From 537814ff7ad02ad49f795b64fba240b7956ef920 Mon Sep 17 00:00:00 2001
From: Derek Nola <derek.nola@suse.com>
Date: Tue, 3 Sep 2024 11:22:09 -0700
Subject: [PATCH 1/2] Add trivy GHA workflow for scanning rke2-runtime image

Signed-off-by: Derek Nola <derek.nola@suse.com>
---
 .github/workflows/trivy.yaml | 73 ++++++++++++++++++++++++++++++++++++
 scripts/build-image-runtime  |  2 +-
 2 files changed, 74 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/trivy.yaml

diff --git a/.github/workflows/trivy.yaml b/.github/workflows/trivy.yaml
new file mode 100644
index 0000000000..4c23d1e3c5
--- /dev/null
+++ b/.github/workflows/trivy.yaml
@@ -0,0 +1,73 @@
+name: PR Comment Triggered Trivy Scan
+
+on:
+  issue_comment:
+    types: [created]
+
+jobs:
+  trivy_scan:
+    if: github.event.issue.pull_request && github.event.comment.body == '/trivy' && github.event.issue.state == 'open'
+    runs-on: ubuntu-latest
+    # runs-on: runs-on,runner=8cpu-linux-x64,run-id=${{ github.run_id }}
+    permissions:
+      pull-requests: write
+    env:
+      GH_TOKEN: ${{ github.token }}
+    steps:
+    - name: Checkout PR code
+      uses: actions/checkout@v4
+      with:
+        ref: refs/pull/${{ github.event.issue.number }}/head
+    
+    - name: Comment Status on PR
+      run: |
+        gh repo set-default ${{ github.repository }}
+        gh pr comment ${{ github.event.issue.number }} -b ":construction: Running Trivy scan on PR :construction: "
+    
+    # We don't care about the go version, as we only use it to capture ENV vars
+    - name: Install Go
+      uses: ./.github/actions/setup-go
+    
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+    
+    - name: Build RKE2 Image
+      id: build-image
+      run: |
+        SKIP_WINDOWS=true make build-image-runtime
+        TAG=$(docker images --format "{{.Repository}}:{{.Tag}} {{.CreatedAt}}" | grep "rancher/rke2-runtime" | sort -k2 -r | head -n1 | awk '{print $1}')
+        echo "TAG=${TAG}" >> "$GITHUB_OUTPUT"
+
+    - name: Run Trivy on image
+      uses: aquasecurity/trivy-action@0.24.0
+      with:
+        image-ref: '${{ steps.build-image.outputs.TAG }}'
+        format: 'table'
+        severity: "HIGH,CRITICAL"
+        output: "trivy-image-report.txt"
+    
+    - name: Run Trivy on filesystem
+      uses: aquasecurity/trivy-action@0.24.0
+      with:
+        scan-type: 'fs'
+        scan-ref: '.'
+        severity: "HIGH,CRITICAL"
+        output: "trivy-fs-report.txt"
+    
+    - name: Add Trivy Report to PR
+      run: |
+        sudo chown runner:runner trivy-image-report.txt trivy-fs-report.txt
+        cat trivy-image-report.txt trivy-fs-report.txt > trivy-report.txt
+        if [ -s trivy-report.txt ] && [ -n "$(grep -v '^\s*$' trivy-report.txt)" ]; then
+          echo '```' | cat - trivy-report.txt > temp && mv temp trivy-report.txt
+          echo '```' >> trivy-report.txt
+          gh issue comment ${{ github.event.issue.number }} --edit-last -F trivy-report.txt
+        else
+          echo ':star2: No High or Critical CVEs Found :star2:' > trivy-report.txt
+          gh issue comment ${{ github.event.issue.number }} --edit-last -F trivy-report.txt
+        fi
+    
+    - name: Report Failure
+      if: ${{ failure() }}
+      run: |
+        gh issue comment ${{ github.event.issue.number }} --edit-last -b ":x: Trivy scan action failed, check logs :x:"
\ No newline at end of file
diff --git a/scripts/build-image-runtime b/scripts/build-image-runtime
index c11896735e..ed8f143d0e 100755
--- a/scripts/build-image-runtime
+++ b/scripts/build-image-runtime
@@ -18,7 +18,7 @@ DOCKER_BUILDKIT=${DOCKER_BUILDKIT:-1} docker image build \
     --file Dockerfile \
     .
 
-if [ "${GOARCH}" != "s390x" ] && [ "${GOARCH}" != "arm64" ]; then
+if [ "${GOARCH}" != "s390x" ] && [ "${GOARCH}" != "arm64" ] && [ -z "$SKIP_WINDOWS" ]; then
   DOCKER_BUILDKIT=${DOCKER_BUILDKIT:-1} docker image build \
       --build-arg TAG=${VERSION} \
       --build-arg KUBERNETES_VERSION=${KUBERNETES_VERSION} \

From a2acf4e9cf6bb0dc0672becddd6b03de6c4e86d4 Mon Sep 17 00:00:00 2001
From: Derek Nola <derek.nola@suse.com>
Date: Wed, 11 Sep 2024 13:10:15 -0700
Subject: [PATCH 2/2] Use customer runners

Signed-off-by: Derek Nola <derek.nola@suse.com>
---
 .github/workflows/trivy.yaml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/trivy.yaml b/.github/workflows/trivy.yaml
index 4c23d1e3c5..7a9d37e460 100644
--- a/.github/workflows/trivy.yaml
+++ b/.github/workflows/trivy.yaml
@@ -7,8 +7,7 @@ on:
 jobs:
   trivy_scan:
     if: github.event.issue.pull_request && github.event.comment.body == '/trivy' && github.event.issue.state == 'open'
-    runs-on: ubuntu-latest
-    # runs-on: runs-on,runner=8cpu-linux-x64,run-id=${{ github.run_id }}
+    runs-on: runs-on,runner=8cpu-linux-x64,run-id=${{ github.run_id }}
     permissions:
       pull-requests: write
     env: