feat(ci): add cve scanning (#1108)

Closes #1068

.github/scripts/generate-sarif-reports.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+
+[[ "$RUNNER_DEBUG" == 1 ]] && set -x
+[[ -o xtrace ]] && export RUNNER_DEBUG=1
+
+set -eu
+set -o pipefail
+
+function createSarifReports() {
+ local chart="${1?}"
+ mkdir -p reports
+
+ yq -r '.annotations["artifacthub.io/images"]' "$chart/Chart.yaml" |
+ yq -r '.[] | .image' |
+ parallel -P 0 -k generateSarifReport "$chart" "{}" "reports/{#}.sarif.json"
+}
+
+function generateSarifReport() {
+ local chart="${1?}"
+ local image="${2?}"
+ local outFile="${3?}"
+ local locationsJson
+ # shellcheck disable=SC2016
+ locationsJson="$(yq --arg image "$image" -r '.annotations["artifacthub.io/images"] | split("\n")[] | select(contains($image))' "$chart/Chart.yaml" |
+ awk '{print $NF}' |
+ jq -r -c -Rn '[inputs] | map({fullyQualifiedName: .})')"
+ trivy image "$image" -f sarif --quiet --ignore-unfixed | jq -r --argjson locations "$locationsJson" '.runs |= map(.results |= map(.locations |= ([$locations[], .[]])))' >"$outFile"
+}
+export -f generateSarifReport
+
+trivy image --download-db-only
+
+if [[ "$#" == 1 ]] && [[ -d "$1" ]]; then
+ createSarifReports "$1"
+else
+ result=0
+ for chart in charts/*; do
+ [[ "$chart" == "charts/*" ]] && continue
+
+ if ! createSarifReports "$chart"; then
+ result=1
+ fi
+ done
+ exit "$result"
+fi

.github/workflows/scan-for-cves.yaml

@@ -0,0 +1,39 @@
+name: Scan for CVEs
+
+on:
+ schedule:
+ - cron: "0 0 * * *"
+ workflow_dispatch: {}
+
+jobs:
+ getAllCharts:
+ runs-on: ubuntu-latest
+ outputs:
+ charts: ${{ steps.getCharts.outputs.charts }}
+ steps:
+ - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
+
+ - name: Get all charts with their images
+ id: getCharts
+ run: |
+ set -ex
+ set -o pipefail
+ (
+ echo -n charts=
+ for chart in charts/*; do
+ [[ -f "$chart/Chart.yaml" ]] && echo "$chart"
+ done | jq -c -Rn '[inputs]'
+ ) | tee -a "$GITHUB_OUTPUT"
+
+ scanForAndAddressCVEsForChart:
+ runs-on: ubuntu-latest
+ needs: getAllCharts
+ permissions:
+ security-events: write
+ strategy:
+ matrix:
+ chart: ${{ fromJson(needs.getAllCharts.outputs.charts) }}
+ steps:
+ - run: ./.github/scripts/generate-sarif-reports.sh ${{ matrix.chart }}
+ - uses: github/codeql-action/upload-sarif@366883a76d75dcee5428da5c3ae7abf9386e35ac # v3
+ # TODO: github dependency tree?