scan-images.yaml

name: Scan images
on:
  schedule:
  # every day at 1:12AM UTC
  - cron: '12 1 * * *'
  workflow_dispatch:

jobs:
  scan-images:
    name: Scan images in bundle
    strategy:
      matrix:
        # specfy location of bundle(s) to be scanned
        bundle:
          - releases/1.8/stable/kubeflow
          - releases/1.9/stable
          - releases/latest/edge
    runs-on: ubuntu-20.04
    steps:
      # Ideally we'd use self-hosted runners, but this effort is still not stable
      # This action will remove unused software (dotnet, haskell, android libs, codeql,
      # and docker images) from the GH runner, which will liberate around 60 GB of storage
      # distributed in 40GB for root and around 20 for a mnt point.
      - name: Maximise GH runner space
        uses: easimon/maximize-build-space@v7
        with:
          root-reserve-mb: 29696
          remove-dotnet: 'true'
          remove-haskell: 'true'
          remove-android: 'true'
          remove-codeql: 'true'
          remove-docker-images: 'true'

      - name: Checkout
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Setup tools
        id: setup
        run: |
          sudo snap install yq
          echo "date=$(date '+%Y-%m-%d-%H-%M-%S')" >> $GITHUB_OUTPUT

      - name: Checkout kubeflow-ci
        uses: actions/checkout@v3
        with:
          repository: canonical/kubeflow-ci.git
          sparse-checkout: scripts/images/
          ref: main
          path: kubeflow-ci

      - name: Get images
        id: images
        run: |
          BUNDLE="${{ matrix.bundle }}"
          BUNDLE_SPLIT=(${BUNDLE//\// })
          RELEASE=${BUNDLE_SPLIT[1]}
          RISK=${BUNDLE_SPLIT[2]}

          pip3 install -r scripts/airgapped/requirements.txt
          python3 scripts/airgapped/get-all-images.py ${{ matrix.bundle }}/bundle.yaml > image_list.txt
          echo "Image list:"
          cat ./image_list.txt
          echo "release_risk=${RELEASE}-${RISK}" >> $GITHUB_OUTPUT

      - name: Scan images
        run: |
          ./kubeflow-ci/scripts/images/scan-images.sh ./image_list.txt
          ./kubeflow-ci/scripts/images/get-summary.py --report-path ./trivy-reports --print-header > scan-summary-${{ steps.setup.outputs.date}}-${{ steps.images.outputs.release_risk }}.csv

      - name: Prepare artifacts
        run: |
          tar zcvf trivy-reports-${{ steps.setup.outputs.date}}-${{ steps.images.outputs.release_risk }}-${{ strategy.job-index }}.tar.gz ./trivy-reports

      - name: Upload Trivy reports
        uses: actions/upload-artifact@v3
        with:
          name: trivy-reports
          path: trivy-reports-${{ steps.setup.outputs.date}}-${{ steps.images.outputs.release_risk }}-${{ strategy.job-index }}.tar.gz
      - name: Upload summary
        uses: actions/upload-artifact@v3
        with:
          name: summary
          path: scan-summary-${{ steps.setup.outputs.date}}-${{ steps.images.outputs.release_risk }}.csv