Skip to content

feat: improved tracing for courier #6174

feat: improved tracing for courier

feat: improved tracing for courier #6174

Workflow file for this run

name: Docker Image Scanners
on:
workflow_dispatch:
push:
branches:
- "master"
tags:
- "v*.*.*"
pull_request:
branches:
- "master"
permissions:
contents: read
security-events: write
jobs:
scanners:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Setup Env
id: vars
shell: bash
run: |
echo "SHA_SHORT=$(git rev-parse --short HEAD)" >> "${GITHUB_ENV}"
- name: Set up QEMU
uses: docker/setup-qemu-action@v3
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Build images
shell: bash
run: |
IMAGE_TAG="${{ env.SHA_SHORT }}" make docker
# Add GitHub authentication for Trivy
- name: Login to GitHub Container Registry
uses: docker/login-action@v3
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
# Configure Trivy
- name: Configure Trivy
run: |
mkdir -p $HOME/.cache/trivy
echo "TRIVY_USERNAME=${{ github.actor }}" >> $GITHUB_ENV
echo "TRIVY_PASSWORD=${{ secrets.GITHUB_TOKEN }}" >> $GITHUB_ENV
- name: Anchore Scanner
uses: anchore/scan-action@v5
id: grype-scan
with:
image: oryd/kratos:${{ env.SHA_SHORT }}
fail-build: true
severity-cutoff: high
add-cpes-if-none: true
- name: Inspect action SARIF report
shell: bash
if: ${{ always() }}
run: |
echo "::group::Anchore Scan Details"
jq '.runs[0].results' ${{ steps.grype-scan.outputs.sarif }}
echo "::endgroup::"
- name: Anchore upload scan SARIF report
if: always()
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: ${{ steps.grype-scan.outputs.sarif }}
- name: Trivy Scanner
uses: aquasecurity/trivy-action@master
if: ${{ always() }}
with:
image-ref: oryd/kratos:${{ env.SHA_SHORT }}
format: "table"
exit-code: "42"
ignore-unfixed: true
vuln-type: "os,library"
severity: "CRITICAL,HIGH"
scanners: "vuln,secret,misconfig"
env:
TRIVY_SKIP_JAVA_DB_UPDATE: "true"
TRIVY_DISABLE_VEX_NOTICE: "true"
- name: Dockle Linter
uses: erzz/dockle-action@v1
if: ${{ always() }}
with:
image: oryd/kratos:${{ env.SHA_SHORT }}
exit-code: 42
failure-threshold: high
- name: Hadolint
uses: hadolint/[email protected]
id: hadolint
if: ${{ always() }}
with:
dockerfile: .docker/Dockerfile-build
verbose: true
format: "json"
failure-threshold: "error"
- name: View Hadolint results
if: ${{ always() }}
shell: bash
run: |
echo "::group::Hadolint Scan Details"
echo "${HADOLINT_RESULTS}" | jq '.'
echo "::endgroup::"