Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement GitHub Actions workflow for scanning Docker images (Ref: #301) #317

Merged
merged 1 commit into from
Nov 20, 2024
Merged

Implement GitHub Actions workflow for scanning Docker images (Ref: #301) #317

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
55 changes: 55 additions & 0 deletions .github/workflows/docker-scan.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,55 @@
name: Build and Scan Docker Images

on:
workflow_dispatch:
push:
branches:
- main

jobs:
build-and-scan:
name: ${{ matrix.folder }}
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
folder: ["curl", "httpd", "locust", "nginx", "wireshark"]

steps:
- name: Checkout Repository
uses: actions/checkout@v4.2.2

- name: Log in to Docker Hub
# Required for Docker Scout
uses: docker/login-action@v3.3.0
with:
username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_PASSWORD }}

- name: Build Docker Image
run: |
FILES=$(find ./${{ matrix.folder }} -type f -iname 'dockerfile*')
if [ -z "$FILES" ]; then
echo "No Dockerfiles found in folder: ${{ matrix.folder }}. Skipping build."
exit 1
fi

for FILE in $FILES; do
IMAGE_NAME="${{ matrix.folder }}-$(basename $FILE | tr '[:upper:]' '[:lower:]' | tr -cd '[:alnum:]-')"
echo "Building Docker image: $IMAGE_NAME using $FILE"
docker build -t $IMAGE_NAME -f $FILE ./${{ matrix.folder }}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This logic has a flaw @Hawazyn : If finding a Dockerfile in a subdirectory (such as nginx/fulltest), the subsequent docker buildcommand does not switch CWD to that subdirectory, leading to files not being found. IMO this is the reason for the persistent CI failure, e.g., here. Please let me know whether you'd provide a PR to fix for this or whether I should do to get CI status back to green.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey @baentsch, I’ll look into this issue today and provide a fix PR.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

On closer look, I'm wondering whether this can be improved in general: Am I right thinking that this job duplicates the tasks in the other CI workflows (building images)? Wouldn't it be better in general to only add a scan step to each separate image build as and when done anyway? This would be much less resource intensive. OK for you to change things this way? This would also do away with this separate file entirely (and thus automatically solve the problem above): OK for you @Hawazyn ?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree with combining the scan with image builds for efficiency. Should I proceed to apply the changes and remove the docker-scan file?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If you have time for that, that would be welcome.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I’ll work on this, but I kindly ask for some additional time as I am currently managing other priorities, in addition to work related to Docker files and their documentation. I truly appreciate your patience and understanding, and I will keep you updated as I make progress.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No urgency -- would you mind if I did it to save you the hassle and let you focus on what you're already doing?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for offering to help! I can see you already have a great deal to manage at the moment, and while I am perfectly happy to continue with this, I do not wish to add to your workload unnecessarily. My tasks are quite manageable, so please let me know how you would prefer to proceed. I am happy to adjust to whatever suits you best.

Copy link
Contributor Author

@Hawazyn Hawazyn Dec 27, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I sincerely apologize for being unable to address the workflow scanning integration as planned due to unforeseen circumstances. Unfortunately, I will be unavailable for the next month and unable to take on new tasks or make additional changes during this time. However, I am committed to finalizing PR #338 to ensure the current work is completed before my absence.

If there are further issues or adjustments needed, I kindly request your assistance to ensure a smooth resolution. I deeply appreciate your understanding and support.

echo "IMAGE_NAME=$IMAGE_NAME" >> $GITHUB_ENV
done

- name: Scan Docker Image
uses: docker/scout-action@v1.15.1
with:
image: ${{ env.IMAGE_NAME }}
command: cves,recommendations
sarif-file: sarif.output.json

- name: Export the Results
uses: actions/upload-artifact@v4.4.3
with:
name: docker-scout-sarif-${{ matrix.folder }}
path: sarif.output.json