From 923962f961e13a38f3fc9f15a36ce638de03d0fd Mon Sep 17 00:00:00 2001 From: "t.behrendt" Date: Thu, 5 Feb 2026 14:27:27 +0100 Subject: [PATCH 1/6] feat: add get-images-from-files action --- .gitea/workflows/ci.yaml | 28 ++++++++++++ get-images-from-files/README.md | 51 ++++++++++++++++++++++ get-images-from-files/action.yaml | 37 ++++++++++++++++ get-images-from-files/test-deployment.yaml | 20 +++++++++ get-images-from-files/test.Dockerfile | 11 +++++ 5 files changed, 147 insertions(+) create mode 100644 get-images-from-files/README.md create mode 100644 get-images-from-files/action.yaml create mode 100644 get-images-from-files/test-deployment.yaml create mode 100644 get-images-from-files/test.Dockerfile diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml index 8dfb8d0..50210c2 100644 --- a/.gitea/workflows/ci.yaml +++ b/.gitea/workflows/ci.yaml @@ -31,3 +31,31 @@ jobs: uses: ./setup-db - name: Run Trivy run: trivy fs --skip-db-update --cache-dir ${{ steps.setup-db.outputs.cache-dir }} . + + test-get-images-from-files: + name: Test Get Images From Files + runs-on: + - ubuntu-latest + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + - name: Get Images From Files + id: giff + uses: ./get-images-from-files + with: + files: | + - get-images-from-files/test.Dockerfile + - get-images-from-files/test-deployment.yaml + - name: Check image formats extracted + run: | + images="${{ steps.giff.outputs.images }}" + echo "Extracted: $images" + # Registry with tag + echo "$images" | grep -q 'example.com/library/nginx:latest' + echo "$images" | grep -q 'example.com/library/redis:7-alpine' + echo "$images" | grep -q 'example.com/library/app:1.25-alpine' + # Registry path with tag + echo "$images" | grep -q 'example.com/distroless/static:nonroot' + # Registry with digest + echo "$images" | grep -q 'example.com/distroless/static@sha256:abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcd' + echo "$images" | grep -q 'example.com/library/alpine@sha256:1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef' + echo "$images" | grep -q 'example.com/myproject/myimg@sha256:abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcd' diff --git a/get-images-from-files/README.md b/get-images-from-files/README.md new file mode 100644 index 0000000..c3751c5 --- /dev/null +++ b/get-images-from-files/README.md @@ -0,0 +1,51 @@ +# Get Images From Files Action + +A reusable Gitea Action, that extracts docker images from selected files in a repository. + +The action supports Dockerfiles and Kubernetes manifests. Other files are supported if they have a recognizable image reference. + +## Usage + +### Basic Usage + +```yaml +- name: Get Images From Files + uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/get-images-from-files@0.0.1 + with: + files: | + - Dockerfile + - k8s/50_deployment.yaml + - values/traefik.yaml +``` + +### Complete Example + +```yaml +name: Get Images From Files +on: [push, pull_request] + +jobs: + get-images-from-files: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - name: Get Images From Files + uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/get-images-from-files@0.0.1 + with: + files: | + - Dockerfile + - k8s/50_deployment.yaml + - values/traefik.yaml +``` + +## Inputs + +| Input | Description | Required | Default | +| --------- | ----------------------------------------- | -------- | -------- | +| `files` | Files to extract images from. Multiple files can be specified.. | Yes | | + +## Outputs + +| Output | Description | +| --------- | ----------------------------------------- | +| `images` | Comma separated list of extracted image references. Only fully-qualified refs (with registry, e.g. `docker.io/library/alpine:latest`, `gcr.io/distroless/static:nonroot@sha256:...