cve-report.yml

name: cve-report

on:
  schedule:
    - cron: '0 17 * * *'
  workflow_dispatch:

concurrency:
  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
  cancel-in-progress: true

jobs:
  report:
    name: Report
    runs-on: ubuntu-24.04
    steps:
    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

    - name: Generate LGTM App token
      id: lgtm-app-token
      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
      with:
        client-id: ${{ secrets.LGTM_APP_CLIENT_ID }}
        private-key: ${{ secrets.LGTM_APP_PRIVATE_KEY }}
        owner: ${{ github.repository_owner }}
        repositories: installer
        permission-contents: write
        permission-pull-requests: write

    - name: Install trivy
      env:
        TRIVY_VERSION: 0.70.0
      run: |
        curl -fsSL -o trivy.deb "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.deb"
        sudo dpkg -i trivy.deb
        rm trivy.deb

    - name: Install image packer
      run: |
        make install-image-packer
        echo "$(pwd)/bin/linux_amd64" >> "$GITHUB_PATH"

    - name: Generate report
      run: |
        image-packer generate-cve-report \
            --output-dir=catalog \
            --src=catalog/ace.yaml \
            --src=catalog/editor-charts.yaml \
            --src=catalog/feature-charts.yaml \
            --src=catalog/reusable-ui-charts.yaml

    - name: Create Pull Request
      uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.11
      with:
        token: ${{ steps.lgtm-app-token.outputs.token }}
        commit-message: Update cve report
        author: ${{ github.actor }} <${{ github.actor }}@appscode.com>
        committer: ${{ github.actor }} <${{ github.actor }}@appscode.com>
        signoff: true
        title: Update cve report
        branch: update-cve-report
        delete-branch: true
        add-paths: |
          catalog/README.md
        labels: |
          automerge