From 9411465688263df1199ecd1b250a0522d28340ab Mon Sep 17 00:00:00 2001 From: "t.behrendt" Date: Thu, 5 Feb 2026 17:29:01 +0100 Subject: [PATCH] feat(get-images-from-files): add support for helm values (#29) Adding support for images inside of helm value files as per helm convention. Limitation: Default images the chart may propose are not exposed and therefore not supported, only what's specifically mentioned in the values file. Reviewed-on: https://gitea.t000-n.de/t.behrendt/trivy-actions/pulls/29 Reviewed-by: branch-buddy Co-authored-by: t.behrendt Co-committed-by: t.behrendt --- .gitea/workflows/ci.yaml | 8 +++++++- get-images-from-files/README.md | 15 ++++++++++++--- get-images-from-files/action.yaml | 13 ++++++++++++- get-images-from-files/test-values-helmfile.yaml | 16 ++++++++++++++++ 4 files changed, 47 insertions(+), 5 deletions(-) create mode 100644 get-images-from-files/test-values-helmfile.yaml diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml index 73a27ba..d83e40c 100644 --- a/.gitea/workflows/ci.yaml +++ b/.gitea/workflows/ci.yaml @@ -45,6 +45,7 @@ jobs: - get-images-from-files/test.Dockerfile - get-images-from-files/test-deployment.yaml - get-images-from-files/test-compose.yaml + - get-images-from-files/test-values-helmfile.yaml - name: Check image formats extracted run: | images="${{ steps.giff.outputs.images }}" @@ -64,6 +65,11 @@ jobs: check "Compose registry+tag (web:v3)" "example.com/compose/web:v3" check "Compose registry+tag (worker:v3)" "example.com/compose/worker:v3" + # Helmfile values (repository + tag, optional registry) + check "Helmfile image (repository+tag)" "example.com/helmfile/app:v4" + check "Helmfile images.worker (repository+tag)" "example.com/helmfile/worker:v5" + check "Helmfile images.helper (repository+tag with digest)" "example.com/myproject/helper:2.0@sha256:cccc" + # Shared ref (in both files) — must appear exactly once check "Shared ref present (distroless/static:nonroot)" "example.com/distroless/static:nonroot" count=$(echo "$images" | tr ',' '\n' | grep -c 'example.com/distroless/static:nonroot' || true) @@ -71,7 +77,7 @@ jobs: [ "$count" -eq 1 ] && echo "OK (count=$count)" || { echo "FAIL (count=$count, expected 1)"; exit 1; } total=$(echo "$images" | tr ',' '\n' | grep -c . || true) echo -n " Total unique refs: " - [ "$total" -eq 7 ] && echo "OK ($total)" || { echo "FAIL (got $total, expected 7)"; exit 1; } + [ "$total" -eq 10 ] && echo "OK ($total)" || { echo "FAIL (got $total, expected 10)"; exit 1; } echo "" echo "All checks passed." diff --git a/get-images-from-files/README.md b/get-images-from-files/README.md index d2c00a8..faa70bf 100644 --- a/get-images-from-files/README.md +++ b/get-images-from-files/README.md @@ -1,11 +1,20 @@ # Get Images From Files Action -A reusable Gitea Action, that extracts docker images from selected files in a repository. - -The action supports Dockerfiles, Kubernetes manifests, and Docker Compose/compose files. Other files are supported if they have a recognizable image reference. Duplicate image references are deduplicated. +A reusable Gitea Action that extracts Docker image references from selected files in a repository. Duplicate refs are deduplicated. **Note:** Only fully-qualified refs (with registry, e.g. `docker.io/library/alpine:latest`, `gcr.io/distroless/static:nonroot@sha256:...`) are included; short refs like `alpine:latest` are omitted as their use is discouraged. +## Supported file formats + +| Format | How images are extracted | +| ------ | ------------------------- | +| **Dockerfile** | `FROM` lines; the image ref is the last token (handles `FROM --platform=... `). | +| **Kubernetes manifests** | Lines with `image:` (e.g. under `containers` / `initContainers`); the value is taken as the image ref. | +| **Docker Compose / Compose** | Same as Kubernetes: `image:` key under services. | +| **Helmfile values** | Pairs of `repository` and `tag` (both required) at the same indent; ref is `repository:tag`. A lone `tag` without `repository` is skipped. | + +Other files are supported if they use one of these patterns (e.g. `image:` or `FROM`). + ## Usage ### Basic Usage diff --git a/get-images-from-files/action.yaml b/get-images-from-files/action.yaml index 2efa1da..5fe4084 100644 --- a/get-images-from-files/action.yaml +++ b/get-images-from-files/action.yaml @@ -1,5 +1,5 @@ name: "Get Images From Files" -description: "Extract docker images from selected files (Dockerfiles, Kubernetes manifests, Docker Compose/compose files, and files with recognizable image references)" +description: "Extract docker images from selected files (Dockerfiles, Kubernetes manifests, Docker Compose/compose files, Helmfile values, and files with recognizable image references)" author: "Timo Behrendt " branding: icon: "package" @@ -32,6 +32,17 @@ runs: awk '/^[[:space:]]*FROM[[:space:]]/ { print $NF }' "$f" 2>/dev/null || true # Kubernetes / Docker Compose: image: grep -E '[[:space:]]image:[[:space:]]' "$f" 2>/dev/null | sed 's/.*image:[[:space:]]*//' | awk '{ print $1 }' || true + # Helmfile values: repository + tag (both required, by indent); tag without repo is skipped + awk ' + match($0, /^[[:space:]]*/) { indent = RLENGTH } + /^[[:space:]]*repository:[[:space:]]/ { + v = $0; sub(/^[^:]*:[[:space:]]*"?/, "", v); sub(/"?[[:space:]]*$/, "", v); repo[indent] = v; next + } + /^[[:space:]]*tag:[[:space:]]/ { + v = $0; sub(/^[^:]*:[[:space:]]*"?/, "", v); sub(/"?[[:space:]]*$/, "", v); + if (repo[indent] != "") { print repo[indent] ":" v; delete repo[indent] }; next + } + ' "$f" 2>/dev/null || true done | grep -E '/' | sort -u | paste -sd, ) echo "images=${images:-}" >> "$GITHUB_OUTPUT" diff --git a/get-images-from-files/test-values-helmfile.yaml b/get-images-from-files/test-values-helmfile.yaml new file mode 100644 index 0000000..083a7db --- /dev/null +++ b/get-images-from-files/test-values-helmfile.yaml @@ -0,0 +1,16 @@ +# Used by CI to test get-images-from-files action (Helmfile values, fully-qualified refs only) +# Simple convention: image.repository + image.tag +image: + repository: example.com/helmfile/app + tag: "v4" + +# Nested under images (repository + tag) +images: + worker: + repository: example.com/helmfile/worker + tag: "v5" + helper: + repository: example.com/myproject/helper + tag: "2.0@sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc" + invalid-references: + repository: example.com/helmfile/invalid-references