-
Notifications
You must be signed in to change notification settings - Fork 1
69 lines (55 loc) · 2.63 KB
/
weekly_vuln_scan.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
# SPDX-FileCopyrightText: 2024 PNED G.I.E.
# SPDX-License-Identifier: Apache-2.0
name: Scan Latest Two Semantically Versioned Docker Image Tags with ORT
on:
schedule:
- cron: "0 14 * * 1" # Works on Every Monday at 14:00 UTC
workflow_dispatch:
jobs:
fetch-and-scan:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v2
- name: Setup Docker
run: |
sudo service docker start
docker ps
- name: Login to GitHub Container Registry
run: |
echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
docker info
- name: List Docker Image Tags and Fetch Latest Two
run: |
IMAGE="ghcr.io/genomicdatainfrastructure/gdi-userportal-frontend"
echo "Fetching Docker image tags..."
RESPONSE=$(curl -s -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" "https://api.github.com/orgs/genomicdatainfrastructure/packages/container/gdi-userportal-frontend/versions")
# Log the response for debugging
echo "Response from curl: $RESPONSE"
# Extract tags and creation dates, then sort by creation date
TAGS_WITH_DATES=$(echo "$RESPONSE" | jq -r '.[] | .metadata.container.tags[] as $tag | "\($tag) \(.created_at)"' | sort -k2 -r)
# Filter out the 'main' tag and get the latest two tags
LATEST_TAGS=$(echo "$TAGS_WITH_DATES" | awk '$1 != "main" {print $1}' | head -n 2 | tr '\n' ' ')
# Print the results
echo "Tags fetched: $LATEST_TAGS"
echo "LATEST_PATCHES=$LATEST_TAGS" >> $GITHUB_ENV
- name: Pull and Scan Docker Images with Trivy
run: |
IFS=' ' read -ra TAGS <<< "${{ env.LATEST_PATCHES }}"
for TAG in "${TAGS[@]}"
do
IMAGE_TAG="ghcr.io/genomicdatainfrastructure/gdi-userportal-frontend:$TAG"
echo "Pulling $IMAGE_TAG"
docker pull $IMAGE_TAG || exit 1
echo "Scanning $IMAGE_TAG with Trivy"
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy:latest image --severity CRITICAL,HIGH --exit-code 1 "$IMAGE_TAG" || exit 1
done
- name: OSS Review Toolkit (ORT) Analysis
uses: actions/checkout@v4
with:
repository: ${{ github.repository }}
- uses: oss-review-toolkit/ort-ci-github-action@7f23c1f8d169dad430e41df223d3b8409c7a156e
with:
allow-dynamic-versions: "true"
fail-on: "issues"
run: "cache-dependencies,cache-scan-results,labels,analyzer,evaluator,advisor,reporter,upload-results"