Skip to content

Commit 8a6cef5

Browse files
yxtayyxtay
authored
ci: container-scan (#257)
* ci: container-scan * Update scans.yml * Update compose.yaml * Update Dockerfile
1 parent 7467fc5 commit 8a6cef5

File tree

4 files changed

+81
-42
lines changed

4 files changed

+81
-42
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 4 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -71,40 +71,15 @@ jobs:
7171
GHCR_IMAGE_NAME: ghcr.io/${{ github.repository }}
7272

7373
steps:
74-
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
75-
with:
76-
sparse-checkout: |
77-
Dockerfile
78-
uv.lock
79-
80-
- uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4
81-
with:
82-
path: |
83-
var-cache-apt
84-
var-lib-apt
85-
root-cache-uv
86-
key: buildkit-mounts-${{ runner.os }}-${{ hashFiles('**/Dockerfile', '**/*.lock') }}
87-
restore-keys: |
88-
buildkit-mounts-${{ runner.os }}
89-
90-
- uses: reproducible-containers/buildkit-cache-dance@653a570f730e3b9460adc576db523788ba59a0d7 # v3
91-
with:
92-
cache-map: |
93-
{
94-
"var-cache-apt": "/var/cache/apt",
95-
"var-lib-apt": "/var/lib/apt",
96-
"root-cache-uv": "/root/.cache/uv"
97-
}
74+
- uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3
9875

9976
- uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3
10077

10178
- id: build-ci
10279
uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6
10380
with:
10481
target: ${{ env.ENVIRONMENT }}
105-
cache-from: |
106-
${{ env.GHCR_IMAGE_NAME }}:dev
107-
${{ env.GHCR_IMAGE_NAME }}:cache
82+
cache-from: ${{ env.GHCR_IMAGE_NAME }}:cache
10883
load: true
10984
env:
11085
ENVIRONMENT: ci
@@ -133,9 +108,7 @@ jobs:
133108
uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6
134109
with:
135110
target: ${{ env.ENVIRONMENT }}
136-
cache-from: |
137-
${{ env.GHCR_IMAGE_NAME }}:dev
138-
${{ env.GHCR_IMAGE_NAME }}:cache
111+
cache-from: ${{ env.GHCR_IMAGE_NAME }}:cache
139112
cache-to: type=inline
140113
tags: ${{ env.GHCR_IMAGE_NAME }}:dev
141114
push: ${{ github.event_name == 'push' || github.ref_name == github.event.repository.default_branch }}
@@ -145,9 +118,7 @@ jobs:
145118
- if: ${{ github.event_name == 'push' || github.ref_name == github.event.repository.default_branch }}
146119
uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6
147120
with:
148-
cache-from: |
149-
${{ env.GHCR_IMAGE_NAME }}:dev
150-
${{ env.GHCR_IMAGE_NAME }}:cache
121+
cache-from: ${{ env.GHCR_IMAGE_NAME }}:cache
151122
cache-to: type=registry,ref=${{ env.GHCR_IMAGE_NAME }}:cache,mode=max
152123
tags: ${{ steps.docker_metadata.outputs.tags }}
153124
labels: ${{ steps.docker_metadata.outputs.labels }}

‎.github/workflows/scans.yml‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,37 @@ jobs:
9999
with:
100100
sarif_file: ${{ steps.grype.outputs.sarif }}
101101

