diff --git a/.docs/cve_scan.md b/.docs/cve_scan.md index fa00739..82b7d5f 100644 --- a/.docs/cve_scan.md +++ b/.docs/cve_scan.md @@ -2,7 +2,7 @@ ## Description This CI runs a Trivy CVE and License scan against module images and their submodule images, then uploads reports to DefectDojo. -The action clones the [cve-scan](https://github.com/deckhouse/cve-scan) scripts and runs them. The script resolves the registry and tag (release vs dev) from *source_tag* and *case*. If your module uses non-standard paths in registries, set *module_prod_registry_custom_path* and *module_dev_registry_custom_path*. +The action clones the [cve-scan](https://github.com/deckhouse/cve-scan) scripts and runs them. It passes action inputs to the script as `CS_*` environment variables. The script resolves the registry and tag (release vs dev) from *source_tag* and *case*. If your module uses non-standard paths in registries, set *module_prod_registry_custom_path* and *module_dev_registry_custom_path*. **CI use cases:** - **Scheduled** — scan main and several latest releases (e.g. 2–3 times a week) @@ -26,9 +26,11 @@ deckhouse/modules-actions/cve_scan@main | `scan_several_latest_releases` | Optional. Scan several latest releases. `true`/`false`. Default: `false` | | `latest_releases_amount` | Optional. How many latest releases to scan. Default: `3` | | `release_in_dev` | Optional. If `true`, the release tag is taken from the dev registry. Default: `false` | -| `trivy_reports_log_output` | Optional. Trivy report verbosity in logs: `0` — off, `1` — CVE/FS only, `2` — CVE + License. Default: `1` | +| `trivy_reports_log_output` | Optional. Trivy report verbosity in logs: `0` — off, `1` — CVE report, `2` — license report. Default: `1` | | `module_prod_registry_custom_path` | Custom path for the module in the prod registry. Default: `deckhouse/fe/modules` | | `module_dev_registry_custom_path` | Custom path for the module in the dev registry. Default: `sys/deckhouse-oss/modules` | +| `digest_from_werf` | Prefix of Werf image digest files for CSE external modules. Default: `images_tags_werf` | +| `scan_users` | Enable container-user validation for CSE. `true`/`false`. Default: `false` | | `workdir` | Working directory for scan artifacts. Default: `cve-scan` | ### Required inputs @@ -75,7 +77,7 @@ on: description: 'If true, release tag is taken from dev registry. Default: false' required: false trivy_reports_log_output: - description: 'Optional. 0=off, 1=CVE only, 2=CVE+License. Default: 1' + description: 'Optional. 0=off, 1=CVE report, 2=license report. Default: 1' required: false external_module_name: description: 'For External Modules: module name to scan' @@ -92,7 +94,7 @@ on: ``` ### Example: External Modules (e.g. csi-ceph) -Use your own Vault or repo secrets for **registry** credentials (and anything else outside the built-in list). DefectDojo, CODEOWNERS, Deckhouse private repo, and cve-scan clone credentials are imported by the action itself; the `dd_*`, `codeowners_*`, `deckhouse_private_repo`, and `cve_*` inputs in the snippet below can remain placeholders if your action version still requires them, or follow your organization’s convention. +Pass registry credentials from repository or organization secrets. DefectDojo, CODEOWNERS, Deckhouse private repo, and cve-scan clone credentials are imported by the action from BOB. ```yaml cve_scan_on_pr: @@ -149,7 +151,7 @@ Use your own Vault or repo secrets for **registry** credentials (and anything el ``` ### Example: case: deckhouse -For the main Deckhouse repo, *case* is `deckhouse` and *source_tag* is set from the workflow (e.g. from a previous step like `steps.scan_type.outputs.tag`). Registry credentials must be imported from BOB secrets. The job still needs `id-token: write` because of the built-in Vault step. +For the main Deckhouse repo, *case* is `deckhouse` and *source_tag* is set from the workflow (e.g. from a previous step like `steps.scan_type.outputs.tag`). Provide registry credentials as workflow secrets. The job still needs `id-token: write` because of the built-in Vault step. ```yaml - uses: deckhouse/modules-actions/cve_scan@main diff --git a/.examples/cve_scan.yml b/.examples/cve_scan.yml index e59de77..ebb72ba 100644 --- a/.examples/cve_scan.yml +++ b/.examples/cve_scan.yml @@ -29,7 +29,7 @@ on: description: 'If true, release tag is taken from dev registry. Default: false' required: false trivy_reports_log_output: - description: 'Optional. 