Skip to content

Scan images

Scan images #131

Workflow file for this run

name: Scan images
on:
schedule:
# every day at 1:12AM UTC
- cron: '12 1 * * *'
workflow_dispatch:
jobs:
scan-images:
name: Scan images in bundle
strategy:
matrix:
# specfy location of bundle(s) to be scanned
bundle: [ releases/1.7/stable/kubeflow, releases/latest/edge ]
runs-on: ubuntu-20.04
steps:
# Ideally we'd use self-hosted runners, but this effort is still not stable
# This action will remove unused software (dotnet, haskell, android libs, codeql,
# and docker images) from the GH runner, which will liberate around 60 GB of storage
# distributed in 40GB for root and around 20 for a mnt point.
- name: Maximise GH runner space
uses: easimon/maximize-build-space@v7
with:
root-reserve-mb: 40960
remove-dotnet: 'true'
remove-haskell: 'true'
remove-android: 'true'
remove-codeql: 'true'
remove-docker-images: 'true'
- name: Checkout
uses: actions/checkout@v3
with:
fetch-depth: 0
- name: Setup tools
id: setup
run: |
sudo snap install yq
echo "date=$(date '+%Y-%m-%d-%H-%M-%S')" >> $GITHUB_OUTPUT
- name: Checkout kubeflow-ci
uses: actions/checkout@v3
with:
repository: canonical/kubeflow-ci.git
sparse-checkout: scripts/images/
ref: main
path: kubeflow-ci
- name: Get images
id: images
run: |
BUNDLE="${{ matrix.bundle }}"
BUNDLE_SPLIT=(${BUNDLE//\// })
RELEASE=${BUNDLE_SPLIT[1]}
RISK=${BUNDLE_SPLIT[2]}
IMAGES=$(./kubeflow-ci/scripts/images/get-all-images.sh ${{ matrix.bundle }}/bundle.yaml ${RELEASE}-${RISK})
echo "$IMAGES" > ./image_list.txt
echo "Image list:"
cat ./image_list.txt
echo "release_risk=${RELEASE}-${RISK}" >> $GITHUB_OUTPUT
- name: Scan images
run: |
./kubeflow-ci/scripts/images/scan-images.sh ./image_list.txt
./kubeflow-ci/scripts/images/get-summary.py --report-path ./trivy-reports --print-header > scan-summary-${{ steps.setup.outputs.date}}-${{ steps.images.outputs.release_risk }}.csv
- name: Prepare artifacts
run: |
tar zcvf trivy-reports-${{ steps.setup.outputs.date}}-${{ steps.images.outputs.release_risk }}-${{ strategy.job-index }}.tar.gz ./trivy-reports
- name: Upload Trivy reports
uses: actions/upload-artifact@v3
with:
name: trivy-reports
path: trivy-reports-${{ steps.setup.outputs.date}}-${{ steps.images.outputs.release_risk }}-${{ strategy.job-index }}.tar.gz
- name: Upload summary
uses: actions/upload-artifact@v3
with:
name: summary
path: scan-summary-${{ steps.setup.outputs.date}}-${{ steps.images.outputs.release_risk }}.csv