Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement GitHub Actions workflow for scanning Docker images (Ref: #301) #317

Merged
merged 1 commit into from
Nov 20, 2024
Merged

Implement GitHub Actions workflow for scanning Docker images (Ref: #301) #317

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
55 changes: 55 additions & 0 deletions .github/workflows/docker-scan.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,55 @@
name: Build and Scan Docker Images

on:
workflow_dispatch:
push:
branches:
- main

jobs:
build-and-scan:
name: ${{ matrix.folder }}
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
folder: ["curl", "httpd", "locust", "nginx", "wireshark"]

steps:
- name: Checkout Repository
uses: actions/[email protected]

- name: Log in to Docker Hub
# Required for Docker Scout
uses: docker/[email protected]
with:
username: ${{ secrets.DOCKER_USERNAME }}
password: ${{ secrets.DOCKER_PASSWORD }}

- name: Build Docker Image
run: |
FILES=$(find ./${{ matrix.folder }} -type f -iname 'dockerfile*')
if [ -z "$FILES" ]; then
echo "No Dockerfiles found in folder: ${{ matrix.folder }}. Skipping build."
exit 1
fi

for FILE in $FILES; do
IMAGE_NAME="${{ matrix.folder }}-$(basename $FILE | tr '[:upper:]' '[:lower:]' | tr -cd '[:alnum:]-')"
echo "Building Docker image: $IMAGE_NAME using $FILE"
docker build -t $IMAGE_NAME -f $FILE ./${{ matrix.folder }}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This logic has a flaw @hawazyn : If finding a Dockerfile in a subdirectory (such as nginx/fulltest), the subsequent docker buildcommand does not switch CWD to that subdirectory, leading to files not being found. IMO this is the reason for the persistent CI failure, e.g., here. Please let me know whether you'd provide a PR to fix for this or whether I should do to get CI status back to green.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey @baentsch, I’ll look into this issue today and provide a fix PR.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

On closer look, I'm wondering whether this can be improved in general: Am I right thinking that this job duplicates the tasks in the other CI workflows (building images)? Wouldn't it be better in general to only add a scan step to each separate image build as and when done anyway? This would be much less resource intensive. OK for you to change things this way? This would also do away with this separate file entirely (and thus automatically solve the problem above): OK for you @hawazyn ?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree with combining the scan with image builds for efficiency. Should I proceed to apply the changes and remove the docker-scan file?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If you have time for that, that would be welcome.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No urgency -- would you mind if I did it to save you the hassle and let you focus on what you're already doing?

Copy link
Contributor Author

@hawazyn hawazyn Dec 27, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I sincerely apologize for being unable to address the workflow scanning integration as planned due to unforeseen circumstances. Unfortunately, I will be unavailable for the next month and unable to take on new tasks or make additional changes during this time. However, I am committed to finalizing PR #338 to ensure the current work is completed before my absence.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @baentsch, Just a gentle reminder about the workflow logic issue mentioned earlier. Unfortunately, I won’t be able to take it on, so I just wanted to ensure it’s still on the radar.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the reminder @hayyaaf . I take it that I then should do a fix for the above?! No problem from my side -- just needed to know.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You’re welcome! I truly appreciate your efforts and thank you in advance.

echo "IMAGE_NAME=$IMAGE_NAME" >> $GITHUB_ENV
done

- name: Scan Docker Image
uses: docker/[email protected]
with:
image: ${{ env.IMAGE_NAME }}
command: cves,recommendations
sarif-file: sarif.output.json

- name: Export the Results
uses: actions/[email protected]
with:
name: docker-scout-sarif-${{ matrix.folder }}
path: sarif.output.json