Skip to content

Commit abf9040

Browse files
mboersmamboersma
committed
Run verify-security weekly as a GitHub action
1 parent 237b321 commit abf9040

File tree

5 files changed

+139
-52
lines changed

5 files changed

+139
-52
lines changed

‎.github/workflows/scan.yml‎

Lines changed: 0 additions & 22 deletions
This file was deleted.

‎.github/workflows/security-scan.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
name: Weekly security scan
2+
3+
on:
4+
schedule:
5+
# Cron for every Monday at 12:00 UTC.
6+
- cron: "0 12 * * 1"
7+
workflow_dispatch:
8+
inputs:
9+
branch:
10+
description: 'Branch to scan'
11+
required: false
12+
default: 'main'
13+
type: string
14+
15+
# Remove all permissions from GITHUB_TOKEN except metadata.
16+
permissions: {}
17+
18+
jobs:
19+
scan:
20+
strategy:
21+
fail-fast: false
22+
matrix:
23+
branch: [ ${{ inputs.branch || 'main' }} ]
24+
name: Trivy
25+
runs-on: ubuntu-latest
26+
steps:
27+
- name: Check out code
28+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # tag=v4.2.2
29+
with:
30+
ref: ${{ matrix.branch }}
31+
- name: Calculate go version
32+
id: vars
33+
run: echo "go_version=$(make go-version)" >> $GITHUB_OUTPUT
34+
- name: Set up Go
35+
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # tag=v5.5.0
36+
with:
37+
go-version: ${{ steps.vars.outputs.go_version }}
38+
- name: Run verify security target
39+
run: make verify-security

‎Makefile‎

Lines changed: 36 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -174,6 +174,8 @@ RELEASE_NOTES_VER := v0.18.0
174174
RELEASE_NOTES_BIN := release-notes
175175
RELEASE_NOTES := $(TOOLS_BIN_DIR)/$(RELEASE_NOTES_BIN)-$(RELEASE_NOTES_VER)
176176

177+
TRIVY_VER := 0.64.0
178+
177179
YQ_VER := v4.35.2
178180
YQ_BIN := yq
179181
YQ := $(abspath $(TOOLS_BIN_DIR)/$(YQ_BIN)-$(YQ_VER))
@@ -203,6 +205,11 @@ TILT_PREPARE := $(abspath $(TOOLS_BIN_DIR)/$(TILT_PREPARE_BIN))
203205
GOLANGCI_LINT_BIN := golangci-lint
204206
GOLANGCI_LINT := $(abspath $(TOOLS_BIN_DIR)/$(GOLANGCI_LINT_BIN))
205207

208+
GOVULNCHECK_BIN := govulncheck
209+
GOVULNCHECK_VER := v1.1.4
210+
GOVULNCHECK := $(abspath $(TOOLS_BIN_DIR)/$(GOVULNCHECK_BIN)-$(GOVULNCHECK_VER))
211+
GOVULNCHECK_PKG := golang.org/x/vuln/cmd/govulncheck
212+
206213
HELM_VER := $(call get_go_version,helm.sh/helm/v3)
207214
HELM_BIN := helm
208215
HELM := $(TOOLS_BIN_DIR)/$(HELM_BIN)-$(HELM_VER)
@@ -262,6 +269,9 @@ all: test manager
262269
help: # Display this help
263270
@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n make \033[36m<target>\033[0m\n"} /^[0-9A-Za-z_-]+:.*?##/ { printf " \033[36m%-45s\033[0m %s\n", $$1, $$2 } /^\$$\([0-9A-Za-z_-]+\):.*?##/ { gsub("_","-", $$1); printf " \033[36m%-45s\033[0m %s\n", tolower(substr($$1, 3, length($$1)-7)), $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)
264271

272+
go-version: ## Print the go version we use to compile our binaries and images
273+
@echo $(GO_VERSION)
274+
265275
## --------------------------------------
266276
## Generate / Manifests
267277
## --------------------------------------
@@ -384,7 +394,26 @@ verify-shellcheck: ## Verify shell files
384394

