Skip to content

Commit 7a0addd

Browse files
NiccoloFeiNiccoloFei
authored
ci: add a composite action for security scanners (#339)
Add a composite GitHub Action that wraps all the security scanners used to analyze CloudNativePG container images. Closes #338 Signed-off-by: Niccolò Fei <[email protected]>
1 parent 6fbb0e5 commit 7a0addd

File tree

3 files changed

+141
-38
lines changed

3 files changed

+141
-38
lines changed

‎.github/actions/security-scans/README.md‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
# Security Scans Action
2+
3+
This composite GitHub Action wraps all the security scanners used to
4+
analyze CloudNativePG container images.
5+
6+
---
7+
8+
## Requirements
9+
10+
This composite action relies on the calling workflow’s `GITHUB_TOKEN`.
11+
Make sure your calling workflow includes:
12+
13+
```
14+
permissions:
15+
contents: read
16+
packages: read
17+
security-events: write # required for SARIF upload
18+
```
19+
20+
---
21+
22+
## Security scanners
23+
24+
- [Dockle](https://github.com/goodwithtech/dockle):
25+
- Best-practice and configuration checks.
26+
27+
- [Snyk](https://github.com/snyk/actions):
28+
- Detects vulnerabilities in OS packages, libraries, and dependencies.
29+
- Generates a `snyk.sarif` that gets uploaded to GitHub Code Scanning
30+
31+
---
32+
33+
## Inputs
34+
35+
| Name | Description | Required | Default |
36+
| ---------------- | -------------------------------------------------- | --------- | -------------- |
37+
| `image` | The image to scan (e.g. `ghcr.io/org/image:tag`) | ✅ Yes | — |
38+
| `registry_user` | The user used to pull the image | ✅ Yes | — |
39+
| `registry_token` | The token used to pull the image | ✅ Yes | — |
40+
| `snyk_token` | The Snyk authentication token | ❌ No | — |
41+
| `dockerfile` | Path to the image’s Dockerfile (for Snyk scanning) | ❌ No | `./Dockerfile` |
42+
43+
Note:
44+
- If a `snyk_token` is not provided, Snyk scans won't be performed.
45+
- The `dockerfile` path is currently only required by Snyk.
46+
47+
---
48+
49+
## Usage
50+
51+
Example workflow:
52+
53+
```
54+
jobs:
55+
security-scan:
56+
runs-on: ubuntu-latest
57+
permissions:
58+
contents: read
59+
packages: read
60+
security-events: write
61+
steps:
62+
- uses: actions/checkout@v5
63+
- name: Security checks
64+
uses: cloudnative-pg/postgres-containers/.github/actions/security-scans@main
65+
with:
66+
image: ghcr.io/org/image:tag
67+
registry_user: ${{ github.actor }}
68+
registry_token: ${{ secrets.GITHUB_TOKEN }}
69+
snyk_token: ${{ secrets.SNYK_TOKEN }}
70+
dockerfile: "./Dockerfile"
71+
```

