Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

New image scanning workflow and parsing #169

Closed
wants to merge 1 commit into from

Conversation

Nava-JoshLong
Copy link

@Nava-JoshLong Nava-JoshLong commented Jan 31, 2025

Ticket

Resolves #{TICKET NUMBER OR URL}

Changes

  • Created python scripts to parse JSON files from scanners, and create markdown for easier viewing of results
  • Created new workflows for the new image scanning logic
  • Create action for image scan

Context for reviewers

I put things in parallel to the existing workflows so I can test if these changes work, without messing with any subsequent runs. I had to tweak the files from the contract's version since it has things more specific to our setup and aren't needed here.

The main changes here will make all image scans save findings to JSON, and then a python script to parse and format it into a clean markdown file that we can view in the workflow summary, and use for creating Github tickets. The ticket creation and Slack alerting is disabled by default, with comments on what it takes to enable.

There's some side benefits of this, such as handling if the image is ARM based, and better trivy finding ignore functionality. There is a change to the current method of parallel scanning, to being a single build and use that image on all of the scanners. This is because as images grow, the time it takes to build also increase, and it doesn't make a lot of sense to build it multiple times (IMHO). In real life, the CI unit and coverage tests takes the same time, or longer than this change

Testing

Testing will be handled by the PR running these workflows

Preview environment for app

♻️ Environment destroyed ♻️

Preview environment for app-rails

♻️ Environment destroyed ♻️

# Setting to new in case there's anything checking the existing vulnerability-scans.yml
# This will be fixed before merging
uses: ./.github/workflows/new-vulnerability-scans.yml
strategy:
Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This might be the issue from here. In my file I pulled this from, I have the matrix in the workflow this calls, but I forgot why I did that. I think this could be why I did it like that. If so, should be an easy move into the sub-workflow to test it

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant