Skip to content

Commit bd20586

Browse files
vipin230vipin230
committed
grype changes
Signed-off-by: Vipin Yadav <vipin.yadav@progress.com>
1 parent 6849aee commit bd20586

File tree

4 files changed

+75
-22
lines changed

4 files changed

+75
-22
lines changed

‎.github/workflows/build-docker-image.yml‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -65,13 +65,14 @@ jobs:
6565
export GITHUB_TOKEN="${{ secrets.GH_TOKEN }}"
6666
make compose-build
6767
68-
echo "Detecting built images..."
69-
docker compose images
70-
71-
IMAGES=$(docker images --format "{{.Repository}}:{{.Tag}}" | grep "^${REPO_NAME}" | grep -v "^<none>")
68+
echo "Detecting built images from compose config..."
69+
# Only get images from services that have a build section (not pulled images like postgres, grafana, etc.)
70+
IMAGES=$(docker compose config --format json 2>/dev/null | jq -r '.services[] | select(.build) | .image // empty' | sort -u | while read img; do
71+
if echo "$img" | grep -q ':'; then echo "$img"; else echo "${img}:latest"; fi
72+
done)
7273
7374
if [ -z "$IMAGES" ]; then
74-
echo "No images found with prefix ${REPO_NAME}, scanning all recent images"
75+
echo "⚠️ Could not detect built images from compose config, falling back to docker images"
7576
IMAGES=$(docker images --format "{{.Repository}}:{{.Tag}}" | grep -v "^<none>" | head -5)
7677
fi
7778
# Strategy 3: Fallback to standard docker build

‎.github/workflows/ci-main-pull-request.yml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -999,17 +999,19 @@ jobs:
999999
run-grype-image:
10001000
name: 'Grype Docker image scan'
10011001
if: ${{ inputs.perform-grype-image-scan }}
1002-
uses: chef/common-github-actions/.github/workflows/grype.yml@main
1003-
needs: checkout
1002+
uses: chef/common-github-actions/.github/workflows/grype.yml@grype-wiz
1003+
needs: [checkout, build-docker-image]
10041004
secrets: inherit
10051005
with:
10061006
fail-grype-on-high: ${{ inputs.grype-image-fail-on-high }}
10071007
fail-grype-on-critical: ${{ inputs.grype-image-fail-on-critical }}
10081008
grype-image-skip-aws: ${{ inputs.grype-image-skip-aws }}
1009+
prebuilt-image-artifact: docker-image-for-scans
1010+
prebuilt-image-names: ${{ needs.build-docker-image.outputs.image-names }}
10091011

10101012
build-docker-image:
10111013
name: 'Build Docker image for security scans'
1012-
if: ${{ inputs.perform-wiz-scan == true }}
1014+
if: ${{ inputs.perform-grype-image-scan == true || inputs.perform-wiz-scan == true }}
10131015
uses: chef/common-github-actions/.github/workflows/build-docker-image.yml@grype-wiz
10141016
needs: checkout
10151017
secrets: inherit

‎.github/workflows/grype.yml‎

Lines changed: 58 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,16 @@ on:
2222
required: false
2323
type: boolean
2424
default: false
25+
prebuilt-image-artifact:
26+
description: 'Name of uploaded artifact containing a Docker image tar (skip Docker build if provided)'
27+
required: false
28+
type: string
29+
default: ''
30+
prebuilt-image-names:
31+
description: 'Space-separated list of Docker image:tag names inside the prebuilt artifact tar'
32+
required: false
33+
type: string
34+
default: ''
2535

2636
jobs:
2737
grype-scan:
@@ -65,13 +75,29 @@ jobs:
6575
if: ${{ !inputs.grype-image-skip-aws }}
6676
uses: aws-actions/amazon-ecr-login@v2
6777

