Skip to content

Commit 76168bc

Browse files
saisatishkarrasaisatishkarra
authored
feat(sca): refactored grype cache (#318)
feat(scan-docker-image): refactored grype cache BREAKING CHANGE: - Removes "force_grype_db_update" and "skip_grype_db_cache" input - Adds "grype_db_cache" and "grype_db_cache_token" input for private grype db mirror - Grype DB caching strategy: GH Cache -> Grype DB mirror (if specified) -> Grype upstream
1 parent 1c412fc commit 76168bc

File tree

6 files changed

+492
-449
lines changed

6 files changed

+492
-449
lines changed

‎.github/workflows/dir-scan.yml‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,12 @@ name: SCA Directory Scan
33
on:
44
pull_request:
55
branches:
6-
- main
6+
- main
77
push:
88
branches:
9-
- main
9+
- main
1010
tags:
11-
- '*'
11+
- "*"
1212
workflow_dispatch: {}
1313

1414
jobs:
@@ -23,16 +23,16 @@ jobs:
2323
pull-requests: write
2424
name: Test Repository Scan
2525
steps:
26-
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
27-
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
28-
with:
29-
repository: ${{env.TEST_REPOSITORY}}
30-
path: ${{env.TEST_REPOSITORY}}
31-
- name: Scan Directory
32-
id: scan-dir
33-
uses: ./security-actions/sca
34-
with:
35-
asset_prefix: test.insomnia
36-
dir: ${{env.TEST_REPOSITORY}}
37-
upload-sbom-release-assets: true
38-
fail_build: false
26+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
27+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
28+
with:
29+
repository: ${{env.TEST_REPOSITORY}}
30+
path: ${{env.TEST_REPOSITORY}}
31+
- name: Scan Directory
32+
id: scan-dir
33+
uses: ./security-actions/sca
34+
with:
35+
asset_prefix: test.insomnia
36+
dir: ${{env.TEST_REPOSITORY}}
37+
upload-sbom-release-assets: true
38+
fail_build: false

‎.github/workflows/docker-image-scan.yml‎

Lines changed: 53 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,12 @@ name: SCA Docker Test
33
on:
44
pull_request:
55
branches:
6-
- main
6+
- main
77
push:
88
branches:
9-
- main
9+
- main
1010
tags:
11-
- '*'
11+
- "*"
1212
workflow_dispatch: {}
1313

1414
jobs:
@@ -24,59 +24,62 @@ jobs:
2424
env:
2525
IMAGE: kong/kong-gateway-dev:latest #particular reason for the choice of image: test multi arch image sbom
2626
steps:
27-
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
27+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
2828

29-
- name: Install regctl
30-
uses: regclient/actions/regctl-installer@ce5fd131e371ffcdd7508b478cb223b3511a9183
29+
- name: Install regctl
30+
uses: regclient/actions/regctl-installer@ce5fd131e371ffcdd7508b478cb223b3511a9183
3131

32-
- name: Login to DockerHub
33-
if: success()
34-
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
35-
with:
36-
username: ${{ secrets.GHA_DOCKERHUB_PULL_USER }}
37-
password: ${{ secrets.GHA_KONG_ORG_DOCKERHUB_PUBLIC_TOKEN }}
32+
- name: Login to DockerHub
33+
if: success()
34+
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
35+
with:
36+
username: ${{ secrets.GHA_DOCKERHUB_PULL_USER }}
37+
password: ${{ secrets.GHA_KONG_ORG_DOCKERHUB_PUBLIC_TOKEN }}
3838