385395
.PHONY: verify-container-images
386396
verify-container-images: ## Verify container images
387-
TRACE=$(TRACE) ./hack/verify-container-images.sh
397+
TRACE=$(TRACE) ./hack/verify-container-images.sh $(TRIVY_VER)
398+
399+
.PHONY: verify-govulncheck
400+
verify-govulncheck: $(GOVULNCHECK) ## Verify code for vulnerabilities
401+
$(GOVULNCHECK) ./... && R1=$$? || R1=$$?; \
402+
$(GOVULNCHECK) -C "$(TOOLS_DIR)" ./... && R2=$$? || R2=$$?; \
403+
$(GOVULNCHECK) -C "$(TEST_DIR)" ./... && R3=$$? || R3=$$?; \
404+
if [ "$$R1" -ne "0" ] || [ "$$R2" -ne "0" ] || [ "$$R3" -ne "0" ]; then \
405+
exit 1; \
406+
fi
407+
408+
.PHONY: verify-security
409+
verify-security: ## Verify code and images for vulnerabilities
410+
$(MAKE) verify-container-images && R1=$$? || R1=$$?; \
411+
$(MAKE) verify-govulncheck && R2=$$? || R2=$$?; \
412+
if [ "$$R1" -ne "0" ] || [ "$$R2" -ne "0" ]; then \
413+
echo "Check for vulnerabilities failed! There are vulnerabilities to be fixed"; \
414+
exit 1; \
415+
fi
416+
388417

389418
## --------------------------------------
390419
## Binaries
@@ -759,6 +788,12 @@ $(TILT_PREPARE_BIN): $(TILT_PREPARE) ## Build a local copy of tilt-prepare.
759788
.PHONY: $(GOLANGCI_LINT_BIN)
760789
$(GOLANGCI_LINT_BIN): $(GOLANGCI_LINT) ## Build a local copy of golangci-lint
761790

791+
.PHONY: $(GOVULNCHECK_BIN)
792+
$(GOVULNCHECK_BIN): $(GOVULNCHECK) ## Build a local copy of govulncheck.
793+
794+
$(GOVULNCHECK): # Build govulncheck.
795+
GOBIN=$(TOOLS_BIN_DIR) $(GO_INSTALL) $(GOVULNCHECK_PKG) $(GOVULNCHECK_BIN) $(GOVULNCHECK_VER)
796+
762797
.PHONY: $(GINKGO_BIN)
763798
$(GINKGO_BIN): $(GINKGO) ## Build a local copy of ginkgo
764799

‎hack/ensure-trivy.sh‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
#!/bin/bash
2+
3+
# Copyright 2025 The Kubernetes Authors.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
set -o errexit
18+
set -o nounset
19+
set -o pipefail
20+
21+
if [[ "${TRACE-0}" == "1" ]]; then
22+
set -o xtrace
23+
fi
24+
25+
VERSION=${1}
26+
27+
GO_OS="$(go env GOOS)"
28+
if [[ "${GO_OS}" == "linux" ]]; then
29+
TRIVY_OS="Linux"
30+
elif [[ "${GO_OS}" == "darwin"* ]]; then
31+
TRIVY_OS="macOS"
32+
fi
33+
34+
GO_ARCH="$(go env GOARCH)"
35+
if [[ "${GO_ARCH}" == "amd" ]]; then
36+
TRIVY_ARCH="32bit"
37+
elif [[ "${GO_ARCH}" == "amd64"* ]]; then
38+
TRIVY_ARCH="64bit"
39+
elif [[ "${GO_ARCH}" == "arm" ]]; then
40+
TRIVY_ARCH="ARM"
41+
elif [[ "${GO_ARCH}" == "arm64" ]]; then
42+
TRIVY_ARCH="ARM64"
43+
fi
44+
45+
TOOL_BIN=hack/tools/bin
46+
mkdir -p ${TOOL_BIN}
47+
48+
TRIVY="${TOOL_BIN}/trivy/${VERSION}/trivy"
49+
50+
# Downloads trivy scanner
51+
if [ ! -f "$TRIVY" ]; then
52+
curl -L -o "${TOOL_BIN}/trivy.tar.gz" "https://github.com/aquasecurity/trivy/releases/download/v${VERSION}/trivy_${VERSION}_${TRIVY_OS}-${TRIVY_ARCH}.tar.gz"
53+
mkdir -p "${TOOL_BIN}/trivy/${VERSION}"
54+
tar -xf "${TOOL_BIN}/trivy.tar.gz" -C "${TOOL_BIN}/trivy/${VERSION}" trivy
55+
chmod +x "${TOOL_BIN}/trivy/${VERSION}/trivy"
56+
rm "${TOOL_BIN}/trivy.tar.gz"
57+
fi

