peetandClaude Fable 5
0807dc6434
- podman-build-publish: reverted to pure build+push (v8 behavior) — the Trivy gate briefly embedded in v10 moves to an explicit action instead. - trivy-scan (new): scans a registry image ref, fails on fixable HIGH/CRITICAL findings; jobs pin it to amd64 runners. - podman-promote (new): server-side retag via skopeo copy --all — releases promote the scanned sha-<commit> candidate instead of rebuilding. - deploy-prod (new): shared deploy body for the *.podman repos (with the BatchMode/IdentitiesOnly ssh flags only two of the four copies had). - README: documents the standard build.yml/release.yml pipeline; refs standardized on public/actions. Plan: noctrl.podman tmp/WORKFLOW_REWRITE_PLAN.md. Release as v11. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg
55 lines
1.8 KiB
YAML
55 lines
1.8 KiB
YAML
name: Trivy Scan
|
|
description: >
|
|
Scan an image in registry.noctrl.eu for vulnerabilities and fail on findings.
|
|
Pulls the image directly from the registry — no podman storage involved.
|
|
Pin the calling job to an amd64 runner (never arm); vulnerability results are
|
|
package-based and arch-independent, so scanning a multi-arch ref once
|
|
(trivy picks the host platform's variant) covers all variants.
|
|
|
|
inputs:
|
|
image-name:
|
|
description: Repository/image name path, for example noctrl/gitea-runner
|
|
required: true
|
|
tag:
|
|
description: Tag to scan, for example sha-abc123 or sha-abc123-amd64
|
|
required: true
|
|
severity:
|
|
description: Comma-separated Trivy severities that fail the scan.
|
|
required: false
|
|
default: HIGH,CRITICAL
|
|
registry-username:
|
|
description: Registry username for pulling the image.
|
|
required: true
|
|
registry-password:
|
|
description: Registry password for pulling the image.
|
|
required: true
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- id: scan
|
|
shell: bash
|
|
env:
|
|
TRIVY_USERNAME: ${{ inputs.registry-username }}
|
|
TRIVY_PASSWORD: ${{ inputs.registry-password }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
if ! command -v trivy >/dev/null 2>&1; then
|
|
echo "ERROR: trivy not found on this runner (needs noctrl/gitea-runner >= v9)" >&2
|
|
exit 1
|
|
fi
|
|
|
|
image_ref="registry.noctrl.eu/${{ inputs.image-name }}:${{ inputs.tag }}"
|
|
|
|
# --ignore-unfixed: unfixed base-image CVEs are unactionable and would
|
|
# perma-block builds; the gate is on vulnerabilities with a fix.
|
|
echo "Scanning ${image_ref} (fail on: ${{ inputs.severity }}, fixed only)"
|
|
trivy image \
|
|
--scanners vuln \
|
|
--severity "${{ inputs.severity }}" \
|
|
--ignore-unfixed \
|
|
--exit-code 1 \
|
|
--no-progress \
|
|
"${image_ref}"
|