Skip to content

Commit cd3ead6

Browse files
vipin230vipin230
committed
grype changes
Signed-off-by: Vipin Yadav <vipin.yadav@progress.com>
1 parent 6849aee commit cd3ead6

File tree

4 files changed

+139
-35
lines changed

4 files changed

+139
-35
lines changed

‎.github/workflows/build-docker-image.yml‎

Lines changed: 34 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,12 @@ name: Build Docker image
1212

1313
on:
1414
workflow_call:
15+
inputs:
16+
skip-aws:
17+
description: 'Skip AWS ECR login (for repos that do not need ECR base images)'
18+
required: false
19+
type: boolean
20+
default: false
1521
outputs:
1622
image-names:
1723
description: 'Space-separated list of built Docker image names (repository:tag)'
@@ -21,6 +27,9 @@ jobs:
2127
build:
2228
name: Build and upload Docker image
2329
runs-on: ubuntu-latest
30+
permissions:
31+
id-token: write
32+
contents: read
2433
outputs:
2534
image-names: ${{ steps.build-image.outputs.IMAGES }}
2635
steps:
@@ -32,6 +41,20 @@ jobs:
3241
- name: Configure git for private repos
3342
run: git config --global url."https://${{ secrets.GH_TOKEN }}@github.com/".insteadOf "https://github.com/"
3443

44+
- name: Configure AWS credentials
45+
if: ${{ !inputs.skip-aws }}
46+
uses: aws-actions/configure-aws-credentials@v4
47+
with:
48+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
49+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
50+
aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }}
51+
aws-region: us-east-2
52+
53+
- name: Login to Amazon ECR
54+
id: login-ecr
55+
if: ${{ !inputs.skip-aws }}
56+
uses: aws-actions/amazon-ecr-login@v2
57+
3558
- name: Build Docker image
3659
id: build-image
3760
env:
@@ -66,13 +89,19 @@ jobs:
6689
make compose-build
6790
6891
echo "Detecting built images..."
69-
docker compose images
70-
71-
IMAGES=$(docker images --format "{{.Repository}}:{{.Tag}}" | grep "^${REPO_NAME}" | grep -v "^<none>")
92+
# Get all image names from compose, then keep only ones that exist locally (i.e., were actually built)
93+
IMAGES=""
94+
for img in $(docker compose config --images 2>/dev/null | sort -u); do
95+
TAG_IMG=$(echo "$img" | grep -q ':' && echo "$img" || echo "${img}:latest")
96+
if docker image inspect "$TAG_IMG" &>/dev/null; then
97+
IMAGES="${IMAGES}${TAG_IMG} "
98+
fi
99+
done
100+
IMAGES=$(echo "$IMAGES" | xargs)
72101
73102
if [ -z "$IMAGES" ]; then
74-
echo "No images found with prefix ${REPO_NAME}, scanning all recent images"
75-
IMAGES=$(docker images --format "{{.Repository}}:{{.Tag}}" | grep -v "^<none>" | head -5)
103+
echo "⚠️ Could not detect built images from compose config, falling back to repo name match"
104+
IMAGES=$(docker images --format "{{.Repository}}:{{.Tag}}" | grep "^${REPO_NAME}" | grep -v "^<none>")
76105
fi
77106
# Strategy 3: Fallback to standard docker build
78107
else

‎.github/workflows/ci-main-pull-request.yml‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -999,20 +999,24 @@ jobs:
999999
run-grype-image:
10001000
name: 'Grype Docker image scan'
10011001
if: ${{ inputs.perform-grype-image-scan }}
1002-
uses: chef/common-github-actions/.github/workflows/grype.yml@main
1003-
needs: checkout
1002+
uses: chef/common-github-actions/.github/workflows/grype.yml@grype-wiz
1003+
needs: [checkout, build-docker-image]
10041004
secrets: inherit
10051005
with:
10061006
fail-grype-on-high: ${{ inputs.grype-image-fail-on-high }}
10071007
fail-grype-on-critical: ${{ inputs.grype-image-fail-on-critical }}
10081008
grype-image-skip-aws: ${{ inputs.grype-image-skip-aws }}
1009+
prebuilt-image-artifact: docker-image-for-scans
1010+
prebuilt-image-names: ${{ needs.build-docker-image.outputs.image-names }}
10091011

