Skip to content

Commit 2816ae4

Browse files
duncanistaduncanista
authored
chore(github): separate vulnerability scans (#739)
# What? Separates Lambda Extension and Serverless Init vulnerability scans # Motivation If Serverless Init fails, Lambda doesnt execute, here it justs separates them and runs them per scanner and per product # Tests <img width="925" height="172" alt="Screenshot 2025-07-11 at 11 38 07 AM" src="https://github.com/user-attachments/assets/765edd75-5baf-4c32-a7b8-bb13f056c031" />
1 parent 7b619d4 commit 2816ae4

2 files changed

Lines changed: 101 additions & 45 deletions

File tree

‎.github/workflows/serverless-init-vulnerability-scan.yml‎

Lines changed: 89 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,89 @@
1+
name: "Serverless Init Vulnerability Scan"
2+
3+
on:
4+
schedule:
5+
# daily at midnight
6+
- cron: "0 0 * * *"
7+
workflow_dispatch:
8+
9+
env:
10+
# adds public.ecr.aws as fallback incase rate limit on ghcr.io is hit
11+
TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db
12+
TRIVY_JAVA_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-java-db,public.ecr.aws/aquasecurity/trivy-java-db
13+
14+
jobs:
15+
trivy-scans:
16+
runs-on: ubuntu-22.04
17+
steps:
18+
- name: Scan latest serverless-init image with trivy
19+
uses: aquasecurity/trivy-action@dc5a429b52fcf669ce959baa2c2dd26090d2a6c4 # v0.32.0
20+
with:
21+
image-ref: "datadog/serverless-init:latest"
22+
ignore-unfixed: true
23+
exit-code: 1
24+
format: table
25+
26+
- name: Scan latest-alpine serverless-init image with trivy
27+
uses: aquasecurity/trivy-action@dc5a429b52fcf669ce959baa2c2dd26090d2a6c4 # v0.32.0
28+
with:
29+
image-ref: "datadog/serverless-init:latest-alpine"
30+
ignore-unfixed: true
31+
exit-code: 1
32+
format: table
33+
34+
grype-scans:
35+
runs-on: ubuntu-22.04
36+
steps:
37+
- name: Scan latest serverless-init image with grype
38+
uses: anchore/scan-action@16910ac423301c6d30554b83a7f71ac6ff4a51f3 # v6.4.0
39+
with:
40+
image: "datadog/serverless-init:latest"
41+
only-fixed: true
42+
fail-build: true
43+
severity-cutoff: low
44+
output-format: table
45+
46+
- name: Scan latest-alpine serverless-init image with grype
47+
uses: anchore/scan-action@16910ac423301c6d30554b83a7f71ac6ff4a51f3 # v6.4.0
48+
with:
49+
image: "datadog/serverless-init:latest-alpine"
50+
only-fixed: true
51+
fail-build: true
52+
severity-cutoff: low
53+
output-format: table
54+
55+
retry:
56+
needs: [trivy-scans, grype-scans]
57+
if: failure() && fromJSON(github.run_attempt) < 2
58+
runs-on: ubuntu-22.04
59+
permissions:
60+
actions: write
61+
steps:
62+
- name: Retry failed action
63+
env:
64+
GH_REPO: ${{ github.repository }}
65+
GH_TOKEN: ${{ github.token }}
66+
run: gh workflow run retry-workflow.yml -F run_id=${{ github.run_id }}
67+
68+
notify:
69+
needs: [trivy-scans, grype-scans]
70+
if: failure() && fromJSON(github.run_attempt) >= 2
71+
runs-on: ubuntu-22.04
72+
steps:
73+
- name: Notify
74+
env:
75+
SLACK_CHANNEL: "#serverless-agent"
76+
SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
77+
run: |
78+
set -x
79+
80+
OPS_MESSAGE=":gh-check-failed: Serverless Init Vulnerability Scan failed! :radar-scan:
81+
82+
Whoever is on support, please fix the vulnerability, before a customer alerts us to it.
83+
84+
See ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID} for the full info on the found vulnerability. :bufo-thanks:"
85+
86+
curl -H "Content-type: application/json" -X POST "$SLACK_WEBHOOK" -d '{
87+
"channel": "'"$SLACK_CHANNEL"'",
88+
"text": "'"$OPS_MESSAGE"'"
89+
}'

.github/workflows/serverless-vuln-scan.yml renamed to .github/workflows/vulnerability-scan.yml

