From a076c9d732e01b22437e97d9aeee3bd13c00f1bb Mon Sep 17 00:00:00 2001 From: "t.behrendt" Date: Thu, 5 Feb 2026 14:52:41 +0100 Subject: [PATCH] feat: add get-images-from-files action (#27) Reviewed-on: https://gitea.t000-n.de/t.behrendt/trivy-actions/pulls/27 Reviewed-by: branch-buddy Co-authored-by: t.behrendt Co-committed-by: t.behrendt --- .gitea/workflows/ci.yaml | 39 ++++++++++++++++ get-images-from-files/README.md | 53 ++++++++++++++++++++++ get-images-from-files/action.yaml | 37 +++++++++++++++ get-images-from-files/test-deployment.yaml | 19 ++++++++ get-images-from-files/test.Dockerfile | 13 ++++++ 5 files changed, 161 insertions(+) create mode 100644 get-images-from-files/README.md create mode 100644 get-images-from-files/action.yaml create mode 100644 get-images-from-files/test-deployment.yaml create mode 100644 get-images-from-files/test.Dockerfile diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml index 8dfb8d0..3d5ee26 100644 --- a/.gitea/workflows/ci.yaml +++ b/.gitea/workflows/ci.yaml @@ -31,3 +31,42 @@ jobs: uses: ./setup-db - name: Run Trivy run: trivy fs --skip-db-update --cache-dir ${{ steps.setup-db.outputs.cache-dir }} . + + test-get-images-from-files: + name: Test Get Images From Files + runs-on: + - ubuntu-latest + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + - id: giff + uses: ./get-images-from-files + with: + files: | + - get-images-from-files/test.Dockerfile + - get-images-from-files/test-deployment.yaml + - name: Check image formats extracted + run: | + images="${{ steps.giff.outputs.images }}" + echo "Extracted: $images" + echo "" + check() { echo -n " $1: "; echo "$images" | grep -q "$2" && echo "OK" || { echo "FAIL (not found)"; exit 1; }; } + + # Dockerfile-only refs + check "Dockerfile registry+tag (nginx:v1)" "example.com/library/nginx:v1" + check "Dockerfile registry+digest (base@sha256:...)" "example.com/library/base@sha256:aaaaaaaa" + + # K8s-only refs + check "K8s registry+tag (app:v2)" "example.com/library/app:v2" + check "K8s registry+digest (helper@sha256:...)" "example.com/myproject/helper@sha256:bbbbbbbb" + + # Shared ref (in both files) — must appear exactly once + check "Shared ref present (distroless/static:nonroot)" "example.com/distroless/static:nonroot" + count=$(echo "$images" | tr ',' '\n' | grep -c 'example.com/distroless/static:nonroot' || true) + echo -n " Shared ref appears once (no duplicates): " + [ "$count" -eq 1 ] && echo "OK (count=$count)" || { echo "FAIL (count=$count, expected 1)"; exit 1; } + total=$(echo "$images" | tr ',' '\n' | grep -c . || true) + echo -n " Total unique refs: " + [ "$total" -eq 5 ] && echo "OK ($total)" || { echo "FAIL (got $total, expected 5)"; exit 1; } + + echo "" + echo "All checks passed." diff --git a/get-images-from-files/README.md b/get-images-from-files/README.md new file mode 100644 index 0000000..ad76b26 --- /dev/null +++ b/get-images-from-files/README.md @@ -0,0 +1,53 @@ +# Get Images From Files Action + +A reusable Gitea Action, that extracts docker images from selected files in a repository. + +The action supports Dockerfiles and Kubernetes manifests. Other files are supported if they have a recognizable image reference. Duplicate image references are deduplicated. + +**Note:** Only fully-qualified refs (with registry, e.g. `docker.io/library/alpine:latest`, `gcr.io/distroless/static:nonroot@sha256:...