fix: update cve scanners
-name: Docker Image Scan
+name: Docker Image Scanners
on:
push:
branches:
@@ -10,11 +10,17 @@ on:
- 'master'
jobs:
- docker:
+ scanners:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v2
+ - name: Setup Env
+ id: vars
+ shell: bash
+ run: |
+ echo "##[set-output name=branch;]$(echo ${GITHUB_REF#refs/heads/})"
+ echo "::set-output name=sha_short::$(git rev-parse --short HEAD)"
- name: Set up QEMU
uses: docker/setup-qemu-action@v1
- name: Set up Docker Buildx
@@ -22,16 +28,64 @@ jobs:
- name: Build images
shell: bash
run: |
- make docker
- - name: Scan image Dev
+ touch oathkeeper
+ DOCKER_BUILDKIT=1 docker build -t oryd/oathkeeper:${{ steps.vars.outputs.sha_short }} --build-arg=COMMIT=${{ steps.vars.outputs.sha_short }} .
+ DOCKER_BUILDKIT=1 docker build -t oryd/oathkeeper:alpine-${{ steps.vars.outputs.sha_short }} --build-arg=COMMIT=${{ steps.vars.outputs.sha_short }} -f Dockerfile-alpine .
+ rm oathkeeper
+ - name: Anchore Scanner
uses: anchore/scan-action@v3
+ id: grype-scan
with:
- image: oryd/oathkeeper:dev
+ image: oryd/oathkeeper:${{ steps.vars.outputs.sha_short }}
fail-build: true
severity-cutoff: high
- - name: Scan image Alpine
+ debug: false
+ acs-report-enable: true
+ - name: Anchore Scanner
uses: anchore/scan-action@v3
+ id: grype-scan
with:
- image: oryd/oathkeeper:dev-alpine
+ image: oryd/oathkeeper:alpine-${{ steps.vars.outputs.sha_short }}
fail-build: true
severity-cutoff: high
+ debug: false
+ acs-report-enable: true
+ - name: Anchore upload scan SARIF report
+ if: always()
+ uses: github/codeql-action/upload-sarif@v1
+ with:
+ sarif_file: ${{ steps.grype-scan.outputs.sarif }}
+ - name: Trivy Scanner
+ uses: aquasecurity/trivy-action@master
+ if: ${{ always() }}
+ with:
+ image-ref: oryd/oathkeeper:${{ steps.vars.outputs.sha_short }}
+ format: 'table'
+ exit-code: '42'
+ ignore-unfixed: true
+ vuln-type: 'os,library'
+ severity: 'CRITICAL,HIGH'
+ - name: Trivy Scanner 2
+ uses: aquasecurity/trivy-action@master
+ if: ${{ always() }}
+ with:
+ image-ref: oryd/oathkeeper:alpine-${{ steps.vars.outputs.sha_short }}
+ format: 'table'
+ exit-code: '42'
+ ignore-unfixed: true
+ vuln-type: 'os,library'
+ severity: 'CRITICAL,HIGH'
+ - name: Dockle Linter
+ uses: erzz/dockle-action@v1.1.1
+ if: ${{ always() }}
+ with:
+ image: oryd/oathkeeper:${{ steps.vars.outputs.sha_short }}
+ exit-code: 42
+ failure-threshold: fatal
+ - name: Dockle Linter
+ uses: erzz/dockle-action@v1.1.1
+ if: ${{ always() }}
+ with:
+ image: oryd/oathkeeper:alpine-${{ steps.vars.outputs.sha_short }}
+ exit-code: 42
+ failure-threshold: fatal
