Skip to content

Add weekly govulncheck workflow #2897

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Add weekly govulncheck workflow #2897

wants to merge 1 commit into from

Conversation

lentzi90
Copy link

What this PR does / why we need it:

This adds a github workflow for weekly security scanning using govulncheck. It was inspired by what CAPI has but adapted quite heavily and limited to govulncheck for now. (CAPI also runs Trivy to scan the images.)
I have been doing the same in CAPO and ORC with the goal of having better insights into when new patch releases would be needed to fix vulnerabilities (and of course when dependencies need to be updated).

Which issue this PR fixes(if applicable):
fixes #

Special notes for reviewers:

Release note:

NONE

@k8s-ci-robot k8s-ci-robot added the release-note-none Denotes a PR that doesn't merit a release note. label May 23, 2025
@k8s-ci-robot k8s-ci-robot requested a review from kayrus May 23, 2025 10:47
@k8s-ci-robot k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label May 23, 2025
@k8s-ci-robot k8s-ci-robot requested a review from stephenfin May 23, 2025 10:47
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign zetaab for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label May 23, 2025
kayrus
kayrus approved these changes Jul 2, 2025
View reviewed changes
Copy link
Contributor

@kayrus kayrus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@lentzi90 thanks for the PR. See my updates in comments

.github/workflows/security-scan.yaml Outdated
runs-on: ubuntu-latest
steps:
- name: Check out code
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # tag=v4.2.2
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why don't use the tag?

Suggested change
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # tag=v4.2.2
uses: actions/[email protected]

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Higher level of paranoia I guess 😅
I copied from CAPI and Metal3, where we use hashes since they are guaranteed to never change. The tag on the other hand can be overwritten.

@lentzi90 lentzi90 force-pushed the lentzi90/govulncheck branch from 0091d9c to 762b679 Compare July 29, 2025 06:43
@lentzi90
Copy link
Author

Thanks for the comments, I have updated and addressed them 🙂

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@kayrus kayrus kayrus approved these changes

@stephenfin stephenfin Awaiting requested review from stephenfin

Assignees
No one assigned
Labels
cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. release-note-none Denotes a PR that doesn't merit a release note. size/M Denotes a PR that changes 30-99 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@lentzi90 @k8s-ci-robot @kayrus