`) are included; short refs like `alpine:latest` are omitted. | diff --git a/get-images-from-files/action.yaml b/get-images-from-files/action.yaml new file mode 100644 index 0000000..2746f63 --- /dev/null +++ b/get-images-from-files/action.yaml @@ -0,0 +1,37 @@ +name: "Get Images From Files" +description: "Extract docker images from selected files (Dockerfiles, Kubernetes manifests, and files with recognizable image references)" +author: "Timo Behrendt " +branding: + icon: "package" + color: "blue" + +inputs: + files: + description: "Files to extract images from. Multiple files can be specified (YAML list format)." + required: true + +outputs: + images: + description: "Comma-separated list of extracted image references (e.g. docker.io/library/alpine:latest,gcr.io/distroless/static:nonroot@sha256:...)" + value: ${{ steps.extract.outputs.images }} + +runs: + using: "composite" + steps: + - id: extract + shell: bash + run: | + set -e + files="${{ inputs.files }}" + # Parse YAML list: lines like " - path/to/file" or "- file" + file_list=$(echo "$files" | sed -n 's/^[[:space:]]*-[[:space:]]*//p' | tr -d '"' | tr -d "'") + images=$( + for f in $file_list; do + [ -f "$f" ] || continue + # Dockerfile: FROM [--platform=...] + awk '/^[[:space:]]*FROM[[:space:]]/ { print $NF }' "$f" 2>/dev/null || true + # Kubernetes / Compose: image: + grep -E '[[:space:]]image:[[:space:]]' "$f" 2>/dev/null | sed 's/.*image:[[:space:]]*//' | awk '{ print $1 }' || true + done | grep -E '/' | sort -u | paste -sd, + ) + echo "images=${images:-}" >> "$GITHUB_OUTPUT" diff --git a/get-images-from-files/test-deployment.yaml b/get-images-from-files/test-deployment.yaml new file mode 100644 index 0000000..ba7d260 --- /dev/null +++ b/get-images-from-files/test-deployment.yaml @@ -0,0 +1,20 @@ +# Used by CI to test get-images-from-files action (K8s manifest, registry refs only) +apiVersion: apps/v1 +kind: Deployment +metadata: + name: test +spec: + replicas: 1 + template: + spec: + containers: + - name: app + image: example.com/library/app:1.25-alpine + - name: sidecar + image: example.com/library/redis:7-alpine + - name: distroless + image: example.com/distroless/static:nonroot + - name: by-digest + image: example.com/library/alpine@sha256:1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef + - name: fqdn-digest + image: example.com/myproject/myimg@sha256:abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcd diff --git a/get-images-from-files/test.Dockerfile b/get-images-from-files/test.Dockerfile new file mode 100644 index 0000000..853180a --- /dev/null +++ b/get-images-from-files/test.Dockerfile @@ -0,0 +1,11 @@ +# Used by CI to test get-images-from-files action (varied image formats, registry refs only) +# Short repo:tag (ignored by design; only registry refs are extracted) +FROM nginx:3.19 +# Fully qualified with host and tag +FROM example.com/library/nginx:latest +# Registry path with tag +FROM example.com/distroless/static:nonroot +# With digest only but no registry (ignored) +FROM nginx@sha256:1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef +# Fully qualified with digest +FROM example.com/distroless/static@sha256:abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcd -- 2.52.0 From 61da085e0fbe0a8058328458f7fca443e90d1eb0 Mon Sep 17 00:00:00 2001 From: "t.behrendt" Date: Thu, 5 Feb 2026 14:34:21 +0100 Subject: [PATCH 2/6] test: make test cases unique and test de-duplication --- .gitea/workflows/ci.yaml | 21 ++++++++++++--------- get-images-from-files/test-deployment.yaml | 15 +++++++-------- get-images-from-files/test.Dockerfile | 20 +++++++++++--------- 3 files changed, 30 insertions(+), 26 deletions(-) diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml index 50210c2..7784fe7 100644 --- a/.gitea/workflows/ci.yaml +++ b/.gitea/workflows/ci.yaml @@ -49,13 +49,16 @@ jobs: run: | images="${{ steps.giff.outputs.images }}" echo "Extracted: $images" - # Registry with tag - echo "$images" | grep -q 'example.com/library/nginx:latest' - echo "$images" | grep -q 'example.com/library/redis:7-alpine' - echo "$images" | grep -q 'example.com/library/app:1.25-alpine' - # Registry path with tag + # Dockerfile-only: registry with tag, registry with digest + echo "$images" | grep -q 'example.com/library/nginx:v1' + echo "$images" | grep -q 'example.com/library/base@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' + # K8s-only: registry with tag, registry with digest + echo "$images" | grep -q 'example.com/library/app:v2' + echo "$images" | grep -q 