From 85bc6574dcfe83968a026b25b261f5a434953a85 Mon Sep 17 00:00:00 2001 From: grieshaber Date: Wed, 13 Nov 2024 13:35:53 +0100 Subject: [PATCH 1/2] Update github-action versions --- .github/workflows/docker-build.yml | 17 ++++++++--------- .github/workflows/helm-lint-test.yaml | 16 ++++++++-------- .github/workflows/release.yml | 8 ++++---- .github/workflows/stale.yml | 2 +- .github/workflows/trivy-scan.yml | 9 ++++----- Dockerfile | 2 +- 6 files changed, 26 insertions(+), 28 deletions(-) diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml index de3e0f2..d4d043e 100644 --- a/.github/workflows/docker-build.yml +++ b/.github/workflows/docker-build.yml @@ -20,20 +20,20 @@ jobs: steps: - name: Checkout - uses: actions/checkout@v2 + uses: actions/checkout@v4 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v1 + uses: docker/setup-buildx-action@v3 - name: Login to GitHub Container Registry - uses: docker/login-action@v1 + uses: docker/login-action@v3 with: registry: ${{ env.REGISTRY }} username: ${{ github.repository_owner }} password: ${{ secrets.GITHUB_TOKEN }} - name: Build and push - uses: docker/build-push-action@v2 + uses: docker/build-push-action@v6 with: context: . platforms: linux/amd64 @@ -41,14 +41,13 @@ jobs: tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-helper:latest - name: Run Trivy vulnerability scanner - uses: aquasecurity/trivy-action@master + uses: aquasecurity/trivy-action@0.28.0 with: - image-ref: '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-helper:latest' - format: 'template' - template: '@/contrib/sarif.tpl' + image-ref: '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-helper:${{ github.sha }}' + format: 'sarif' output: 'trivy-results.sarif' - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v1 + uses: github/codeql-action/upload-sarif@v3 with: sarif_file: 'trivy-results.sarif' diff --git a/.github/workflows/helm-lint-test.yaml b/.github/workflows/helm-lint-test.yaml index 60184d6..4dabb9d 100644 --- a/.github/workflows/helm-lint-test.yaml +++ b/.github/workflows/helm-lint-test.yaml @@ -10,24 +10,24 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@v2 + uses: actions/checkout@v4 with: fetch-depth: 0 - name: Set up Helm - uses: azure/setup-helm@v1 + uses: azure/setup-helm@v4.2.0 with: - version: v3.5.1 + version: v3.14.4 # Python is required because `ct lint` runs Yamale (https://github.com/23andMe/Yamale) and # yamllint (https://github.com/adrienverge/yamllint) which require Python - - name: Set up Python - uses: actions/setup-python@v2 + - uses: actions/setup-python@v5 with: - python-version: 3.7 + python-version: '3.x' + check-latest: true - name: Set up chart-testing - uses: helm/chart-testing-action@v2.1.0 + uses: helm/chart-testing-action@v2.7.0 - name: Run chart-testing (list-changed) id: list-changed @@ -41,7 +41,7 @@ jobs: run: ct lint --config .github/ct.yaml - name: Create kind cluster - uses: helm/kind-action@v1.2.0 + uses: helm/kind-action@v1.10.0 if: steps.list-changed.outputs.changed == 'true' - name: Run chart-testing (install) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 44dbb05..783c0ff 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -21,12 +21,12 @@ jobs: git config user.name "$GITHUB_ACTOR" git config user.email "$GITHUB_ACTOR@users.noreply.github.com" - - name: Install Helm - uses: azure/setup-helm@v1 + - name: Set up Helm + uses: azure/setup-helm@v4.2.0 with: - version: v3.5.1 + version: v3.14.4 - name: Run chart-releaser - uses: helm/chart-releaser-action@v1.1.0 + uses: helm/chart-releaser-action@v1.6.0 env: CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}" \ No newline at end of file diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index b6abb9e..9d13f39 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -8,7 +8,7 @@ jobs: stale: runs-on: ubuntu-latest steps: - - uses: actions/stale@v3 + - uses: actions/stale@v9 with: repo-token: ${{ secrets.GITHUB_TOKEN }} stale-issue-message: This issue has been marked as stale because it has been open for 30 days with no activity. It will be automatically closed in 10 days if no further activity occurs. diff --git a/.github/workflows/trivy-scan.yml b/.github/workflows/trivy-scan.yml index bc5a78c..716e842 100644 --- a/.github/workflows/trivy-scan.yml +++ b/.github/workflows/trivy-scan.yml @@ -12,21 +12,20 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v2 + uses: actions/checkout@v4 - name: Build an image from Dockerfile run: | docker build -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-helper:${{ github.sha }} . - name: Run Trivy vulnerability scanner - uses: aquasecurity/trivy-action@master + uses: aquasecurity/trivy-action@0.28.0 with: image-ref: '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-helper:${{ github.sha }}' - format: 'template' - template: '@/contrib/sarif.tpl' + format: 'sarif' output: 'trivy-results.sarif' - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v1 + uses: github/codeql-action/upload-sarif@v3 with: sarif_file: 'trivy-results.sarif' \ No newline at end of file diff --git a/Dockerfile b/Dockerfile index 8174050..0282ac0 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM alpine:3.19 +FROM alpine:3.20 RUN apk add yq curl --no-cache From 83658cf7cec82e4a592888c97085bdad8b913378 Mon Sep 17 00:00:00 2001 From: grieshaber Date: Wed, 13 Nov 2024 13:42:56 +0100 Subject: [PATCH 2/2] Use another trivy db image --- .github/workflows/docker-build.yml | 3 +++ .github/workflows/trivy-scan.yml | 3 +++ 2 files changed, 6 insertions(+) diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml index d4d043e..0272bc2 100644 --- a/.github/workflows/docker-build.yml +++ b/.github/workflows/docker-build.yml @@ -42,6 +42,9 @@ jobs: - name: Run Trivy vulnerability scanner uses: aquasecurity/trivy-action@0.28.0 + env: + TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db + TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db with: image-ref: '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-helper:${{ github.sha }}' format: 'sarif' diff --git a/.github/workflows/trivy-scan.yml b/.github/workflows/trivy-scan.yml index 716e842..62a1bad 100644 --- a/.github/workflows/trivy-scan.yml +++ b/.github/workflows/trivy-scan.yml @@ -20,6 +20,9 @@ jobs: - name: Run Trivy vulnerability scanner uses: aquasecurity/trivy-action@0.28.0 + env: + TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db + TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db with: image-ref: '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-helper:${{ github.sha }}' format: 'sarif'