t.behrendt
067d321f7a
CD / Release (push) Successful in 15s
Pinning to the full semver where it is missing. Some digests updated as well. Also fixed some formatting, there were extra spaces. Reviewed-on: t.behrendt/trivy-actions#38 Reviewed-by: branch-buddy <branch-buddy@t00n.de> Co-authored-by: Timo Behrendt <t.behrendt@t00n.de> Co-committed-by: Timo Behrendt <t.behrendt@t00n.de>
85 lines
3.5 KiB
YAML
85 lines
3.5 KiB
YAML
name: CI
|
|
|
|
on:
|
|
pull_request:
|
|
|
|
jobs:
|
|
test-setup-trivy:
|
|
strategy:
|
|
matrix:
|
|
arch: [ amd64, arm64 ]
|
|
name: Test Setup Trivy ${{ matrix.arch }}
|
|
runs-on:
|
|
- ubuntu-latest
|
|
- linux_${{ matrix.arch }}
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
- name: Setup Trivy
|
|
uses: ./setup-trivy
|
|
- name: Run Trivy
|
|
run: trivy --version
|
|
|
|
test-setup-db:
|
|
name: Test Setup DB
|
|
runs-on:
|
|
- ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
- uses: ./setup-trivy
|
|
- name: Setup DB
|
|
id: setup-db
|
|
uses: ./setup-db
|
|
- name: Run Trivy
|
|
run: trivy fs --skip-db-update --cache-dir ${{ steps.setup-db.outputs.cache-dir }} .
|
|
|
|
test-get-images-from-files:
|
|
name: Test Get Images From Files
|
|
runs-on:
|
|
- ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
- id: giff
|
|
uses: ./get-images-from-files
|
|
with:
|
|
files: |
|
|
- get-images-from-files/test.Dockerfile
|
|
- get-images-from-files/test-deployment.yaml
|
|
- get-images-from-files/test-compose.yaml
|
|
- get-images-from-files/test-values-helmfile.yaml
|
|
- name: Check image formats extracted
|
|
run: |
|
|
images='${{ steps.giff.outputs.images }}'
|
|
echo "JSON array (for manual inspection):"
|
|
echo "$images" | jq .
|
|
echo ""
|
|
check() { echo -n " $1: "; echo "$images" | jq -e --arg ref "$2" 'index($ref) != null' >/dev/null && echo "OK" || { echo "FAIL (not found)"; exit 1; }; }
|
|
|
|
# Dockerfile-only refs
|
|
check "Dockerfile registry+tag (nginx:v1)" "example.com/library/nginx:v1"
|
|
check "Dockerfile registry+digest (base@sha256:...)" "example.com/library/base@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
|
|
|
|
# K8s-only refs
|
|
check "K8s registry+tag (app:v2)" "example.com/library/app:v2"
|
|
check "K8s registry+digest (helper@sha256:...)" "example.com/myproject/helper@sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
|
|
|
|
# Compose-only refs
|
|
check "Compose registry+tag (web:v3)" "example.com/compose/web:v3"
|
|
check "Compose registry+tag (worker:v3)" "example.com/compose/worker:v3"
|
|
|
|
# Helmfile values (repository + tag, optional registry)
|
|
check "Helmfile image (repository+tag)" "example.com/helmfile/app:v4"
|
|
check "Helmfile images.worker (repository+tag)" "example.com/helmfile/worker:v5"
|
|
check "Helmfile images.helper (repository+tag with digest)" "example.com/myproject/helper:2.0@sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
|
|
|
|
# Shared ref (in both files) — must appear exactly once
|
|
check "Shared ref present (distroless/static:nonroot)" "example.com/distroless/static:nonroot"
|
|
count=$(echo "$images" | jq '[.[] | select(. == "example.com/distroless/static:nonroot")] | length')
|
|
echo -n " Shared ref appears once (no duplicates): "
|
|
[ "$count" -eq 1 ] && echo "OK (count=$count)" || { echo "FAIL (count=$count, expected 1)"; exit 1; }
|
|
total=$(echo "$images" | jq 'length')
|
|
echo -n " Total unique refs: "
|
|
[ "$total" -eq 10 ] && echo "OK ($total)" || { echo "FAIL (got $total, expected 10)"; exit 1; }
|
|
|
|
echo ""
|
|
echo "All checks passed."
|