10101012
build-docker-image:
10111013
name: 'Build Docker image for security scans'
1012-
if: ${{ inputs.perform-wiz-scan == true }}
1014+
if: ${{ inputs.perform-grype-image-scan == true || inputs.perform-wiz-scan == true }}
10131015
uses: chef/common-github-actions/.github/workflows/build-docker-image.yml@grype-wiz
10141016
needs: checkout
10151017
secrets: inherit
1018+
with:
1019+
skip-aws: ${{ inputs.grype-image-skip-aws }}
10161020

10171021
run-wiz-scan:
10181022
name: 'Wiz CLI security scan'

‎.github/workflows/grype.yml‎

Lines changed: 63 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,16 @@ on:
2222
required: false
2323
type: boolean
2424
default: false
25+
prebuilt-image-artifact:
26+
description: 'Name of uploaded artifact containing a Docker image tar (skip Docker build if provided)'
27+
required: false
28+
type: string
29+
default: ''
30+
prebuilt-image-names:
31+
description: 'Space-separated list of Docker image:tag names inside the prebuilt artifact tar'
32+
required: false
33+
type: string
34+
default: ''
2535

2636
jobs:
2737
grype-scan:
@@ -65,13 +75,29 @@ jobs:
6575
if: ${{ !inputs.grype-image-skip-aws }}
6676
uses: aws-actions/amazon-ecr-login@v2
6777

68-
- name: Scan with Grype
69-
id: grype-scan
78+
- name: Download prebuilt Docker image
79+
if: ${{ inputs.prebuilt-image-artifact != '' }}
80+
uses: actions/download-artifact@v4
81+
with:
82+
name: ${{ inputs.prebuilt-image-artifact }}
83+
path: /tmp
84+
85+
- name: Load prebuilt Docker image
86+
id: load-image
87+
if: ${{ inputs.prebuilt-image-artifact != '' }}
88+
run: |
89+
echo "Loading prebuilt images from artifact..."
90+
docker load -i /tmp/docker-image.tar
91+
echo "IMAGES=${{ inputs.prebuilt-image-names }}" >> "$GITHUB_OUTPUT"
92+
echo "Loaded images: ${{ inputs.prebuilt-image-names }}"
93+
docker images
94+
95+
- name: Build Docker image
96+
id: build-image
97+
if: ${{ inputs.prebuilt-image-artifact == '' }}
7098
env:
7199
GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
72100
run: |
73-
SCAN_NAME="${{ github.repository }}"
74-
75101
if [ ! -f "Dockerfile" ]; then
76102
echo "❌ No Dockerfile found - this workflow requires a Dockerfile to scan Docker image"
77103
exit 1
@@ -101,13 +127,19 @@ jobs:
101127
make compose-build
102128
103129
echo "Detecting built images..."
104-
docker compose images
105-
106-
IMAGES=$(docker images --format "{{.Repository}}:{{.Tag}}" | grep "^${REPO_NAME}" | grep -v "^<none>")
130+
# Get all image names from compose, then keep only ones that exist locally (i.e., were actually built)
131+
IMAGES=""
132+
for img in $(docker compose config --images 2>/dev/null | sort -u); do
133+
TAG_IMG=$(echo "$img" | grep -q ':' && echo "$img" || echo "${img}:latest")
134+
if docker image inspect "$TAG_IMG" &>/dev/null; then
135+
IMAGES="${IMAGES}${TAG_IMG} "
136+
fi
137+
done
138+
IMAGES=$(echo "$IMAGES" | xargs)
107139
108140
if [ -z "$IMAGES" ]; then
109-
echo "No images found with prefix ${REPO_NAME}, scanning all recent images"
110-
IMAGES=$(docker images --format "{{.Repository}}:{{.Tag}}" | grep -v "^<none>" | head -5)
141+
echo "⚠️ Could not detect built images from compose config, falling back to repo name match"
142+
IMAGES=$(docker images --format "{{.Repository}}:{{.Tag}}" | grep "^${REPO_NAME}" | grep -v "^<none>")
111143
fi
112144
# Strategy 3: Fallback to standard docker build
113145
else
@@ -121,6 +153,28 @@ jobs:
121153
exit 1
122154
fi
123155
156+
echo "IMAGES=$(echo $IMAGES | tr '\n' ' ')" >> "$GITHUB_OUTPUT"
157+
echo "Found images: $IMAGES"
158+
159+
- name: Determine scan targets
160+
id: scan-target
161+
run: |
162+
IMAGES="${{ steps.load-image.outputs.IMAGES || steps.build-image.outputs.IMAGES }}"
163+
if [ -z "$IMAGES" ]; then
164+
echo "❌ No images available to scan"
165+
exit 1
166+
fi
167+
echo "IMAGES=$IMAGES" >> "$GITHUB_OUTPUT"
168+
echo "Scan targets: $IMAGES"
169+
170+
- name: Scan with Grype
171+
id: grype-scan
172+
env:
173+
GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
174+
run: |
175+
SCAN_NAME="${{ github.repository }}"
176+
IMAGES="${{ steps.scan-target.outputs.IMAGES }}"
177+
124178
echo "Found images to scan:"
125179
echo "$IMAGES"
126180

