-
Notifications
You must be signed in to change notification settings - Fork 50
76 lines (67 loc) · 2.42 KB
/
scan-images.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
name: Scan images
on:
schedule:
# every day at 1:12AM UTC
- cron: '12 1 * * *'
workflow_dispatch:
jobs:
scan-images:
name: Scan images in bundle
strategy:
matrix:
# specfy location of bundle(s) to be scanned
bundle:
- releases/1.8/stable/kubeflow
- releases/1.9/stable
- releases/latest/edge
runs-on: [self-hosted, linux, X64, jammy, large]
steps:
- name: Checkout
uses: actions/checkout@v3
with:
fetch-depth: 0
- name: Setup tools
id: setup
run: |
sudo snap install yq
echo "date=$(date '+%Y-%m-%d-%H-%M-%S')" >> $GITHUB_OUTPUT
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: "3.10"
- name: Checkout kubeflow-ci
uses: actions/checkout@v3
with:
repository: canonical/kubeflow-ci.git
sparse-checkout: scripts/images/
ref: main
path: kubeflow-ci
- name: Get images
id: images
run: |
BUNDLE="${{ matrix.bundle }}"
BUNDLE_SPLIT=(${BUNDLE//\// })
RELEASE=${BUNDLE_SPLIT[1]}
RISK=${BUNDLE_SPLIT[2]}
pip3 install -r scripts/requirements.txt
python3 scripts/get-all-images.py ${{ matrix.bundle }}/bundle.yaml > image_list.txt
echo "Image list:"
cat ./image_list.txt
echo "release_risk=${RELEASE}-${RISK}" >> $GITHUB_OUTPUT
- name: Scan images
run: |
./kubeflow-ci/scripts/images/scan-images.sh ./image_list.txt
./kubeflow-ci/scripts/images/get-summary.py --report-path ./trivy-reports --print-header > scan-summary-${{ steps.setup.outputs.date}}-${{ steps.images.outputs.release_risk }}.csv
- name: Prepare artifacts
run: |
tar zcvf trivy-reports-${{ steps.setup.outputs.date}}-${{ steps.images.outputs.release_risk }}-${{ strategy.job-index }}.tar.gz ./trivy-reports
- name: Upload Trivy reports
uses: actions/upload-artifact@v3
with:
name: trivy-reports
path: trivy-reports-${{ steps.setup.outputs.date}}-${{ steps.images.outputs.release_risk }}-${{ strategy.job-index }}.tar.gz
- name: Upload summary
uses: actions/upload-artifact@v3
with:
name: summary
path: scan-summary-${{ steps.setup.outputs.date}}-${{ steps.images.outputs.release_risk }}.csv