‎hack/verify-container-images.sh‎

Lines changed: 7 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -22,51 +22,29 @@ if [[ "${TRACE-0}" == "1" ]]; then
2222
set -o xtrace
2323
fi
2424

25-
TRIVY_VERSION=0.34.0
26-
27-
GO_OS="$(go env GOOS)"
28-
if [[ "${GO_OS}" == "linux" ]]; then
29-
TRIVY_OS="Linux"
30-
elif [[ "${GO_OS}" == "darwin"* ]]; then
31-
TRIVY_OS="macOS"
32-
fi
33-
25+
VERSION=${1}
3426
GO_ARCH="$(go env GOARCH)"
35-
if [[ "${GO_ARCH}" == "amd" ]]; then
36-
TRIVY_ARCH="32bit"
37-
elif [[ "${GO_ARCH}" == "amd64"* ]]; then
38-
TRIVY_ARCH="64bit"
39-
elif [[ "${GO_ARCH}" == "arm" ]]; then
40-
TRIVY_ARCH="ARM"
41-
elif [[ "${GO_ARCH}" == "arm64" ]]; then
42-
TRIVY_ARCH="ARM64"
43-
fi
44-
45-
TOOL_BIN=hack/tools/bin
46-
mkdir -p ${TOOL_BIN}
4727

48-
# Downloads trivy scanner
49-
curl -L -o ${TOOL_BIN}/trivy.tar.gz "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_${TRIVY_OS}-${TRIVY_ARCH}.tar.gz"
28+
REPO_ROOT=$(git rev-parse --show-toplevel)
29+
"${REPO_ROOT}/hack/ensure-trivy.sh" "${VERSION}"
5030

51-
tar -xf "${TOOL_BIN}/trivy.tar.gz" -C "${TOOL_BIN}" trivy
52-
chmod +x ${TOOL_BIN}/trivy
53-
rm ${TOOL_BIN}/trivy.tar.gz
31+
TRIVY="${REPO_ROOT}/hack/tools/bin/trivy/${VERSION}/trivy"
5432

5533
# Builds all the container images to be scanned and cleans up changes to ./*manager_image_patch.yaml ./*manager_pull_policy.yaml.
5634
make REGISTRY=gcr.io/k8s-staging-cluster-api-helm PULL_POLICY=IfNotPresent TAG=dev docker-build
5735
make clean-release-git
5836

5937
# Scan the images
60-
${TOOL_BIN}/trivy image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api-helm/cluster-api-helm-controller-"${GO_ARCH}":dev && R5=$? || R5=$?
38+
"${TRIVY}" image -q --exit-code 1 --ignore-unfixed --severity MEDIUM,HIGH,CRITICAL gcr.io/k8s-staging-cluster-api-helm/cluster-api-helm-controller-"${GO_ARCH}":dev && R1=$? || R1=$?
6139

6240
echo ""
6341
BRed='\033[1;31m'
6442
BGreen='\033[1;32m'
6543
NC='\033[0m' # No
6644

67-
if [ "$R1" -ne "0" ] || [ "$R2" -ne "0" ] || [ "$R3" -ne "0" ] || [ "$R4" -ne "0" ] || [ "$R5" -ne "0" ] || [ "$R6" -ne "0" ]
45+
if [ "$R1" -ne "0" ]
6846
then
69-
echo -e "${BRed}Check container images failed! There are vulnerability to be fixed${NC}"
47+
echo -e "${BRed}Check container images failed! There are vulnerabilities to be fixed${NC}"
7048
exit 1
7149
fi
7250

0 commit comments

Comments
 (0)