step.
30-
# Some of the required params below are set to dummy values
31-
# as they are only used in the artifacts_build action when push_image is true,
32-
# and setting them to some legit value might cause confusion
33-
# to readers.
3429
- name: Build Wheel and Image Files
3530
uses: ./.github/actions/artifacts_build
3631
with:
37-
aws-region: ${{ env.AWS_DEFAULT_REGION }}
3832
image_uri_with_tag: "adot-autoinstrumentation-python:test"
39-
image_registry: "dummy-registry"
40-
snapshot-ecr-role: "dummy-role"
4133
push_image: false
4234
load_image: false
4335
python_version: "3.10"

‎.github/workflows/released_image_scan.yml

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
## Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
2+
## SPDX-License-Identifier: Apache-2.0
3+
name: Released image scan
4+
description: |
5+
Performs a daily scan of the latest released ADOT Python image. Publishes results to CloudWatch Metrics.
6+
7+
on:
8+
schedule:
9+
- cron: '0 18 * * *' # scheduled to run at 18:00 UTC every day
10+
workflow_dispatch: # be able to run the workflow on demand
11+
12+
permissions:
13+
id-token: write
14+
contents: read
15+
16+
jobs:
17+
scan_and_report:
18+
runs-on: ubuntu-latest
19+
steps:
20+
- name: Perform high scan
21+
id: high_scan
22+
uses: ./.github/actions/image_scan
23+
with:
24+
image-ref: "public.ecr.aws/aws-observability/adot-autoinstrumentation-python:v0.0.1"
25+
severity: 'CRITICAL,HIGH'
26+
27+
- name: Perform low scan
28+
if: always()
29+
id: low_scan
30+
uses: ./.github/actions/image_scan
31+
with:
32+
image-ref: "public.ecr.aws/aws-observability/adot-autoinstrumentation-python:v0.0.1"
33+
severity: 'MEDIUM,LOW,UNKNOWN'
34+
35+
- name: Configure AWS Credentials
36+
if: always()
37+
uses: aws-actions/configure-aws-credentials@v4
38+
with:
39+
role-to-assume: ${{ secrets.E2E_SECRET_TEST_ROLE_ARN }}
40+
aws-region: us-east-1
41+
42+
- name: Publish high scan status success
43+
if: steps.high_scan.outcome == "success'
44+
run: |
45+
aws cloudwatch put-metric-data --namespace 'ADOT/GitHubActions' \
46+
--metric-name Success \
47+
--dimensions repository=${{ github.repository }},branch=${{ github.ref_name }},workflow=released_image_scan_high \
48+
--value 1.0
49+
50+
- name: Publish high scan status failure
51+
if: steps.high_scan.outcome != 'success'
52+
run: |
53+
aws cloudwatch put-metric-data --namespace 'ADOT/GitHubActions' \
54+
--metric-name Success \
55+
--dimensions repository=${{ github.repository }},branch=${{ github.ref_name }},workflow=released_image_scan_high \
56+
--value 0.0
57+
58+
- name: Publish low scan status success
59+
if: steps.low_scan.outcome == "success'
60+
run: |
61+
aws cloudwatch put-metric-data --namespace 'ADOT/GitHubActions' \
62+
--metric-name Success \
63+
--dimensions repository=${{ github.repository }},branch=${{ github.ref_name }},workflow=released_image_scan_low \
64+
--value 1.0
65+
66+
- name: Publish low scan status failure
67+
if: steps.low_scan.outcome != 'success'
68+
run: |
69+
aws cloudwatch put-metric-data --namespace 'ADOT/GitHubActions' \
70+
--metric-name Success \
71+
--dimensions repository=${{ github.repository }},branch=${{ github.ref_name }},workflow=released_image_scan_low \
72+
--value 0.0

0 commit comments

Comments
 (0)