0=off, 1=CVE only, 2=CVE+License. Default: 1' + description: 'Optional. 0=off, 1=CVE report, 2=license report. Default: 1' required: false external_module_name: description: 'For External Modules: module name whose tag will be scanned' @@ -50,7 +50,7 @@ jobs: REPO: ${{ github.event.repository.name }} run: echo "role_name=${REPO##*/}" >> $GITHUB_OUTPUT - uses: actions/checkout@v4 - - uses: deckhouse/modules-actions/cve_scan@new_cve_scan + - uses: deckhouse/modules-actions/cve_scan@main with: source_tag: 'pr${{ github.event.number }}' case: "External Modules" @@ -78,7 +78,7 @@ jobs: REPO: ${{ github.event.repository.name }} run: echo "role_name=${REPO##*/}" >> $GITHUB_OUTPUT - uses: actions/checkout@v4 - - uses: deckhouse/modules-actions/cve_scan@new_cve_scan + - uses: deckhouse/modules-actions/cve_scan@main with: source_tag: ${{ github.event.inputs.release_branch || github.event.repository.default_branch }} case: "External Modules" diff --git a/cve_scan/action.yml b/cve_scan/action.yml index 0df55b0..66af0f3 100644 --- a/cve_scan/action.yml +++ b/cve_scan/action.yml @@ -1,5 +1,5 @@ name: 'Trivy CVE Scan' -description: 'Build Deckhouse module' +description: 'Scan container images for CVEs and licenses and upload reports to DefectDojo' inputs: prod_registry: description: 'Prod registry host (e.g., registry.deckhouse.io)' @@ -19,29 +19,11 @@ inputs: dev_registry_password: description: 'Password for dev-registry authentication' required: true - codeowners_repo_token: - description: 'Fox token for downloading CODEOWNERS configmap' - required: true - deckhouse_private_repo: - description: 'Deckhouse private repository' - required: true - dd_url: - description: 'DefectDojo API URL' - required: true - dd_token: - description: 'DefectDojo API token' - required: true source_tag: description: 'Tag to scan (e.g., main, v1.74.3, pr123, release-1.73)' required: true case: - description: 'Scan type: deckhouse | external_modules | CSE' - required: true - cve_test_repo_git: - description: 'cve_scan repo' - required: true - cve_ssh_private_key: - description: 'cve_scan repo key' + description: 'Scan type: deckhouse | External Modules | CSE' required: true external_module_name: description: 'External module name (required when case=External Modules)' @@ -68,7 +50,7 @@ inputs: required: false default: 'False' digest_from_werf: - description: 'Path to werf images tags file (for CSE external modules)' + description: 'Prefix of Werf image digest files (for CSE external modules)' required: false default: 'images_tags_werf' scan_users: @@ -80,12 +62,12 @@ inputs: required: false default: 'cve-scan' trivy_reports_log_output: - description: 'Trivy log output level (0=off, 1=CVE only, 2=CVE+License)' + description: 'Trivy log output level (0=off, 1=CVE report, 2=license report)' required: false default: '1' role_name: description: 'Repository name' - required: false + required: true runs: using: "composite" @@ -123,42 +105,42 @@ runs: shell: bash run: | rm -rf /tmp/cve-scripts - git clone --depth 1 --branch v1.0 ${{ steps.secrets.outputs.CVE_TEST_REPO_GIT }} /tmp/cve-scripts - cp /tmp/cve-scripts/* ./ + git clone --depth 1 --branch v2.0 "${{ steps.secrets.outputs.CVE_TEST_REPO_GIT }}" /tmp/cve-scripts + cp /tmp/cve-scripts/*.sh /tmp/cve-scripts/*.py ./ + chmod +x *.sh *.py - name: Run Trivy CVE Scan shell: bash env: - TRIVY_BIN_VERSION: "v0.67.2" - TRIVY_REPO_ID: "2181" - TRIVY_PROD_REGISTRY: "registry.deckhouse.io" - TRIVY_DEV_REGISTRY: "dev-registry.deckhouse.io" - TRIVY_DB_URL: "${{ inputs.prod_registry }}/deckhouse/ee/security/trivy-db:2" - TRIVY_JAVA_DB_URL: "${{ inputs.prod_registry }}/deckhouse/ee/security/trivy-java-db:1" - TRIVY_POLICY_URL: "${{ inputs.prod_registry }}/deckhouse/ee/security/trivy-bdu:1" - TRIVY_REPORTS_LOG_OUTPUT: "${{ inputs.trivy_reports_log_output }}" - PROD_REGISTRY: "${{ inputs.prod_registry }}" - PROD_REGISTRY_USER: "${{ inputs.prod_registry_user }}" - PROD_REGISTRY_PASSWORD: "${{ inputs.prod_registry_password }}" - DEV_REGISTRY: "${{ inputs.dev_registry }}" - DEV_REGISTRY_USER: "${{ inputs.dev_registry_user }}" - DEV_REGISTRY_PASSWORD: "${{ inputs.dev_registry_password }}" - SOURCE_TAG: "${{ inputs.source_tag }}" - CASE: "${{ inputs.case }}" - EXTERNAL_MODULE_NAME: "${{ inputs.external_module_name }}" - RELEASE_IN_DEV: "${{ inputs.release_in_dev }}" - SCAN_USERS: "${{ inputs.scan_users }}" - SCAN_SEVERAL_LATEST_RELEASES: "${{ inputs.scan_several_latest_releases }}" - LATEST_RELEASES_AMOUNT: "${{ inputs.latest_releases_amount }}" - MODULE_PROD_REGISTRY_CUSTOM_PATH: "${{ inputs.module_prod_registry_custom_path }}" - MODULE_DEV_REGISTRY_CUSTOM_PATH: "${{ inputs.module_dev_registry_custom_path }}" - DIGEST_FROM_WERF: "${{ inputs.digest_from_werf }}" - DD_URL: "${{ steps.secrets.outputs.DD_URL }}" - DD_TOKEN: "${{ steps.secrets.outputs.DD_TOKEN }}" - CODEOWNERS_REPO_TOKEN: "${{ steps.secrets.outputs.CODEOWNERS_REPO_TOKEN }}" - DECKHOUSE_PRIVATE_REPO: "${{ steps.secrets.outputs.DECKHOUSE_PRIVATE_REPO }}" - CONFIGMAP_PROJECT_ID: "4352" - WORKDIR: "${{ github.workspace }}/${{ inputs.workdir }}" + CS_TRIVY_BIN_VERSION: "v0.67.2" + CS_TRIVY_REPO_ID: "2181" + CS_TRIVY_PROD_REGISTRY: "${{ inputs.prod_registry }}" + CS_TRIVY_DB_URL: "${{ inputs.prod_registry }}/deckhouse/ee/security/trivy-db:2" + CS_TRIVY_JAVA_DB_URL: "${{ inputs.prod_registry }}/deckhouse/ee/security/trivy-java-db:1" + CS_TRIVY_POLICY_URL: "${{ inputs.prod_registry }}/deckhouse/ee/security/trivy-bdu:1" + CS_TRIVY_REPORTS_LOG_OUTPUT: "${{ inputs.trivy_reports_log_output }}" + CS_PROD_REGISTRY: "${{ inputs.prod_registry }}" + CS_PROD_REGISTRY_USER: "${{ inputs.prod_registry_user }}" + CS_PROD_REGISTRY_PASSWORD: "${{ inputs.prod_registry_password }}" + CS_DEV_REGISTRY: "${{ inputs.dev_registry }}" + CS_DEV_REGISTRY_USER: "${{ inputs.dev_registry_user }}" + CS_DEV_REGISTRY_PASSWORD: "${{ inputs.dev_registry_password }}" + CS_SOURCE_TAG: "${{ inputs.source_tag }}" + CS_CASE: "${{ inputs.case }}" + CS_EXTERNAL_MODULE_NAME: "${{ inputs.external_module_name }}" + CS_RELEASE_IN_DEV: "${{ inputs.release_in_dev }}" + CS_SCAN_USERS: "${{ inputs.scan_users }}" + CS_SCAN_SEVERAL_LATEST_RELEASES: "${{ inputs.scan_several_latest_releases }}" + CS_LATEST_RELEASES_AMOUNT: "${{ inputs.latest_releases_amount }}" + CS_MODULE_PROD_REGISTRY_CUSTOM_PATH: "${{ inputs.module_prod_registry_custom_path }}" + CS_MODULE_DEV_REGISTRY_CUSTOM_PATH: "${{ inputs.module_dev_registry_custom_path }}" + CS_DIGEST_FROM_WERF: "${{ inputs.digest_from_werf }}" + CS_DD_URL: "${{ steps.secrets.outputs.DD_URL }}" + CS_DD_TOKEN: "${{ steps.secrets.outputs.DD_TOKEN }}" + CS_CODEOWNERS_REPO_TOKEN: "${{ steps.secrets.outputs.CODEOWNERS_REPO_TOKEN }}" + CS_DECKHOUSE_PRIVATE_REPO: "${{ steps.secrets.outputs.DECKHOUSE_PRIVATE_REPO }}" + CS_CONFIGMAP_PROJECT_ID: "4352" + CS_WORKDIR: "${{ github.workspace }}/${{ inputs.workdir }}" run: | ./cve_scan.sh diff --git a/gitleaks/action.yml b/gitleaks/action.yml index 71a79ca..f26fe2c 100644 --- a/gitleaks/action.yml +++ b/gitleaks/action.yml @@ -25,7 +25,7 @@ runs: uses: actions/checkout@v4 if: ${{ inputs.scan_mode == 'diff' }} with: - ref: refs/pull/${{ github.event.number }}/merge + ref: ${{ github.event.pull_request.head.sha }} fetch-depth: 0 persist-credentials: false