68-
- name: Scan with Grype
69-
id: grype-scan
78+
- name: Download prebuilt Docker image
79+
if: ${{ inputs.prebuilt-image-artifact != '' }}
80+
uses: actions/download-artifact@v4
81+
with:
82+
name: ${{ inputs.prebuilt-image-artifact }}
83+
path: /tmp
84+
85+
- name: Load prebuilt Docker image
86+
id: load-image
87+
if: ${{ inputs.prebuilt-image-artifact != '' }}
88+
run: |
89+
echo "Loading prebuilt images from artifact..."
90+
docker load -i /tmp/docker-image.tar
91+
echo "IMAGES=${{ inputs.prebuilt-image-names }}" >> "$GITHUB_OUTPUT"
92+
echo "Loaded images: ${{ inputs.prebuilt-image-names }}"
93+
docker images
94+
95+
- name: Build Docker image
96+
id: build-image
97+
if: ${{ inputs.prebuilt-image-artifact == '' }}
7098
env:
7199
GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
72100
run: |
73-
SCAN_NAME="${{ github.repository }}"
74-
75101
if [ ! -f "Dockerfile" ]; then
76102
echo "❌ No Dockerfile found - this workflow requires a Dockerfile to scan Docker image"
77103
exit 1
@@ -100,13 +126,14 @@ jobs:
100126
export GITHUB_TOKEN="${{ secrets.GH_TOKEN }}"
101127
make compose-build
102128
103-
echo "Detecting built images..."
104-
docker compose images
105-
106-
IMAGES=$(docker images --format "{{.Repository}}:{{.Tag}}" | grep "^${REPO_NAME}" | grep -v "^<none>")
129+
echo "Detecting built images from compose config..."
130+
# Only get images from services that have a build section (not pulled images like postgres, grafana, etc.)
131+
IMAGES=$(docker compose config --format json 2>/dev/null | jq -r '.services[] | select(.build) | .image // empty' | sort -u | while read img; do
132+
if echo "$img" | grep -q ':'; then echo "$img"; else echo "${img}:latest"; fi
133+
done)
107134
108135
if [ -z "$IMAGES" ]; then
109-
echo "No images found with prefix ${REPO_NAME}, scanning all recent images"
136+
echo "⚠️ Could not detect built images from compose config, falling back to docker images"
110137
IMAGES=$(docker images --format "{{.Repository}}:{{.Tag}}" | grep -v "^<none>" | head -5)
111138
fi
112139
# Strategy 3: Fallback to standard docker build
@@ -121,6 +148,28 @@ jobs:
121148
exit 1
122149
fi
123150
151+
echo "IMAGES=$(echo $IMAGES | tr '\n' ' ')" >> "$GITHUB_OUTPUT"
152+
echo "Found images: $IMAGES"
153+
154+
- name: Determine scan targets
155+
id: scan-target
156+
run: |
157+
IMAGES="${{ steps.load-image.outputs.IMAGES || steps.build-image.outputs.IMAGES }}"
158+
if [ -z "$IMAGES" ]; then
159+
echo "❌ No images available to scan"
160+
exit 1
161+
fi
162+
echo "IMAGES=$IMAGES" >> "$GITHUB_OUTPUT"
163+
echo "Scan targets: $IMAGES"
164+
165+
- name: Scan with Grype
166+
id: grype-scan
167+
env:
168+
GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
169+
run: |
170+
SCAN_NAME="${{ github.repository }}"
171+
IMAGES="${{ steps.scan-target.outputs.IMAGES }}"
172+
124173
echo "Found images to scan:"
125174
echo "$IMAGES"
126175

‎.github/workflows/wiz.yml‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -115,13 +115,14 @@ jobs:
115115
export GITHUB_TOKEN="${{ secrets.GH_TOKEN }}"
116116
make compose-build
117117
118-
echo "Detecting built images..."
119-
docker compose images
120-
121-
IMAGES=$(docker images --format "{{.Repository}}:{{.Tag}}" | grep "^${REPO_NAME}" | grep -v "^<none>")
118+
echo "Detecting built images from compose config..."
119+
# Only get images from services that have a build section (not pulled images like postgres, grafana, etc.)
120+
IMAGES=$(docker compose config --format json 2>/dev/null | jq -r '.services[] | select(.build) | .image // empty' | sort -u | while read img; do
121+
if echo "$img" | grep -q ':'; then echo "$img"; else echo "${img}:latest"; fi
122+
done)
122123
123124
if [ -z "$IMAGES" ]; then
124-
echo "No images found with prefix ${REPO_NAME}, scanning all recent images"
125+
echo "⚠️ Could not detect built images from compose config, falling back to docker images"
125126
IMAGES=$(docker images --format "{{.Repository}}:{{.Tag}}" | grep -v "^<none>" | head -5)
126127
fi
127128
# Strategy 3: Fallback to standard docker build

0 commit comments

Comments
 (0)