102+
grype-container:
103+
permissions:
104+
contents: read
105+
security-events: write
106+
107+
runs-on: ubuntu-latest
108+
env:
109+
GHCR_IMAGE_NAME: ghcr.io/${{ github.repository }}
110+
steps:
111+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
112+
113+
- id: build
114+
uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6
115+
with:
116+
cache-from: ${{ env.GHCR_IMAGE_NAME }}:cache
117+
load: true
118+
119+
- id: grype
120+
uses: anchore/scan-action@2c901ab7378897c01b8efaa2d0c9bf519cc64b9e # v6
121+
with:
122+
image: ${{ env.IMAGE_ID }}
123+
severity-cutoff: high
124+
only-fixed: true
125+
env:
126+
IMAGE_ID: ${{ steps.build.outputs.imageid }}
127+
128+
- if: ${{ success() || failure() }}
129+
uses: github/codeql-action/upload-sarif@60168efe1c415ce0f5521ea06d5c2062adbeed1b # v3
130+
with:
131+
sarif_file: ${{ steps.grype.outputs.sarif }}
132+
102133
kics:
103134
permissions:
104135
checks: write
@@ -277,6 +308,39 @@ jobs:
277308
with:
278309
sarif_file: trivy-results.sarif
279310

311+
trivy-container:
312+
permissions:
313+
contents: write
314+
security-events: write
315+
316+
runs-on: ubuntu-latest
317+
env:
318+
GHCR_IMAGE_NAME: ghcr.io/${{ github.repository }}
319+
steps:
320+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
321+
322+
- id: build
323+
uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6
324+
with:
325+
cache-from: ${{ env.GHCR_IMAGE_NAME }}:cache
326+
load: true
327+
328+
- uses: aquasecurity/trivy-action@6c175e9c4083a92bbca2f9724c8a5e33bc2d97a5 # 0.30
329+
with:
330+
image-ref: ${{ env.IMAGE_ID}}
331+
exit-code: 1
332+
ignore-unfixed: true
333+
severity: HIGH,CRITICAL
334+
format: sarif
335+
output: trivy-results.sarif
336+
env:
337+
IMAGE_ID: ${{ steps.build.outputs.imageid }}
338+
339+
- if: ${{ success() || failure() }}
340+
uses: github/codeql-action/upload-sarif@60168efe1c415ce0f5521ea06d5c2062adbeed1b # v3
341+
with:
342+
sarif_file: trivy-results.sarif
343+
280344
trufflehog:
281345
permissions:
282346
contents: read

‎Dockerfile‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ RUN useradd --create-home --shell /bin/false --uid ${UID} ${USER}
1313

1414
# set up environment
1515
ARG APP_HOME=/work/app
16+
ARG DEBIAN_FRONTEND=noninteractive
1617
ARG VIRTUAL_ENV=${APP_HOME}/.venv
1718
ENV PATH=${VIRTUAL_ENV}/bin:${PATH} \
1819
PYTHONFAULTHANDLER=1 \
@@ -22,12 +23,6 @@ ENV PATH=${VIRTUAL_ENV}/bin:${PATH} \
2223

2324
WORKDIR ${APP_HOME}
2425

25-
##
26-
# dev
27-
##
28-
FROM base AS dev
29-
30-
ARG DEBIAN_FRONTEND=noninteractive
3126
COPY <<-EOF /etc/apt/apt.conf.d/99-disable-recommends
3227
APT::Install-Recommends "false";
3328
APT::Install-Suggests "false";
@@ -36,9 +31,17 @@ APT::AutoRemove::SuggestsImportant "false";
3631
EOF
3732

3833
RUN apt-get update && \
39-
apt-get install --yes --no-install-recommends \
40-
build-essential \
41-
curl \
34+
apt-get upgrade --yes && \
35+
apt-get install --yes --no-install-recommends curl \
36+
&& rm -rf /var/lib/apt/lists/*
37+
38+
##
39+
# dev
40+
##
41+
FROM base AS dev
42+
43+
RUN apt-get update && \
44+
apt-get install --yes --no-install-recommends build-essential \
4245
&& rm -rf /var/lib/apt/lists/*
4346

4447
ARG PYTHONDONTWRITEBYTECODE=1

‎compose.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# kics-scan disable=451d79dc-0588-476a-ad03-3c7f0320abb3,698ed579-b239-4f8f-a388-baa4bcb13ef8
12
services:
23
app_dev:
34
image: ghcr.io/yxtay/python-example-app:dev

0 commit comments

Comments
 (0)