`) are included; short refs like `alpine:latest` are omitted as their use is discouraged. + +## Usage + +### Basic Usage + +```yaml +- name: Get Images From Files + uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/get-images-from-files@0.0.1 + with: + files: | + - Dockerfile + - k8s/50_deployment.yaml + - values/traefik.yaml +``` + +### Complete Example + +```yaml +name: Get Images From Files +on: [push, pull_request] + +jobs: + get-images-from-files: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - name: Get Images From Files + uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/get-images-from-files@0.0.1 + with: + files: | + - Dockerfile + - k8s/50_deployment.yaml + - values/traefik.yaml +``` + +## Inputs + +| Input | Description | Required | Default | +| --------- | ----------------------------------------- | -------- | -------- | +| `files` | Files to extract images from. Multiple files can be specified.. | Yes | | + +## Outputs + +| Output | Description | +| --------- | ----------------------------------------- | +| `images` | Comma separated list of extracted image references. Only fully-qualified refs (with registry, e.g. `docker.io/library/alpine:latest`, `gcr.io/distroless/static:nonroot@sha256:...`) are included; short refs like `alpine:latest` are omitted. | diff --git a/get-images-from-files/action.yaml b/get-images-from-files/action.yaml new file mode 100644 index 0000000..2746f63 --- /dev/null +++ b/get-images-from-files/action.yaml @@ -0,0 +1,37 @@ +name: "Get Images From Files" +description: "Extract docker images from selected files (Dockerfiles, Kubernetes manifests, and files with recognizable image references)" +author: "Timo Behrendt " +branding: + icon: "package" + color: "blue" + +inputs: + files: + description: "Files to extract images from. Multiple files can be specified (YAML list format)." + required: true + +outputs: + images: + description: "Comma-separated list of extracted image references (e.g. docker.io/library/alpine:latest,gcr.io/distroless/static:nonroot@sha256:...)" + value: ${{ steps.extract.outputs.images }} + +runs: + using: "composite" + steps: + - id: extract + shell: bash + run: | + set -e + files="${{ inputs.files }}" + # Parse YAML list: lines like " - path/to/file" or "- file" + file_list=$(echo "$files" | sed -n 's/^[[:space:]]*-[[:space:]]*//p' | tr -d '"' | tr -d "'") + images=$( + for f in $file_list; do + [ -f "$f" ] || continue + # Dockerfile: FROM [--platform=...] + awk '/^[[:space:]]*FROM[[:space:]]/ { print $NF }' "$f" 2>/dev/null || true + # Kubernetes / Compose: image: + grep -E '[[:space:]]image:[[:space:]]' "$f" 2>/dev/null | sed 's/.*image:[[:space:]]*//' | awk '{ print $1 }' || true + done | grep -E '/' | sort -u | paste -sd, + ) + echo "images=${images:-}" >> "$GITHUB_OUTPUT" diff --git a/get-images-from-files/test-deployment.yaml b/get-images-from-files/test-deployment.yaml new file mode 100644 index 0000000..bcab9a5 --- /dev/null +++ b/get-images-from-files/test-deployment.yaml @@ -0,0 +1,19 @@ +# Used by CI to test get-images-from-files action (K8s, distinct from Dockerfile) +apiVersion: apps/v1 +kind: Deployment +metadata: + name: test +spec: + replicas: 1 + template: + spec: + containers: + - name: app + # Registry with tag (K8s) + image: example.com/library/app:v2 + - name: shared + # Same ref as in test.Dockerfile — tests deduplication + image: example.com/distroless/static:nonroot + - name: by-digest + # Registry with digest (K8s) + image: example.com/myproject/helper@sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb diff --git a/get-images-from-files/test.Dockerfile b/get-images-from-files/test.Dockerfile new file mode 100644 index 0000000..4aa49e0 --- /dev/null +++ b/get-images-from-files/test.Dockerfile @@ -0,0 +1,13 @@ +# Used by CI to test get-images-from-files action (registry refs only, distinct from K8s) +# Registry with tag (Dockerfile) +FROM example.com/library/nginx:v1 +# Registry path with tag — shared with K8s to test deduplication +FROM example.com/distroless/static:nonroot +# Registry with digest (Dockerfile) +FROM example.com/library/base@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa + +# Ignored tags +## Short repo:tag (ignored by design; only registry refs are extracted) +FROM nginx:3.19 +## With digest only but no registry (ignored) +FROM nginx@sha256:1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef