Skip to content

Commit ecdb70e

Browse files
petermetzzondervancalvez
petermetz
authored and
zondervancalvez
committed
trivy scan conditioning
1 parent ab9eedf commit ecdb70e

File tree

2 files changed

+100
-105
lines changed

2 files changed

+100
-105
lines changed

‎.github/workflows/ci.yaml‎

Lines changed: 98 additions & 105 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
---
22
env:
33
NODEJS_VERSION: v18.18.2
4+
RUN_TRIVY_SCAN: true
45
jobs:
56
ActionLint:
67
uses: ./.github/workflows/actionlint.yaml
@@ -1516,6 +1517,46 @@ jobs:
15161517
restore-keys: |
15171518
${{ runner.os }}-yarn-${{ hashFiles('./yarn.lock') }}
15181519
- run: ./tools/ci.sh
1520+
cactus-plugin-ledger-connector-iroha:
1521+
continue-on-error: false
1522+
env:
1523+
FULL_BUILD_DISABLED: true
1524+
JEST_TEST_PATTERN: packages/cactus-plugin-ledger-connector-iroha/src/test/typescript/(unit|integration|benchmark)/.*/*.test.ts
1525+
JEST_TEST_RUNNER_DISABLED: false
1526+
TAPE_TEST_PATTERN: >-
1527+
--files={./packages/cactus-plugin-ledger-connector-iroha/src/test/typescript/integration/iroha-iroha-transfer-example.test.ts,./packages/cactus-plugin-ledger-connector-iroha/src/test/typescript/integration/openapi/openapi-validation.test.ts,./packages/cactus-plugin-ledger-connector-iroha/src/test/typescript/integration/run-transaction-endpoint-v1.test.ts,./packages/cactus-plugin-ledger-connector-iroha/src/test/typescript/unit/iroha-test-ledger-parameters.test.ts,./packages/cactus-plugin-ledger-connector-iroha/src/test/typescript/unit/postgres-test-container-parameters.test.ts}
1528+
TAPE_TEST_RUNNER_DISABLED: false
1529+
needs: build-dev
1530+
runs-on: ubuntu-22.04
1531+
steps:
1532+
- name: Use Node.js ${{ env.NODEJS_VERSION }}
1533+
uses: actions/setup-node@v4.0.2
1534+
with:
1535+
node-version: ${{ env.NODEJS_VERSION }}
1536+
- uses: actions/checkout@v4.1.1
1537+
1538+
- id: yarn-cache
1539+
name: Restore Yarn Cache
1540+
uses: actions/cache@v4.0.1
1541+
with:
1542+
key: ${{ runner.os }}-yarn-${{ hashFiles('./yarn.lock') }}
1543+
path: ./.yarn/
1544+
restore-keys: |
1545+
${{ runner.os }}-yarn-${{ hashFiles('./yarn.lock') }}
1546+
- run: ./tools/ci.sh
1547+
1548+
- name: Build an image from Dockerfile
1549+
run: DOCKER_BUILDKIT=1 docker build . -f ./packages/cactus-plugin-ledger-connector-iroha/Dockerfile -t plugin-ledger-connector-iroha
1550+
- if: ${{ env.RUN_TRIVY_SCAN == 'true' }}
1551+
name: Run Trivy vulnerability scan for plugin-ledger-connector-iroha
1552+
uses: aquasecurity/trivy-action@0.19.0
1553+
with:
1554+
image-ref: 'plugin-ledger-connector-iroha'
1555+
format: 'table'
1556+
exit-code: '1'
1557+
ignore-unfixed: false
1558+
vuln-type: 'os,library'
1559+
severity: 'CRITICAL,HIGH'
15191560
cactus-plugin-ledger-connector-iroha2:
15201561
continue-on-error: false
15211562
needs:
@@ -1591,7 +1632,7 @@ jobs:
15911632
with:
15921633
node-version: ${{ env.NODEJS_VERSION }}
15931634
- uses: actions/checkout@v4.1.1
1594-
1635+
15951636
- id: yarn-cache
15961637
name: Restore Yarn Cache
15971638
uses: actions/cache@v4.0.1
@@ -1601,6 +1642,19 @@ jobs:
16011642
restore-keys: |
16021643
${{ runner.os }}-yarn-${{ hashFiles('./yarn.lock') }}
16031644
- run: ./tools/ci.sh
1645+
1646+