'example.com/myproject/helper@sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' + # Shared ref (in both Dockerfile and K8s) — must appear exactly once echo "$images" | grep -q 'example.com/distroless/static:nonroot' - # Registry with digest - echo "$images" | grep -q 'example.com/distroless/static@sha256:abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcd' - echo "$images" | grep -q 'example.com/library/alpine@sha256:1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef' - echo "$images" | grep -q 'example.com/myproject/myimg@sha256:abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcd' + count=$(echo "$images" | tr ',' '\n' | grep -c 'example.com/distroless/static:nonroot' || true) + [ "$count" -eq 1 ] || { echo "expected shared ref once, got: $count"; exit 1; } + # Total unique refs: 5 + total=$(echo "$images" | tr ',' '\n' | grep -c . || true) + [ "$total" -eq 5 ] || { echo "expected 5 unique refs, got: $total"; exit 1; } diff --git a/get-images-from-files/test-deployment.yaml b/get-images-from-files/test-deployment.yaml index ba7d260..bcab9a5 100644 --- a/get-images-from-files/test-deployment.yaml +++ b/get-images-from-files/test-deployment.yaml @@ -1,4 +1,4 @@ -# Used by CI to test get-images-from-files action (K8s manifest, registry refs only) +# Used by CI to test get-images-from-files action (K8s, distinct from Dockerfile) apiVersion: apps/v1 kind: Deployment metadata: @@ -9,12 +9,11 @@ spec: spec: containers: - name: app - image: example.com/library/app:1.25-alpine - - name: sidecar - image: example.com/library/redis:7-alpine - - name: distroless + # Registry with tag (K8s) + image: example.com/library/app:v2 + - name: shared + # Same ref as in test.Dockerfile — tests deduplication image: example.com/distroless/static:nonroot - name: by-digest - image: example.com/library/alpine@sha256:1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef - - name: fqdn-digest - image: example.com/myproject/myimg@sha256:abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcd + # Registry with digest (K8s) + image: example.com/myproject/helper@sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb diff --git a/get-images-from-files/test.Dockerfile b/get-images-from-files/test.Dockerfile index 853180a..4aa49e0 100644 --- a/get-images-from-files/test.Dockerfile +++ b/get-images-from-files/test.Dockerfile @@ -1,11 +1,13 @@ -# Used by CI to test get-images-from-files action (varied image formats, registry refs only) -# Short repo:tag (ignored by design; only registry refs are extracted) -FROM nginx:3.19 -# Fully qualified with host and tag -FROM example.com/library/nginx:latest -# Registry path with tag +# Used by CI to test get-images-from-files action (registry refs only, distinct from K8s) +# Registry with tag (Dockerfile) +FROM example.com/library/nginx:v1 +# Registry path with tag — shared with K8s to test deduplication FROM example.com/distroless/static:nonroot -# With digest only but no registry (ignored) +# Registry with digest (Dockerfile) +FROM example.com/library/base@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa + +# Ignored tags +## Short repo:tag (ignored by design; only registry refs are extracted) +FROM nginx:3.19 +## With digest only but no registry (ignored) FROM nginx@sha256:1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef -# Fully qualified with digest -FROM example.com/distroless/static@sha256:abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcd -- 2.52.0 From 6eef74009f7ce204c99906d406085c292dd90636 Mon Sep 17 00:00:00 2001 From: "t.behrendt" Date: Thu, 5 Feb 2026 14:35:15 +0100 Subject: [PATCH 3/6] docs: add mention about deduplication --- get-images-from-files/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/get-images-from-files/README.md b/get-images-from-files/README.md index c3751c5..00822ab 100644 --- a/get-images-from-files/README.md +++ b/get-images-from-files/README.md @@ -2,7 +2,7 @@ A reusable Gitea Action, that extracts docker images from selected files in a repository. -The action supports Dockerfiles and Kubernetes manifests. Other files are supported if they have a recognizable image reference. +The action supports Dockerfiles and Kubernetes manifests. Other