‎.github/workflows/wiz.yml‎

Lines changed: 35 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,11 @@ on:
2424
required: false
2525
type: boolean
2626
default: false
27+
wiz-image-skip-aws:
28+
description: 'Skip AWS ECR login (for repos that do not need ECR base images)'
29+
required: false
30+
type: boolean
31+
default: false
2732
prebuilt-image-artifact:
2833
description: 'Name of uploaded artifact containing a Docker image tar (skip Docker build if provided)'
2934
required: false
@@ -51,19 +56,25 @@ jobs:
5156
- name: Configure git for private repos
5257
run: git config --global url."https://${{ secrets.GH_TOKEN }}@github.com/".insteadOf "https://github.com/"
5358

54-
# - name: Configure AWS credentials
55-
# uses: aws-actions/configure-aws-credentials@v4
56-
# if: ${{ !inputs.wiz-image-skip-aws }}
57-
# with:
58-
# aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
59-
# aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
60-
# aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }}
61-
# aws-region: us-east-2
59+
- name: Generate Artifact Name
60+
run: |
61+
TIMESTAMP=$(date +%Y%m%d-%H%M%S)
62+
ARTIFACT_NAME=$(echo "wiz-scan-${{ github.event.repository.name }}-${TIMESTAMP}" | sed 's|/|-|g')
63+
echo "ARTIFACT_NAME=${ARTIFACT_NAME}" >> $GITHUB_ENV
6264
63-
# - name: Login to Amazon ECR
64-
# id: login-ecr
65-
# if: ${{ !inputs.wiz-image-skip-aws }}
66-
# uses: aws-actions/amazon-ecr-login@v2
65+
- name: Configure AWS credentials
66+
uses: aws-actions/configure-aws-credentials@v4
67+
if: ${{ !inputs.wiz-image-skip-aws }}
68+
with:
69+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
70+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
71+
aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }}
72+
aws-region: us-east-2
73+
74+
- name: Login to Amazon ECR
75+
id: login-ecr
76+
if: ${{ !inputs.wiz-image-skip-aws }}
77+
uses: aws-actions/amazon-ecr-login@v2
6778

6879
- name: Download prebuilt Docker image
6980
if: ${{ inputs.prebuilt-image-artifact != '' }}
@@ -116,13 +127,19 @@ jobs:
116127
make compose-build
117128
118129
echo "Detecting built images..."
119-
docker compose images
120-
121-
IMAGES=$(docker images --format "{{.Repository}}:{{.Tag}}" | grep "^${REPO_NAME}" | grep -v "^<none>")
130+
# Get all image names from compose, then keep only ones that exist locally (i.e., were actually built)
131+
IMAGES=""
132+
for img in $(docker compose config --images 2>/dev/null | sort -u); do
133+
TAG_IMG=$(echo "$img" | grep -q ':' && echo "$img" || echo "${img}:latest")
134+
if docker image inspect "$TAG_IMG" &>/dev/null; then
135+
IMAGES="${IMAGES}${TAG_IMG} "
136+
fi
137+
done
138+
IMAGES=$(echo "$IMAGES" | xargs)
122139
123140
if [ -z "$IMAGES" ]; then
124-
echo "No images found with prefix ${REPO_NAME}, scanning all recent images"
125-
IMAGES=$(docker images --format "{{.Repository}}:{{.Tag}}" | grep -v "^<none>" | head -5)
141+
echo "⚠️ Could not detect built images from compose config, falling back to repo name match"
142+
IMAGES=$(docker images --format "{{.Repository}}:{{.Tag}}" | grep "^${REPO_NAME}" | grep -v "^<none>")
126143
fi
127144
# Strategy 3: Fallback to standard docker build
128145
else
@@ -293,7 +310,7 @@ jobs:
293310
if: always()
294311
uses: actions/upload-artifact@v4
295312
with:
296-
name: wiz-scan-${{ github.event.repository.name }}
313+
name: ${{ env.ARTIFACT_NAME }}
297314
path: |
298315
/tmp/wiz-scan*.json
299316
/tmp/wiz-scan-results.txt

0 commit comments

Comments
 (0)