- name: Build an image from Dockerfile
1647+
run: DOCKER_BUILDKIT=1 docker build . -f ./packages/cactus-plugin-ledger-connector-quorum/Dockerfile -t plugin-ledger-connector-quorum
1648+
- if: ${{ env.RUN_TRIVY_SCAN == 'true' }}
1649+
name: Run Trivy vulnerability scan for plugin-ledger-connector-quorum
1650+
uses: aquasecurity/trivy-action@0.19.0
1651+
with:
1652+
image-ref: 'plugin-ledger-connector-quorum'
1653+
format: 'table'
1654+
exit-code: '1'
1655+
ignore-unfixed: false
1656+
vuln-type: 'os,library'
1657+
severity: 'CRITICAL,HIGH'
16041658
cactus-plugin-ledger-connector-sawtooth:
16051659
continue-on-error: false
16061660
env:
@@ -1943,7 +1997,7 @@ jobs:
19431997
with:
19441998
node-version: ${{ env.NODEJS_VERSION }}
19451999
- uses: actions/checkout@v4.1.1
1946-
2000+
19472001
- id: yarn-cache
19482002
name: Restore Yarn Cache
19492003
uses: actions/cache@v4.0.1
@@ -2068,16 +2122,7 @@ jobs:
20682122
steps:
20692123
- uses: actions/checkout@v4.1.1
20702124
- name: ghcr.io/hyperledger/cactus-besu-all-in-one
2071-
run: DOCKER_BUILDKIT=1 docker build ./tools/docker/besu-all-in-one/ -f ./tools/docker/besu-all-in-one/Dockerfile -t cactus-besu-all-in-one
2072-
- name: Run Trivy vulnerability scan for cactus-besu-all-in-one
2073-
uses: aquasecurity/trivy-action@0.11.2
2074-
with:
2075-
image-ref: 'cactus-besu-all-in-one'
2076-
format: 'table'
2077-
exit-code: '1'
2078-
ignore-unfixed: true
2079-
vuln-type: 'os,library'
2080-
severity: 'CRITICAL,HIGH'
2125+
run: DOCKER_BUILDKIT=1 docker build ./tools/docker/besu-all-in-one/ -f ./tools/docker/besu-all-in-one/Dockerfile
20812126
ghcr-cmd-api-server:
20822127
runs-on: ubuntu-22.04
20832128
needs:
@@ -2087,13 +2132,14 @@ jobs:
20872132
- uses: actions/checkout@v4.1.1
20882133
- name: ghcr.io/hyperledger/cactus-cmd-api-server
20892134
run: DOCKER_BUILDKIT=1 docker build . -f ./packages/cactus-cmd-api-server/Dockerfile -t cactus-cmd-api-server
2090-
- name: Run Trivy vulnerability scan for cactus-cmd-api-server
2091-
uses: aquasecurity/trivy-action@0.11.2
2135+
- if: ${{ env.RUN_TRIVY_SCAN == 'true' }}
2136+
name: Run Trivy vulnerability scan for cactus-cmd-api-server
2137+
uses: aquasecurity/trivy-action@0.19.0
20922138
with:
20932139
image-ref: 'cactus-cmd-api-server'
20942140
format: 'table'
20952141
exit-code: '1'
2096-
ignore-unfixed: true
2142+
ignore-unfixed: false
20972143
vuln-type: 'os,library'
20982144
severity: 'CRITICAL,HIGH'
20992145
ghcr-connector-besu:
@@ -2105,13 +2151,14 @@ jobs:
21052151
- uses: actions/checkout@v4.1.1
21062152
- name: ghcr.io/hyperledger/cactus-connector-besu
21072153
run: DOCKER_BUILDKIT=1 docker build ./packages/cactus-plugin-ledger-connector-besu/ -f ./packages/cactus-plugin-ledger-connector-besu/Dockerfile -t cactus-connector-besu
2108-
- name: Run Trivy vulnerability scan for cactus-connector-besu
2109-
uses: aquasecurity/trivy-action@0.11.2
2154+
- if: ${{ env.RUN_TRIVY_SCAN == 'true' }}
2155+
name: Run Trivy vulnerability scan for cactus-connector-besu
2156+
uses: aquasecurity/trivy-action@0.19.0
21102157
with:
21112158
image-ref: 'cactus-connector-besu'
21122159
format: 'table'
21132160
exit-code: '1'
2114-
ignore-unfixed: true
2161+
ignore-unfixed: false
21152162
vuln-type: 'os,library'
21162163