Lines changed: 12 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: "Serverless Vulnerability Scan"
1+
name: "Vulnerability Scan"
22

33
on:
44
schedule:
@@ -7,18 +7,15 @@ on:
77
workflow_dispatch:
88

99
env:
10-
VERSION: 1 # env var required when building extension
10+
VERSION: dev # env var required when building extension
1111
# adds public.ecr.aws as fallback incase rate limit on ghcr.io is hit
1212
TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db
1313
TRIVY_JAVA_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-java-db,public.ecr.aws/aquasecurity/trivy-java-db
1414

1515
jobs:
16-
check:
16+
trivy-scans:
1717
runs-on: ubuntu-22.04
1818
steps:
19-
20-
# scan latest released images
21-
2219
- name: Scan latest released image with trivy
2320
uses: aquasecurity/trivy-action@dc5a429b52fcf669ce959baa2c2dd26090d2a6c4 # v0.32.0
2421
with:
@@ -35,22 +32,9 @@ jobs:
3532
exit-code: 1
3633
format: table
3734

38-
- name: Scan latest serverless-init image with trivy
39-
uses: aquasecurity/trivy-action@dc5a429b52fcf669ce959baa2c2dd26090d2a6c4 # v0.32.0
40-
with:
41-
image-ref: "datadog/serverless-init:latest"
42-
ignore-unfixed: true
43-
exit-code: 1
44-
format: table
45-
46-
- name: Scan latest-alpine serverless-init image with trivy
47-
uses: aquasecurity/trivy-action@dc5a429b52fcf669ce959baa2c2dd26090d2a6c4 # v0.32.0
48-
with:
49-
image-ref: "datadog/serverless-init:latest-alpine"
50-
ignore-unfixed: true
51-
exit-code: 1
52-
format: table
53-
35+
grype-scans:
36+
runs-on: ubuntu-22.04
37+
steps:
5438
- name: Scan latest release image with grype
5539
uses: anchore/scan-action@16910ac423301c6d30554b83a7f71ac6ff4a51f3 # v6.4.0
5640
with:
@@ -69,26 +53,9 @@ jobs:
6953
severity-cutoff: low
7054
output-format: table
7155

72-
- name: Scan latest serverless-init image with grype
73-
uses: anchore/scan-action@16910ac423301c6d30554b83a7f71ac6ff4a51f3 # v6.4.0
74-
with:
75-
image: "datadog/serverless-init:latest"
76-
only-fixed: true
77-
fail-build: true
78-
severity-cutoff: low
79-
output-format: table
80-
81-
- name: Scan latest-alpine serverless-init image with grype
82-
uses: anchore/scan-action@16910ac423301c6d30554b83a7f71ac6ff4a51f3 # v6.4.0
83-
with:
84-
image: "datadog/serverless-init:latest-alpine"
85-
only-fixed: true
86-
fail-build: true
87-
severity-cutoff: low
88-
output-format: table
89-
90-
# scan unreleased from main
91-
56+
build-and-binary-scans:
57+
runs-on: ubuntu-22.04
58+
steps:
9259
- name: Checkout datadog-agent repository
9360
uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
9461
with:
@@ -160,7 +127,7 @@ jobs:
160127
output-format: table
161128

162129
retry:
163-
needs: check
130+
needs: [trivy-scans, grype-scans, build-and-binary-scans]
164131
if: failure() && fromJSON(github.run_attempt) < 2
165132
runs-on: ubuntu-22.04
166133
permissions:
@@ -173,7 +140,7 @@ jobs:
173140
run: gh workflow run retry-workflow.yml -F run_id=${{ github.run_id }}
174141

175142
notify:
176-
needs: check
143+
needs: [trivy-scans, grype-scans, build-and-binary-scans]
177144
if: failure() && fromJSON(github.run_attempt) >= 2
178145
runs-on: ubuntu-22.04
179146
steps:
@@ -184,7 +151,7 @@ jobs:
184151
run: |
185152
set -x
186153
187-
OPS_MESSAGE=":gh-check-failed: Serverless Vulnerability Scan failed! :radar-scan:
154+
OPS_MESSAGE=":gh-check-failed: Lambda Extension Vulnerability Scan failed! :radar-scan:
188155
189156
Whoever is on support, please fix the vulnerability, before a customer alerts us to it.
190157

0 commit comments

Comments
 (0)