feat(helm)!: Update Helm release kube-prometheus-stack to v67 #2440
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: Scan Containers | |
| on: | |
| pull_request: | |
| branches: | |
| - main | |
| - next | |
| paths: | |
| - "cluster/**.yaml" | |
| workflow_dispatch: | |
| jobs: | |
| detect-file-changes: | |
| name: Detect File Changes | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: dorny/paths-filter@v2 | |
| id: filter | |
| with: | |
| list-files: json | |
| filters: | | |
| yaml: | |
| - added|modified: "**.yaml" | |
| - added|modified: "**.yml" | |
| outputs: | |
| yaml_files: ${{ steps.filter.outputs.yaml_files }} | |
| detect-containers: | |
| name: Detect Containers | |
| runs-on: ubuntu-24.04 | |
| needs: detect-file-changes | |
| strategy: | |
| matrix: | |
| file: ${{ fromJSON(needs.detect-file-changes.outputs.yaml_files) }} | |
| steps: | |
| - name: Generate Token | |
| uses: actions/create-github-app-token@v1 | |
| id: generate-token | |
| with: | |
| app-id: "${{ secrets.BOT_APP_ID }}" | |
| private-key: "${{ secrets.BOT_APP_PRIVATE_KEY }}" | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| token: "${{ steps.generate-token.outputs.token }}" | |
| fetch-depth: 0 | |
| - name: Install Jo | |
| run: | | |
| sudo apt-get install jo | |
| - name: Detect Containers in Files | |
| id: containers | |
| run: | | |
| containers=$(.github/scripts/container-parser.sh --file "${{ matrix.file }}") | |
| echo "{\"containers\": ${containers}}" > containers.json | |
| outputs: | |
| containers: ${{ steps.containers.outputs.containers }} | |
| scan-containers: | |
| name: Scan Containers | |
| runs-on: ubuntu-24.04 | |
| needs: detect-containers | |
| strategy: | |
| matrix: ${{ fromJSON(needs.detect-containers.outputs.containers) }} | |
| fail-fast: false | |
| steps: | |
| - name: Generate Token | |
| uses: actions/create-github-app-token@v1 | |
| id: generate-token | |
| with: | |
| app-id: "${{ secrets.BOT_APP_ID }}" | |
| private-key: "${{ secrets.BOT_APP_PRIVATE_KEY }}" | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| token: "${{ steps.generate-token.outputs.token }}" | |
| fetch-depth: 0 | |
| - name: Scan Container | |
| uses: aquasecurity/[email protected] | |
| with: | |
| image-ref: ${{ matrix.containers }} | |
| vuln-type: os,library | |
| severity: CRITICAL,HIGH | |
| format: template | |
| template: "@/contrib/sarif.tpl" | |
| output: trivy-results.sarif | |
| - name: Upload Trivy scan results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@v2 | |
| with: | |
| sarif_file: trivy-results.sarif |