39-
- name: Parse Architecture Specific Image Manifest Digests
40-
id: image_manifest_metadata
41-
run: |
42-
manifest_list_exists="$(
43-
if regctl manifest get "${IMAGE}" --format raw-body --require-list -v panic &> /dev/null; then
44-
echo true
45-
else
46-
echo false
47-
fi
48-
)"
49-
echo "manifest_list_exists=$manifest_list_exists"
50-
echo "manifest_list_exists=$manifest_list_exists" >> $GITHUB_OUTPUT
39+
- name: Parse Architecture Specific Image Manifest Digests
40+
id: image_manifest_metadata
41+
run: |
42+
manifest_list_exists="$(
43+
if regctl manifest get "${IMAGE}" --format raw-body --require-list -v panic &> /dev/null; then
44+
echo true
45+
else
46+
echo false
47+
fi
48+
)"
49+
echo "manifest_list_exists=$manifest_list_exists"
50+
echo "manifest_list_exists=$manifest_list_exists" >> $GITHUB_OUTPUT
5151
52-
amd64_sha="$(regctl image digest "${IMAGE}" --platform linux/amd64 || echo '')"
53-
arm64_sha="$(regctl image digest "${IMAGE}" --platform linux/arm64 || echo '')"
54-
echo "amd64_sha=$amd64_sha"
55-
echo "amd64_sha=$amd64_sha" >> $GITHUB_OUTPUT
56-
echo "arm64_sha=$arm64_sha"
57-
echo "arm64_sha=$arm64_sha" >> $GITHUB_OUTPUT
52+
amd64_sha="$(regctl image digest "${IMAGE}" --platform linux/amd64 || echo '')"
53+
arm64_sha="$(regctl image digest "${IMAGE}" --platform linux/arm64 || echo '')"
54+
echo "amd64_sha=$amd64_sha"
55+
echo "amd64_sha=$amd64_sha" >> $GITHUB_OUTPUT
56+
echo "arm64_sha=$arm64_sha"
57+
echo "arm64_sha=$arm64_sha" >> $GITHUB_OUTPUT
5858
59-
- name: Scan AMD64 Image digest
60-
id: sbom_action_amd64
61-
if: steps.image_manifest_metadata.outputs.amd64_sha != ''
62-
uses: ./security-actions/scan-docker-image
63-
with:
64-
asset_prefix: kong-gateway-dev-linux-amd64
65-
image: ${{env.IMAGE}}@${{ steps.image_manifest_metadata.outputs.amd64_sha }}
66-
skip_cis_scan: false
67-
trivy_db_cache: Kong/trivy-db-mirror@master
68-
trivy_db_cache_token: ${{ secrets.SECURITY_BOT_PSA_PAT }}
69-
by_cve: true
59+
- name: Scan AMD64 Image digest
60+
id: sbom_action_amd64
61+
if: steps.image_manifest_metadata.outputs.amd64_sha != ''
62+
uses: ./security-actions/scan-docker-image
63+
with:
64+
asset_prefix: kong-gateway-dev-linux-amd64
65+
image: ${{env.IMAGE}}@${{ steps.image_manifest_metadata.outputs.amd64_sha }}
66+
skip_cis_scan: false
67+
trivy_db_cache: Kong/trivy-db-mirror@master
68+
trivy_db_cache_token: ${{ secrets.SECURITY_BOT_PSA_PAT }}
69+
grype_db_cache: Kong/grype-db-mirror@main
70+
grype_db_cache_token: ${{ secrets.SECURITY_BOT_PSA_PAT }}
71+
by_cve: true
7072

71-
- name: Scan ARM64 Image digest
72-
if: steps.image_manifest_metadata.outputs.manifest_list_exists == 'true' && steps.image_manifest_metadata.outputs.arm64_sha != ''
73-
id: sbom_action_arm64
74-
uses: ./security-actions/scan-docker-image
75-
with:
76-
asset_prefix: test.kong-gateway-dev-linux-arm64
77-
image: ${{env.IMAGE}}@${{ steps.image_manifest_metadata.outputs.arm64_sha }}
78-
upload-sbom-release-assets: true
79-
skip_cis_scan: false
73+
# Should use git cache for grype DB due to AMD64 scan being run first
74+
- name: Scan ARM64 Image digest
75+
if: steps.image_manifest_metadata.outputs.manifest_list_exists == 'true' && steps.image_manifest_metadata.outputs.arm64_sha != ''
76+
id: sbom_action_arm64
77+
uses: ./security-actions/scan-docker-image
78+
with:
79+
asset_prefix: test.kong-gateway-dev-linux-arm64
80+
image: ${{env.IMAGE}}@${{ steps.image_manifest_metadata.outputs.arm64_sha }}
81+
upload-sbom-release-assets: true
82+
skip_cis_scan: false
8083

8184
test-download-sbom:
8285
if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}

‎security-actions/sca/README.md‎

Lines changed: 75 additions & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -49,16 +49,16 @@
4949
#### Global parameters
5050

