Skip to content

Commit f98cce7

Browse files
duncanistaduncanista
committed
add lambda vulnerability scans
1 parent 115b99b commit f98cce7

1 file changed

Lines changed: 163 additions & 0 deletions

File tree

‎.github/workflows/vulnerability-scan.yml‎

Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
name: "Vulnerability Scan"
2+
3+
on:
4+
schedule:
5+
# daily at midnight
6+
- cron: "0 0 * * *"
7+
workflow_dispatch:
8+
9+
env:
10+
VERSION: dev # env var required when building extension
11+
# adds public.ecr.aws as fallback incase rate limit on ghcr.io is hit
12+
TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db
13+
TRIVY_JAVA_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-java-db,public.ecr.aws/aquasecurity/trivy-java-db
14+
15+
jobs:
16+
trivy-scans:
17+
runs-on: ubuntu-22.04
18+
steps:
19+
- name: Scan latest released image with trivy
20+
uses: aquasecurity/trivy-action@dc5a429b52fcf669ce959baa2c2dd26090d2a6c4 # v0.32.0
21+
with:
22+
image-ref: "public.ecr.aws/datadog/lambda-extension:latest"
23+
ignore-unfixed: true
24+
exit-code: 1
25+
format: table
26+
27+
- name: Scan latest-alpine released image with trivy
28+
uses: aquasecurity/trivy-action@dc5a429b52fcf669ce959baa2c2dd26090d2a6c4 # v0.32.0
29+
with:
30+
image-ref: "public.ecr.aws/datadog/lambda-extension:latest-alpine"
31+
ignore-unfixed: true
32+
exit-code: 1
33+
format: table
34+
35+
grype-scans:
36+
runs-on: ubuntu-22.04
37+
steps:
38+
- name: Scan latest release image with grype
39+
uses: anchore/scan-action@16910ac423301c6d30554b83a7f71ac6ff4a51f3 # v6.4.0
40+
with:
41+
image: "public.ecr.aws/datadog/lambda-extension:latest"
42+
only-fixed: true
43+
fail-build: true
44+
severity-cutoff: low
45+
output-format: table
46+
47+
- name: Scan latest-alpine release image with grype
48+
uses: anchore/scan-action@16910ac423301c6d30554b83a7f71ac6ff4a51f3 # v6.4.0
49+
with:
50+
image: "public.ecr.aws/datadog/lambda-extension:latest-alpine"
51+
only-fixed: true
52+
fail-build: true
53+
severity-cutoff: low
54+
output-format: table
55+
56+
build-and-binary-scans:
57+
runs-on: ubuntu-22.04
58+
steps:
59+
- name: Checkout datadog-agent repository
60+
uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
61+
with:
62+
repository: DataDog/datadog-agent
63+
path: go/src/github.com/DataDog/datadog-agent
64+
65+
- name: Checkout datadog-lambda-extension repository
66+
uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
67+
with:
68+
repository: DataDog/datadog-lambda-extension
69+
path: go/src/github.com/DataDog/datadog-lambda-extension
70+
71+
- name: Set up QEMU
72+
id: qemu
73+
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
74+
with:
75+
image: tonistiigi/binfmt:qemu-v9.2.2-52 #v3.6.0 latest
76+
platforms: amd64,arm64
77+
78+
- name: Set up Docker Buildx
79+
uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb # v3.3.0
80+
81+
- name: Build extension
82+
run: |
83+
cd go/src/github.com/DataDog/datadog-lambda-extension
84+
./scripts/build_binary_and_layer_dockerized.sh
85+
86+
- name: Scan amd64 image with trivy
87+
uses: aquasecurity/trivy-action@dc5a429b52fcf669ce959baa2c2dd26090d2a6c4 # v0.32.0
88+
with:
89+
image-ref: "datadog/build-lambda-extension-amd64:${{ env.VERSION }}"
90+
ignore-unfixed: true
91+
exit-code: 1
92+
format: table
93+
94+
- name: Scan arm64 image with trivy
95+
uses: aquasecurity/trivy-action@dc5a429b52fcf669ce959baa2c2dd26090d2a6c4 # v0.32.0
96+
with:
97+
image-ref: "datadog/build-lambda-extension-arm64:${{ env.VERSION }}"
98+
ignore-unfixed: true
99+
exit-code: 1
100+
format: table
101+
102+
- name: Scan amd64 image with grype
103+
uses: anchore/scan-action@16910ac423301c6d30554b83a7f71ac6ff4a51f3 # v6.4.0
104+
with:
105+
image: "datadog/build-lambda-extension-amd64:${{ env.VERSION }}"
106+
only-fixed: true
107+
fail-build: true
108+
severity-cutoff: low
109+
output-format: table
110+
111+
- name: Scan arm64 image with grype
112+
uses: anchore/scan-action@16910ac423301c6d30554b83a7f71ac6ff4a51f3 # v6.4.0
113+
with:
114+
image: "datadog/build-lambda-extension-arm64:${{ env.VERSION }}"
115+
only-fixed: true
116+
fail-build: true
117+
severity-cutoff: low
118+
output-format: table
119+
120+
- name: Scan binary files with grype
121+
uses: anchore/scan-action@16910ac423301c6d30554b83a7f71ac6ff4a51f3 # v6.4.0
122+
with:
123+
path: go/src/github.com/DataDog/datadog-lambda-extension/.layers
124+
only-fixed: true
125+
fail-build: true
126+
severity-cutoff: low
127+
output-format: table
128+
129+
retry:
130+
needs: [trivy-scans, grype-scans, build-and-binary-scans]
131+
if: failure() && fromJSON(github.run_attempt) < 2
132+
runs-on: ubuntu-22.04
133+
permissions:
134+
actions: write
135+
steps:
136+
- name: Retry failed action
137+
env:
138+
GH_REPO: ${{ github.repository }}
139+
GH_TOKEN: ${{ github.token }}
140+
run: gh workflow run retry-workflow.yml -F run_id=${{ github.run_id }}
141+
142+
notify:
143+
needs: [trivy-scans, grype-scans, build-and-binary-scans]
144+
if: failure() && fromJSON(github.run_attempt) >= 2
145+
runs-on: ubuntu-22.04
146+
steps:
147+
- name: Notify
148+
env:
149+
SLACK_CHANNEL: "#serverless-agent"
150+
SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
151+
run: |
152+
set -x
153+
154+
OPS_MESSAGE=":gh-check-failed: Lambda Extension Vulnerability Scan failed! :radar-scan:
155+
156+
Whoever is on support, please fix the vulnerability, before a customer alerts us to it.
157+
158+
See ${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID} for the full info on the found vulnerability. :bufo-thanks:"
159+
160+
curl -H "Content-type: application/json" -X POST "$SLACK_WEBHOOK" -d '{
161+
"channel": "'"$SLACK_CHANNEL"'",
162+
"text": "'"$OPS_MESSAGE"'"
163+
}'

0 commit comments

Comments
 (0)