severity: 'CRITICAL,HIGH'
21172164
ghcr-connector-corda-server:
@@ -2124,13 +2171,14 @@ jobs:
21242171
- uses: actions/checkout@v4.1.1
21252172
- name: ghcr.io/hyperledger/cactus-connector-corda-server
21262173
run: DOCKER_BUILDKIT=1 docker build ./packages/cactus-plugin-ledger-connector-corda/src/main-server/ -f ./packages/cactus-plugin-ledger-connector-corda/src/main-server/Dockerfile -t cactus-connector-corda-server
2127-
- name: Run Trivy vulnerability scan for cactus-connector-corda-server
2128-
uses: aquasecurity/trivy-action@0.11.2
2174+
- if: ${{ env.RUN_TRIVY_SCAN == 'true' }}
2175+
name: Run Trivy vulnerability scan for cactus-connector-corda-server
2176+
uses: aquasecurity/trivy-action@0.19.0
21292177
with:
21302178
image-ref: 'cactus-connector-corda-server'
21312179
format: 'table'
21322180
exit-code: '1'
2133-
ignore-unfixed: true
2181+
ignore-unfixed: false
21342182
vuln-type: 'os,library'
21352183
severity: 'CRITICAL,HIGH'
21362184
ghcr-connector-fabric:
@@ -2143,13 +2191,14 @@ jobs:
21432191
- uses: actions/checkout@v4.1.1
21442192
- name: ghcr.io/hyperledger/cactus-connector-fabric
21452193
run: DOCKER_BUILDKIT=1 docker build ./packages/cactus-plugin-ledger-connector-fabric/ -f ./packages/cactus-plugin-ledger-connector-fabric/Dockerfile -t cactus-connector-fabric
2146-
- name: Run Trivy vulnerability scan for cactus-connector-fabric
2147-
uses: aquasecurity/trivy-action@0.11.2
2194+
- if: ${{ env.RUN_TRIVY_SCAN == 'true' }}
2195+
name: Run Trivy vulnerability scan for cactus-connector-fabric
2196+
uses: aquasecurity/trivy-action@0.19.0
21482197
with:
21492198
image-ref: 'cactus-connector-fabric'
21502199
format: 'table'
21512200
exit-code: '1'
2152-
ignore-unfixed: true
2201+
ignore-unfixed: false
21532202
vuln-type: 'os,library'
21542203
severity: 'CRITICAL,HIGH'
21552204
ghcr-corda-all-in-one:
@@ -2160,16 +2209,8 @@ jobs:
21602209
steps:
21612210
- uses: actions/checkout@v4.1.1
21622211
- name: ghcr.io/hyperledger/cactus-corda-all-in-one
2163-
run: DOCKER_BUILDKIT=1 docker build ./tools/docker/corda-all-in-one/ -f ./tools/docker/corda-all-in-one/Dockerfile -t cactus-corda-all-in-one
2164-
- name: Run Trivy vulnerability scan for cactus-corda-all-in-one
2165-
uses: aquasecurity/trivy-action@0.11.2
2166-
with:
2167-
image-ref: 'cactus-corda-all-in-one'
2168-
format: 'table'
2169-
exit-code: '1'
2170-
ignore-unfixed: true
2171-
vuln-type: 'os,library'
2172-
severity: 'CRITICAL,HIGH'
2212+
run: DOCKER_BUILDKIT=1 docker build ./tools/docker/corda-all-in-one/ -f ./tools/docker/corda-all-in-one/Dockerfile
2213+
21732214
ghcr-corda-all-in-one-flowdb:
21742215
runs-on: ubuntu-22.04
21752216
steps:
@@ -2185,15 +2226,7 @@ jobs:
21852226
- uses: actions/checkout@v4.1.1
21862227
- name: ghcr.io/hyperledger/cactus-corda-all-in-one-obligation
21872228
run: DOCKER_BUILDKIT=1 docker build ./tools/docker/corda-all-in-one/ -f ./tools/docker/corda-all-in-one/corda-v4_8/Dockerfile -t cactus-corda-all-in-one-obligation
2188-
- name: Run Trivy vulnerability scan for cactus-corda-all-in-one-obligation
2189-
uses: aquasecurity/trivy-action@0.11.2
2190-
with:
2191-
image-ref: 'cactus-corda-all-in-one-obligation'
2192-
format: 'table'
2193-
exit-code: '1'
2194-
ignore-unfixed: true
2195-
