feat(ci): add image scanning workflow #1161
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
p5
changed the title
p5
changed the title
p5
changed the title
p5
commented
Apr 20, 2024
There was a problem hiding this comment.
IMO we should centralise this configuration in ublue-os/main or somewhere before implementing scanning in other repos. There's nothing bluefin-specific in here, so no need to copy & paste it.
There was a problem hiding this comment.
I think we can start here as a proof of concept.
We could then move it as it's own repo and have it be a callable action if we genericize it enough.
There was a problem hiding this comment.
Yeah, I plan to add things like uploading the SERIF files to GitHub, upload SBOMs to R2 etc. But that all comes later. Right now, I just want to build the files and push them to job artifacts in only this repo.
None of this will be specific to ublue and/or bluefin
Always run the scan job on events that are not a PR
p5
changed the title
m2Giles
approved these changes
Apr 21, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Creates a reusable workflow to scan images. This scan generates a SBOM and checks that SBOM for known vulnerabilities.
The only way I was able to merge the outputs of each matrix run was to use artifacts. It's certainly not clean, but it works.
We needed to exclude some directories during the SBOM generation because Syft crashes when scanning too large images.
This PR only enables the scans for Bluefin until we finalise it. Once we confirm everything is working, I will apply the same to Aurora and possibly Bazzite.