‎.github/actions/security-scans/action.yml‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
name: Security Scans
2+
description: Security Scans
3+
inputs:
4+
image:
5+
description: "The image to scan"
6+
required: true
7+
registry_user:
8+
description: "The user used to pull the image"
9+
required: true
10+
registry_token:
11+
description: "The token used to pull the image"
12+
required: true
13+
snyk_token:
14+
description: "The snyk authentication token"
15+
required: false
16+
dockerfile:
17+
description: "The image's Dockerfile"
18+
required: false
19+
default: './Dockerfile'
20+
21+
runs:
22+
using: composite
23+
steps:
24+
- name: Log in to the GitHub Container registry
25+
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
26+
with:
27+
registry: ghcr.io
28+
username: ${{ inputs.registry_user }}
29+
password: ${{ inputs.registry_token }}
30+
31+
- name: Dockle
32+
uses: erzz/dockle-action@69369bc745ee29813f730231a821bcd4f71cd290 # v1
33+
with:
34+
image: "${{ inputs.image }}"
35+
exit-code: '1'
36+
failure-threshold: WARN
37+
accept-keywords: key
38+
accept-filenames: usr/share/postgresql-common/pgdg/apt.postgresql.org.asc,etc/ssl/private/ssl-cert-snakeoil.key,usr/local/lib/python3.9/dist-packages/azure/core/settings.py,usr/local/lib/python3.11/dist-packages/azure/core/settings.py,usr/local/lib/python3.13/dist-packages/azure/core/settings.py
39+
40+
- name: Snyk
41+
uses: snyk/actions/docker@master
42+
id: snyk
43+
if: ${{ inputs.snyk_token != '' }}
44+
# Snyk can be used to break the build when it detects vulnerabilities.
45+
# In this case we want to upload the issues to GitHub Code Scanning.
46+
continue-on-error: true
47+
env:
48+
SNYK_TOKEN: ${{ inputs.snyk_token }}
49+
with:
50+
image: "${{ inputs.image }}"
51+
args: --severity-threshold=high --file=${{ inputs.dockerfile }}
52+
53+
- name: Replace sarif security-severity invalid values
54+
if: ${{ steps.snyk.conclusion == 'success' }}
55+
shell: bash
56+
run: |
57+
sed -i 's/"security-severity": "null"/"security-severity": "0"/g' snyk.sarif
58+
sed -i 's/"security-severity": "undefined"/"security-severity": "0"/g' snyk.sarif
59+
60+
- name: Upload result to GitHub Code Scanning
61+
uses: github/codeql-action/upload-sarif@f443b600d91635bebf5b0d9ebc620189c0d6fba5 # v4
62+
if: ${{ steps.snyk.conclusion == 'success' }}
63+
with:
64+
sarif_file: snyk.sarif

‎.github/workflows/bake_targets.yml‎

Lines changed: 6 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -143,46 +143,14 @@ jobs:
143143
- name: Checkout Code
144144
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
145145

146-
- name: Log in to the GitHub Container registry
147-
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
148-
with:
149-
registry: ghcr.io
150-
username: ${{ github.actor }}
151-
password: ${{ secrets.GITHUB_TOKEN }}
152-
153-
- name: Dockle
154-
uses: erzz/dockle-action@69369bc745ee29813f730231a821bcd4f71cd290 # v1
155-
with:
156-
image: ${{ matrix.image }}
157-
exit-code: '1'
158-
failure-threshold: WARN
159-
accept-keywords: key
160-
accept-filenames: usr/share/postgresql-common/pgdg/apt.postgresql.org.asc,etc/ssl/private/ssl-cert-snakeoil.key,usr/local/lib/python3.9/dist-packages/azure/core/settings.py,usr/local/lib/python3.11/dist-packages/azure/core/settings.py,usr/local/lib/python3.13/dist-packages/azure/core/settings.py
161-
162-
- name: Snyk
163-
uses: snyk/actions/docker@master
164-
id: snyk
165-
if: ${{ env.SNYK_TOKEN != '' }}
166-
# Snyk can be used to break the build when it detects vulnerabilities.
167-
# In this case we want to upload the issues to GitHub Code Scanning.
168-
continue-on-error: true
169-
env:
170-
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
146+
- name: Security checks
147+
uses: ./.github/actions/security-scans
171148
with:
172149
image: "${{ matrix.image }}"
173-
args: --severity-threshold=high --file=Dockerfile
174-
175-
- name: Replace sarif security-severity invalid values
176-
if: ${{ steps.snyk.conclusion == 'success' }}
177-
run: |
178-
sed -i 's/"security-severity": "null"/"security-severity": "0"/g' snyk.sarif
179-
sed -i 's/"security-severity": "undefined"/"security-severity": "0"/g' snyk.sarif
180-
181-
- name: Upload result to GitHub Code Scanning
182-
uses: github/codeql-action/upload-sarif@f443b600d91635bebf5b0d9ebc620189c0d6fba5 # v4
183-
if: ${{ steps.snyk.conclusion == 'success' }}
184-
with:
185-
sarif_file: snyk.sarif
150+
registry_user: ${{ github.actor }}
151+
registry_token: ${{ secrets.GITHUB_TOKEN }}
152+
snyk_token: ${{ secrets.SNYK_TOKEN }}
153+
dockerfile: "./Dockerfile"
186154

187155
# Use the metadata generated in the `testbuild` step to find all the images
188156
# that have been built. We copy them one by one to the production registry

0 commit comments

Comments
 (0)