New image scanning workflow and parsing #169
Closed
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Ticket
Resolves #{TICKET NUMBER OR URL}
Changes
Context for reviewers
I put things in parallel to the existing workflows so I can test if these changes work, without messing with any subsequent runs. I had to tweak the files from the contract's version since it has things more specific to our setup and aren't needed here.
The main changes here will make all image scans save findings to JSON, and then a python script to parse and format it into a clean markdown file that we can view in the workflow summary, and use for creating Github tickets. The ticket creation and Slack alerting is disabled by default, with comments on what it takes to enable.
There's some side benefits of this, such as handling if the image is ARM based, and better trivy finding ignore functionality. There is a change to the current method of parallel scanning, to being a single build and use that image on all of the scanners. This is because as images grow, the time it takes to build also increase, and it doesn't make a lot of sense to build it multiple times (IMHO). In real life, the CI unit and coverage tests takes the same time, or longer than this change
Testing
Testing will be handled by the PR running these workflows
Preview environment for app
♻️ Environment destroyed ♻️
Preview environment for app-rails
♻️ Environment destroyed ♻️