vuln-type: 'os,library'
2196-
severity: 'CRITICAL,HIGH'
2229+
21972230
ghcr-dev-container-vscode:
21982231
runs-on: ubuntu-22.04
21992232
needs:
@@ -2216,106 +2249,66 @@ jobs:
22162249
steps:
22172250
- uses: actions/checkout@v4.1.1
22182251
- name: ghcr.io/hyperledger/cactus-example-carbon-accounting
2219-
run: DOCKER_BUILDKIT=1 docker build . -f ./examples/carbon-accounting/Dockerfile -t cactus-example-carbon-accounting
2220-
- name: Run Trivy vulnerability scan for cactus-example-carbon-accounting
2221-
uses: aquasecurity/trivy-action@0.11.2
2222-
with:
2223-
image-ref: 'cactus-example-carbon-accounting'
2224-
format: 'table'
2225-
exit-code: '1'
2226-
ignore-unfixed: true
2227-
vuln-type: 'os,library'
2228-
severity: 'CRITICAL,HIGH'
2252+
run: DOCKER_BUILDKIT=1 docker build . -f ./examples/carbon-accounting/Dockerfile
2253+
22292254
ghcr-example-supply-chain-app:
22302255
runs-on: ubuntu-22.04
22312256
steps:
22322257
- uses: actions/checkout@v4.1.1
22332258
- name: ghcr.io/hyperledger/cactus-example-supply-chain-app
22342259
run: DOCKER_BUILDKIT=1 docker build . -f ./examples/cactus-example-supply-chain-backend/Dockerfile -t cactus-example-supply-chain-app
2235-
- name: Run Trivy vulnerability scan for cactus-example-supply-chain-app
2236-
uses: aquasecurity/trivy-action@0.11.2
2237-
with:
2238-
image-ref: 'cactus-example-supply-chain-app'
2239-
format: 'table'
2240-
exit-code: '1'
2241-
ignore-unfixed: true
2242-
vuln-type: 'os,library'
2243-
severity: 'CRITICAL,HIGH'
2260+
22442261
ghcr-fabric-all-in-one:
22452262
runs-on: ubuntu-22.04
22462263
steps:
22472264
- uses: actions/checkout@v4.1.1
22482265
- name: ghcr.io/hyperledger/cactus-fabric-all-in-one
2249-
run: DOCKER_BUILDKIT=1 docker build ./tools/docker/fabric-all-in-one/ -f ./tools/docker/fabric-all-in-one/Dockerfile_v1.4.x -t cactus-fabric-all-in-one
2250-
- name: Run Trivy vulnerability scan for cactus-fabric-all-in-one
2251-
uses: aquasecurity/trivy-action@0.11.2
2252-
with:
2253-
image-ref: 'cactus-fabric-all-in-one'
2254-
format: 'table'
2255-
exit-code: '1'
2256-
ignore-unfixed: true
2257-
vuln-type: 'os,library'
2258-
severity: 'CRITICAL,HIGH'
2266+
run: DOCKER_BUILDKIT=1 docker build ./tools/docker/fabric-all-in-one/ -f ./tools/docker/fabric-all-in-one/Dockerfile_v1.4.x
2267+
22592268
ghcr-fabric2-all-in-one:
22602269
runs-on: ubuntu-22.04
22612270
steps:
22622271
- uses: actions/checkout@v4.1.1
22632272
- name: ghcr.io/hyperledger/cactus-fabric2-all-in-one
2264-
run: DOCKER_BUILDKIT=1 docker build ./tools/docker/fabric-all-in-one/ -f ./tools/docker/fabric-all-in-one/Dockerfile_v2.x -t cactus-fabric2-all-in-one
2265-
- name: Run Trivy vulnerability scan for cactus-fabric2-all-in-one
2266-
uses: aquasecurity/trivy-action@0.11.2
2267-
with:
2268-
image-ref: 'cactus-fabric2-all-in-one'
2269-
format: 'table'
2270-
exit-code: '1'
2271-
ignore-unfixed: true
2272-
vuln-type: 'os,library'
2273-
severity: 'CRITICAL,HIGH'
2273+
run: DOCKER_BUILDKIT=1 docker build ./tools/docker/fabric-all-in-one/ -f ./tools/docker/fabric-all-in-one/Dockerfile_v2.x
2274+
2275+
ghcr-iroha-all-in-one:
2276+
runs-on: ubuntu-22.04
2277+
steps:
2278+
- uses: actions/checkout@v4.1.1
2279+
- name: ghcr.io/hyperledger/cactus-iroha-all-in-one