files are supported if they have a recognizable image reference. Duplicate image references are deduplicated. ## Usage -- 2.52.0 From 2c9bfa6eb809fffe2e5bbfd6e4d57e2e386e5686 Mon Sep 17 00:00:00 2001 From: "t.behrendt" Date: Thu, 5 Feb 2026 14:35:33 +0100 Subject: [PATCH 4/6] docs: add warning about short refs not being supported --- get-images-from-files/README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/get-images-from-files/README.md b/get-images-from-files/README.md index 00822ab..ad76b26 100644 --- a/get-images-from-files/README.md +++ b/get-images-from-files/README.md @@ -4,6 +4,8 @@ A reusable Gitea Action, that extracts docker images from selected files in a re The action supports Dockerfiles and Kubernetes manifests. Other files are supported if they have a recognizable image reference. Duplicate image references are deduplicated. +**Note:** Only fully-qualified refs (with registry, e.g. `docker.io/library/alpine:latest`, `gcr.io/distroless/static:nonroot@sha256:...`) are included; short refs like `alpine:latest` are omitted as their use is discouraged. + ## Usage ### Basic Usage -- 2.52.0 From a30bdc5e8e503a222f8e14d856f80f2547d03991 Mon Sep 17 00:00:00 2001 From: "t.behrendt" Date: Thu, 5 Feb 2026 14:38:07 +0100 Subject: [PATCH 5/6] style: formatting --- .gitea/workflows/ci.yaml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml index 7784fe7..e467dd3 100644 --- a/.gitea/workflows/ci.yaml +++ b/.gitea/workflows/ci.yaml @@ -38,8 +38,7 @@ jobs: - ubuntu-latest steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 - - name: Get Images From Files - id: giff + - id: giff uses: ./get-images-from-files with: files: | -- 2.52.0 From b41c75e76f2c08e80079677a5523989067de2291 Mon Sep 17 00:00:00 2001 From: "t.behrendt" Date: Thu, 5 Feb 2026 14:45:44 +0100 Subject: [PATCH 6/6] style: make ci test more expressive --- .gitea/workflows/ci.yaml | 31 ++++++++++++++++++++----------- 1 file changed, 20 insertions(+), 11 deletions(-) diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml index e467dd3..3d5ee26 100644 --- a/.gitea/workflows/ci.yaml +++ b/.gitea/workflows/ci.yaml @@ -48,16 +48,25 @@ jobs: run: | images="${{ steps.giff.outputs.images }}" echo "Extracted: $images" - # Dockerfile-only: registry with tag, registry with digest - echo "$images" | grep -q 'example.com/library/nginx:v1' - echo "$images" | grep -q 'example.com/library/base@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa' - # K8s-only: registry with tag, registry with digest - echo "$images" | grep -q 'example.com/library/app:v2' - echo "$images" | grep -q 'example.com/myproject/helper@sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb' - # Shared ref (in both Dockerfile and K8s) — must appear exactly once - echo "$images" | grep -q 'example.com/distroless/static:nonroot' + echo "" + check() { echo -n " $1: "; echo "$images" | grep -q "$2" && echo "OK" || { echo "FAIL (not found)"; exit 1; }; } + + # Dockerfile-only refs + check "Dockerfile registry+tag (nginx:v1)" "example.com/library/nginx:v1" + check "Dockerfile registry+digest (base@sha256:...)" "example.com/library/base@sha256:aaaaaaaa" + + # K8s-only refs + check "K8s registry+tag (app:v2)" "example.com/library/app:v2" + check "K8s registry+digest (helper@sha256:...)" "example.com/myproject/helper@sha256:bbbbbbbb" + + # Shared ref (in both files) — must appear exactly once + check "Shared ref present (distroless/static:nonroot)" "example.com/distroless/static:nonroot" count=$(echo "$images" | tr ',' '\n' | grep -c 'example.com/distroless/static:nonroot' || true) - [ "$count" -eq 1 ] || { echo "expected shared ref once, got: $count"; exit 1; } - # Total unique refs: 5 + echo -n " Shared ref appears once (no duplicates): " + [ "$count" -eq 1 ] && echo "OK (count=$count)" || { echo "FAIL (count=$count, expected 1)"; exit 1; } total=$(echo "$images" | tr ',' '\n' | grep -c . || true) - [ "$total" -eq 5 ] || { echo "expected 5 unique refs, got: $total"; exit 1; } + echo -n " Total unique refs: " + [ "$total" -eq 5 ] && echo "OK ($total)" || { echo "FAIL (got $total, expected 5)"; exit 1; } + + echo "" + echo "All checks passed." -- 2.52.0