t.behrendt
9411465688
CD / Release (push) Successful in 13s
Adding support for images inside of helm value files as per helm convention. Limitation: Default images the chart may propose are not exposed and therefore not supported, only what's specifically mentioned in the values file. Reviewed-on: t.behrendt/trivy-actions#29 Reviewed-by: branch-buddy <branch-buddy@t00n.de> Co-authored-by: t.behrendt <t.behrendt@t00n.de> Co-committed-by: t.behrendt <t.behrendt@t00n.de>
84 lines
3.3 KiB
YAML
84 lines
3.3 KiB
YAML
name: CI
|
|
|
|
on:
|
|
pull_request:
|
|
|
|
jobs:
|
|
test-setup-trivy:
|
|
strategy:
|
|
matrix:
|
|
arch: [amd64, arm64]
|
|
name: Test Setup Trivy ${{ matrix.arch }}
|
|
runs-on:
|
|
- ubuntu-latest
|
|
- linux_${{ matrix.arch }}
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
|
- name: Setup Trivy
|
|
uses: ./setup-trivy
|
|
- name: Run Trivy
|
|
run: trivy --version
|
|
|
|
test-setup-db:
|
|
name: Test Setup DB
|
|
runs-on:
|
|
- ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
|
- uses: ./setup-trivy
|
|
- name: Setup DB
|
|
id: setup-db
|
|
uses: ./setup-db
|
|
- name: Run Trivy
|
|
run: trivy fs --skip-db-update --cache-dir ${{ steps.setup-db.outputs.cache-dir }} .
|
|
|
|
test-get-images-from-files:
|
|
name: Test Get Images From Files
|
|
runs-on:
|
|
- ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
|
- id: giff
|
|
uses: ./get-images-from-files
|
|
with:
|
|
files: |
|
|
- get-images-from-files/test.Dockerfile
|
|
- get-images-from-files/test-deployment.yaml
|
|
- get-images-from-files/test-compose.yaml
|
|
- get-images-from-files/test-values-helmfile.yaml
|
|
- name: Check image formats extracted
|
|
run: |
|
|
images="${{ steps.giff.outputs.images }}"
|
|
echo "Extracted: $images"
|
|
echo ""
|
|
check() { echo -n " $1: "; echo "$images" | grep -q "$2" && echo "OK" || { echo "FAIL (not found)"; exit 1; }; }
|
|
|
|
# Dockerfile-only refs
|
|
check "Dockerfile registry+tag (nginx:v1)" "example.com/library/nginx:v1"
|
|
check "Dockerfile registry+digest (base@sha256:...)" "example.com/library/base@sha256:aaaaaaaa"
|
|
|
|
# K8s-only refs
|
|
check "K8s registry+tag (app:v2)" "example.com/library/app:v2"
|
|
check "K8s registry+digest (helper@sha256:...)" "example.com/myproject/helper@sha256:bbbbbbbb"
|
|
|
|
# Compose-only refs
|
|
check "Compose registry+tag (web:v3)" "example.com/compose/web:v3"
|
|
check "Compose registry+tag (worker:v3)" "example.com/compose/worker:v3"
|
|
|
|
# Helmfile values (repository + tag, optional registry)
|
|
check "Helmfile image (repository+tag)" "example.com/helmfile/app:v4"
|
|
check "Helmfile images.worker (repository+tag)" "example.com/helmfile/worker:v5"
|
|
check "Helmfile images.helper (repository+tag with digest)" "example.com/myproject/helper:2.0@sha256:cccc"
|
|
|
|
# Shared ref (in both files) — must appear exactly once
|
|
check "Shared ref present (distroless/static:nonroot)" "example.com/distroless/static:nonroot"
|
|
count=$(echo "$images" | tr ',' '\n' | grep -c 'example.com/distroless/static:nonroot' || true)
|
|
echo -n " Shared ref appears once (no duplicates): "
|
|
[ "$count" -eq 1 ] && echo "OK (count=$count)" || { echo "FAIL (count=$count, expected 1)"; exit 1; }
|
|
total=$(echo "$images" | tr ',' '\n' | grep -c . || true)
|
|
echo -n " Total unique refs: "
|
|
[ "$total" -eq 10 ] && echo "OK ($total)" || { echo "FAIL (got $total, expected 10)"; exit 1; }
|
|
|
|
echo ""
|
|
echo "All checks passed."
|