2280+
run: DOCKER_BUILDKIT=1 docker build ./tools/docker/iroha-all-in-one/ -f ./tools/docker/iroha-all-in-one/Dockerfile
2281+
22742282
ghcr-keychain-vault-server:
22752283
runs-on: ubuntu-22.04
22762284
steps:
22772285
- uses: actions/checkout@v4.1.1
22782286
- name: ghcr.io/hyperledger/cactus-keychain-vault-server
22792287
run: DOCKER_BUILDKIT=1 docker build ./packages/cactus-plugin-keychain-vault/src/cactus-keychain-vault-server/ -f ./packages/cactus-plugin-keychain-vault/src/cactus-keychain-vault-server/Dockerfile -t cactus-keychain-vault-server
2280-
- name: Run Trivy vulnerability scan for cactus-keychain-vault-server
2281-
uses: aquasecurity/trivy-action@0.11.2
2288+
- if: ${{ env.RUN_TRIVY_SCAN == 'true' }}
2289+
name: Run Trivy vulnerability scan for cactus-keychain-vault-server
2290+
uses: aquasecurity/trivy-action@0.19.0
22822291
with:
22832292
image-ref: 'cactus-keychain-vault-server'
22842293
format: 'table'
22852294
exit-code: '1'
2286-
ignore-unfixed: true
2295+
ignore-unfixed: false
22872296
vuln-type: 'os,library'
22882297
severity: 'CRITICAL,HIGH'
22892298
ghcr-quorum-all-in-one:
22902299
runs-on: ubuntu-22.04
22912300
steps:
22922301
- uses: actions/checkout@v4.1.1
22932302
- name: ghcr.io/hyperledger/cactus-quorum-all-in-one
2294-
run: DOCKER_BUILDKIT=1 docker build ./tools/docker/quorum-all-in-one/ -f ./tools/docker/quorum-all-in-one/Dockerfile -t cactus-quorum-all-in-one
2295-
- name: Run Trivy vulnerability scan for cactus-quorum-all-in-one
2296-
uses: aquasecurity/trivy-action@0.11.2
2297-
with:
2298-
image-ref: 'cactus-quorum-all-in-one'
2299-
format: 'table'
2300-
exit-code: '1'
2301-
ignore-unfixed: true
2302-
vuln-type: 'os,library'
2303-
severity: 'CRITICAL,HIGH'
2303+
run: DOCKER_BUILDKIT=1 docker build ./tools/docker/quorum-all-in-one/ -f ./tools/docker/quorum-all-in-one/Dockerfile
2304+
23042305
ghcr-quorum-multi-party-all-in-one:
23052306
runs-on: ubuntu-22.04
23062307
steps:
23072308
- uses: actions/checkout@v4.1.1
23082309
- name: ghcr.io/hyperledger/cactus-quorum-multi-party-all-in-one
23092310
run: DOCKER_BUILDKIT=1 docker build ./tools/docker/quorum-multi-party-all-in-one/ -f ./tools/docker/quorum-multi-party-all-in-one/Dockerfile -t cactus-quorum-multi-party-all-in-one
2310-
- name: Run Trivy vulnerability scan for cactus-quorum-multi-party-all-in-one
2311-
uses: aquasecurity/trivy-action@0.11.2
2312-
with:
2313-
image-ref: 'cactus-quorum-multi-party-all-in-one'
2314-
format: 'table'
2315-
exit-code: '1'
2316-
ignore-unfixed: true
2317-
vuln-type: 'os,library'
2318-
severity: 'CRITICAL,HIGH'
2311+
23192312
name: Cactus_CI
23202313
'on':
23212314
pull_request:
@@ -2326,4 +2319,4 @@ name: Cactus_CI
23262319
push:
23272320
branches:
23282321
- main
2329-
- dev
2322+
- dev

‎packages/cactus-cmd-api-server/Dockerfile‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,3 +66,5 @@ COPY ./packages/cactus-cmd-api-server/docker-entrypoint.sh /usr/local/bin/
6666
HEALTHCHECK --interval=5s --timeout=5s --start-period=1s --retries=30 CMD /healthcheck.sh
6767
ENTRYPOINT ["docker-entrypoint.sh"]
6868
CMD ["node_modules/@hyperledger/cactus-cmd-api-server/dist/lib/main/typescript/cmd/cactus-api.js"]
69+
70+
##

0 commit comments

Comments
 (0)