5151
```yaml
52-
global_severity_cutoff:
53-
description: 'grype/trivy vulnerability severity cutoff'
54-
options:
55-
- 'negligible'
56-
- 'low'
57-
- 'medium'
58-
- 'high'
59-
- 'critical'
60-
global_enforce_build_failure:
61-
description: 'This will enforce the build failure regardless of `fail_build` external input parameter value for a specified `severity_cutoff`'
52+
global_severity_cutoff:
53+
description: "grype/trivy vulnerability severity cutoff"
54+
options:
55+
- "negligible"
56+
- "low"
57+
- "medium"
58+
- "high"
59+
- "critical"
60+
global_enforce_build_failure:
61+
description: "This will enforce the build failure regardless of `fail_build` external input parameter value for a specified `severity_cutoff`"
6262
```
6363
6464
### Required Workflow Permissions
@@ -73,48 +73,54 @@ permissions:
7373
- Inputs **image / dir / file** are mutually exclusive. Any one input is mandatory
7474
7575
```yaml
76-
asset_prefix:
77-
description: 'prefix for generated scan artifacts'
78-
required: false
79-
default: ''
80-
dir:
81-
description: 'Specify a directory to be scanned. This is mutually exclusive to file and image'
82-
required: 'false'
83-
default: ''
84-
file:
85-
description: 'Specify a file to be scanned. This is mutually exclusive to dir and image'
86-
required: 'false'
87-
default: ''
88-
config:
89-
description: 'file path to syft custom configuration'
90-
required: false
91-
fail_build:
92-
description: 'fail the build if the vulnerability is above the severity cutoff'
93-
required: 'false'
94-
default: 'false'
95-
type: choice
96-
options:
97-
- 'true'
98-
- 'false'
99-
github-token:
100-
description: "Authorized secret GitHub Personal Access Token. Defaults to github.token"
101-
required: false
102-
default: ${{ github.token }}
103-
upload-sbom-release-assets:
104-
description: 'specify to only upload sboms to GH release assets.'
105-
required: false
106-
default: false
107-
type: choice
108-
options:
109-
- 'true'
110-
- 'false'
76+
asset_prefix:
77+
description: "prefix for generated scan artifacts"
78+
required: false
79+
default: ""
80+
dir:
81+
description: "Specify a directory to be scanned. This is mutually exclusive to file and image"
82+
required: "false"
83+
default: ""
84+
file:
85+
description: "Specify a file to be scanned. This is mutually exclusive to dir and image"
86+
required: "false"
87+
default: ""
88+
config:
89+
description: "file path to syft custom configuration"
90+
required: false
91+
fail_build:
92+
description: "fail the build if the vulnerability is above the severity cutoff"
93+
required: "false"
94+
default: "false"
95+
type: choice
96+
options:
97+
- "true"
98+
- "false"
99+
github-token:
100+
description: "Authorized secret GitHub Personal Access Token. Defaults to github.token"
101+
required: false
102+
default: ${{ github.token }}
103+
upload-sbom-release-assets:
104+
description: "specify to only upload sboms to GH release assets."
105+
required: false
106+
default: false
107+
type: choice
108+
options:
109+
- "true"
110+
- "false"
111+
grype_db_cache:
112+
description: "GitHub repository containing Grype DB cache (format: owner/repo@ref). Database should be named `db_v*.tar.zst` on the default branch."
113+
required: false
114+
grype_db_cache_token:
115+
description: "Token for accessing `grype_db_cache`."
116+
required: false
111117
```
112118
113119
#### Output specification
114120
115-
- Generates sbom reports in **spdx.json** and **cyclonedx.xml** formats using *syft* on the inputs **image / dir / file**
121+
- Generates sbom reports in **spdx.json** and **cyclonedx.xml** formats using _syft_ on the inputs **image / dir / file**
116122
117-
- Generates cve vulnerability analysis report based on the spdx sbom file using *grype*
123+
- Generates cve vulnerability analysis report based on the spdx sbom file using _grype_
118124
119125
- Uploads all the generated security assets as workflow artifacts and retained based on repo / org settings
120126
@@ -123,14 +129,14 @@ permissions:
123129
#### Output parameters
124130

125131
```yaml
126-
grype-sarif-report:
127-
description: 'vulnerability SARIF report'
128-
grype-json-report:
129-
description: 'vulnerability JSON report'
130-
sbom-spdx-report:
131-
description: 'SBOM spdx report'
132-
sbom-cyclonedx-report:
133-
description: 'SBOM cyclonedx report'
132+
grype-sarif-report:
133+
description: "vulnerability SARIF report"
134+
grype-json-report:
135+
description: "vulnerability JSON report"
136+
sbom-spdx-report:
137+
description: "SBOM spdx report"
138+
sbom-cyclonedx-report:
139+
description: "SBOM cyclonedx report"
134140
```
135141

136142
### Migration Strategy
@@ -153,7 +159,7 @@ We expect application teams to use the advanced configuration of ignore rules wi
153159

154160
To bypass blocking builds during emergency releases/scenarios where CVE fix needs a lot of refactoring during a hotfix:
155161

156-
#### Syft
162+
#### Syft
157163

158164
1. Generate a Syft [Override](https://github.com/anchore/syft?tab=readme-ov-file#configuration) configuration file
159165
2. [Select catalogers](https://github.com/anchore/syft?tab=readme-ov-file#package-cataloger-selection)
@@ -176,12 +182,12 @@ name: SCA Repository Scan
176182
on:
177183
pull_request:
178184
branches:
179-
- main
185+
- main
180186
push:
181187
branches:
182-
- main
188+
- main
183189
tags:
184-
- '*'
190+
- "*"
185191
186192
jobs:
187193
sca:
@@ -193,13 +199,13 @@ jobs:
193199
pull-requests: write
194200
name: Repository Scan
195201
steps:
196-
- uses: actions/checkout@v4
197-
- name: Scan Repository
198-
id: sca_repo
199-
uses: Kong/public-shared-actions/security-actions/sca@main
200-
with:
201-
asset_prefix: <repo-name-slug> #output files prefix
202-
dir: '.' # Path to directory where the repository is checked out
203-
config: .syft.yaml # Custom config for overrides in repository root
204-
fail_build: 'true' # Fail job if critical vulnerabilities are detected
205-
```
202+
- uses: actions/checkout@v4
203+
- name: Scan Repository
204+
id: sca_repo
205+
uses: Kong/public-shared-actions/security-actions/sca@main
206+
with:
207+
asset_prefix: <repo-name-slug> #output files prefix
208+
dir: "." # Path to directory where the repository is checked out
209+
config: .syft.yaml # Custom config for overrides in repository root
210+
fail_build: "true" # Fail job if critical vulnerabilities are detected
211+
```

0 commit comments

Comments
 (0)