nessi
7f7cf9179f
Trivy-based scanning steps and their summaries have been removed from the GitHub Actions workflow. This change focuses on streamlining the workflow by reducing redundancy and relying on alternate scanning methods.
113 lines
4.2 KiB
YAML
113 lines
4.2 KiB
YAML
name: Container CVE Scan (development)
|
|
|
|
on:
|
|
push:
|
|
branches: ["development"]
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
cve-scan:
|
|
name: Scan backend/frontend images for CVEs
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v3
|
|
|
|
- name: Docker Hub login (for Scout)
|
|
if: ${{ secrets.DOCKERHUB_USERNAME != '' && secrets.DOCKERHUB_TOKEN != '' }}
|
|
uses: docker/login-action@v3
|
|
with:
|
|
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
|
|
- name: Prepare Docker auth config for Scout container
|
|
if: ${{ secrets.DOCKERHUB_USERNAME != '' && secrets.DOCKERHUB_TOKEN != '' }}
|
|
run: |
|
|
mkdir -p "$RUNNER_TEMP/scout-docker-config"
|
|
cp "$HOME/.docker/config.json" "$RUNNER_TEMP/scout-docker-config/config.json"
|
|
chmod 600 "$RUNNER_TEMP/scout-docker-config/config.json"
|
|
|
|
- name: Build backend image (local)
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: ./backend
|
|
file: ./backend/Dockerfile
|
|
push: false
|
|
load: true
|
|
tags: nexapg-backend:dev-scan
|
|
provenance: false
|
|
sbom: false
|
|
|
|
- name: Build frontend image (local)
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: ./frontend
|
|
file: ./frontend/Dockerfile
|
|
push: false
|
|
load: true
|
|
tags: nexapg-frontend:dev-scan
|
|
build-args: |
|
|
VITE_API_URL=/api/v1
|
|
provenance: false
|
|
sbom: false
|
|
|
|
- name: Docker Scout scan (backend)
|
|
continue-on-error: true
|
|
run: |
|
|
if [ -z "${{ secrets.DOCKERHUB_USERNAME }}" ] || [ -z "${{ secrets.DOCKERHUB_TOKEN }}" ]; then
|
|
echo "Docker Hub Scout scan skipped: DOCKERHUB_USERNAME/DOCKERHUB_TOKEN not set." > scout-backend.txt
|
|
exit 0
|
|
fi
|
|
docker run --rm \
|
|
-u root \
|
|
-v /var/run/docker.sock:/var/run/docker.sock \
|
|
-v "$RUNNER_TEMP/scout-docker-config:/root/.docker" \
|
|
-e DOCKER_CONFIG=/root/.docker \
|
|
-e DOCKER_SCOUT_HUB_USER="${{ secrets.DOCKERHUB_USERNAME }}" \
|
|
-e DOCKER_SCOUT_HUB_PASSWORD="${{ secrets.DOCKERHUB_TOKEN }}" \
|
|
docker/scout-cli:latest cves nexapg-backend:dev-scan \
|
|
--only-severity critical,high,medium,low > scout-backend.txt 2>&1 || {
|
|
echo "" >> scout-backend.txt
|
|
echo "Docker Scout backend scan failed (non-blocking)." >> scout-backend.txt
|
|
}
|
|
|
|
- name: Docker Scout scan (frontend)
|
|
continue-on-error: true
|
|
run: |
|
|
if [ -z "${{ secrets.DOCKERHUB_USERNAME }}" ] || [ -z "${{ secrets.DOCKERHUB_TOKEN }}" ]; then
|
|
echo "Docker Hub Scout scan skipped: DOCKERHUB_USERNAME/DOCKERHUB_TOKEN not set." > scout-frontend.txt
|
|
exit 0
|
|
fi
|
|
docker run --rm \
|
|
-u root \
|
|
-v /var/run/docker.sock:/var/run/docker.sock \
|
|
-v "$RUNNER_TEMP/scout-docker-config:/root/.docker" \
|
|
-e DOCKER_CONFIG=/root/.docker \
|
|
-e DOCKER_SCOUT_HUB_USER="${{ secrets.DOCKERHUB_USERNAME }}" \
|
|
-e DOCKER_SCOUT_HUB_PASSWORD="${{ secrets.DOCKERHUB_TOKEN }}" \
|
|
docker/scout-cli:latest cves nexapg-frontend:dev-scan \
|
|
--only-severity critical,high,medium,low > scout-frontend.txt 2>&1 || {
|
|
echo "" >> scout-frontend.txt
|
|
echo "Docker Scout frontend scan failed (non-blocking)." >> scout-frontend.txt
|
|
}
|
|
|
|
- name: Print scan summary
|
|
run: |
|
|
echo "===== Docker Scout backend ====="
|
|
test -f scout-backend.txt && cat scout-backend.txt || echo "scout-backend.txt not available"
|
|
echo
|
|
echo "===== Docker Scout frontend ====="
|
|
test -f scout-frontend.txt && cat scout-frontend.txt || echo "scout-frontend.txt not available"
|
|
|
|
- name: Upload scan reports
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: container-cve-scan-reports
|
|
path: |
|
|
scout-backend.txt
|
|
scout-frontend.txt
|