mirror of
https://github.com/open-metadata/OpenMetadata.git
synced 2026-01-07 13:07:22 +00:00
80 lines
2.6 KiB
YAML
80 lines
2.6 KiB
YAML
name: Trivy Scan For OpenMetadata Ingestion Base Slim Docker Image
|
|
|
|
on:
|
|
pull_request_target:
|
|
types: [labeled, opened, synchronize, reopened, ready_for_review]
|
|
paths:
|
|
- "**/*.py"
|
|
- "ingestion/operators/docker/Dockerfile.ci"
|
|
|
|
concurrency:
|
|
group: trivy-ingestion-base-slim-scan-${{ github.head_ref || github.run_id }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
build-and-scan:
|
|
runs-on: ubuntu-latest
|
|
if: ${{ !github.event.pull_request.draft }}
|
|
permissions:
|
|
pull-requests: write
|
|
steps:
|
|
- name: Wait for the labeler
|
|
uses: lewagon/wait-on-check-action@v1.3.4
|
|
if: ${{ github.event_name == 'pull_request_target' }}
|
|
with:
|
|
ref: ${{ github.event.pull_request.head.sha }}
|
|
check-name: Team Label
|
|
repo-token: ${{ secrets.GITHUB_TOKEN }}
|
|
wait-interval: 90
|
|
|
|
- name: Verify PR labels
|
|
uses: jesusvasquez333/verify-pr-label-action@v1.4.0
|
|
if: ${{ github.event_name == 'pull_request_target' }}
|
|
with:
|
|
github-token: '${{ secrets.GITHUB_TOKEN }}'
|
|
valid-labels: 'safe to test'
|
|
pull-request-number: '${{ github.event.pull_request.number }}'
|
|
disable-reviews: true # To not auto approve changes
|
|
|
|
- name: Checkout Repository
|
|
uses: actions/checkout@v4
|
|
with:
|
|
ref: ${{ github.event.pull_request.head.sha }}
|
|
|
|
- name: Prepare for Docker Build
|
|
id: prepare
|
|
uses: ./.github/actions/prepare-for-docker-build
|
|
with:
|
|
image: openmetadata-ingestion-base-slim
|
|
tag: trivy
|
|
is_ingestion: true
|
|
|
|
|
|
- name: Build Docker Image
|
|
run: |
|
|
docker build -t openmetadata-ingestion-base-slim:trivy -f ingestion/operators/docker/Dockerfile.ci .
|
|
|
|
|
|
- name: Run Trivy Image Scan
|
|
id: trivy_scan
|
|
uses: aquasecurity/trivy-action@master
|
|
with:
|
|
scan-type: "image"
|
|
image-ref: openmetadata-ingestion-base-slim:trivy
|
|
hide-progress: false
|
|
ignore-unfixed: true
|
|
severity: "HIGH,CRITICAL"
|
|
skip-dirs: "/opt/airflow/dags,/home/airflow/ingestion/pipelines"
|
|
scan-ref: .
|
|
format: 'template'
|
|
template: "@.github/trivy/templates/github.tpl"
|
|
output: "trivy-result-ingestion-base-slim.md"
|
|
env:
|
|
TRIVY_DISABLE_VEX_NOTICE: "true"
|
|
|
|
- name: Comment Trivy Scan Results on PR
|
|
uses: marocchino/sticky-pull-request-comment@v2
|
|
with:
|
|
path: trivy-result-ingestion-base-slim.md
|
|
header: "trivy-scan-${{ github.workflow }}"
|