Use digest-pinned BCI Nano for the static CLI #2
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Container timezone regression | |
| on: | |
| pull_request: | |
| branches: [main] | |
| paths: | |
| - 'main.go' | |
| - 'go.mod' | |
| - 'go.sum' | |
| - 'docker/**' | |
| - '.goreleaser.yml' | |
| - '.github/workflows/container-timezones.yml' | |
| workflow_dispatch: | |
| permissions: {} | |
| jobs: | |
| timezone: | |
| name: Timezones, build and scans (${{ matrix.arch }}) | |
| permissions: | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - arch: amd64 | |
| runner: ubuntu-24.04 | |
| trivy_arch: 64bit | |
| - arch: arm64 | |
| runner: ubuntu-24.04-arm | |
| trivy_arch: ARM64 | |
| runs-on: ${{ matrix.runner }} | |
| timeout-minutes: 20 | |
| env: | |
| ARCH: ${{ matrix.arch }} | |
| TRIVY_ARCH: ${{ matrix.trivy_arch }} | |
| IMAGE: cli-timezone-candidate | |
| steps: | |
| - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 | |
| with: | |
| persist-credentials: false | |
| ref: ${{ github.event.pull_request.head.sha || github.sha }} | |
| - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 | |
| with: | |
| go-version-file: go.mod | |
| cache: false | |
| - name: Build release-style binary and container | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| mkdir -p "$RUNNER_TEMP/build" evidence | |
| commit=$(git rev-parse HEAD) | |
| date=$(date -u +%Y-%m-%dT%H:%M:%SZ) | |
| CGO_ENABLED=0 GOOS=linux GOARCH="$ARCH" go build \ | |
| -ldflags "-s -w -X github.com/stackvista/stackstate-cli/static_info.Version=timezone-candidate -X github.com/stackvista/stackstate-cli/static_info.Commit=$commit -X github.com/stackvista/stackstate-cli/static_info.BuildDate=$date -X static_info.builtBy=goreleaser" \ | |
| -o "$RUNNER_TEMP/build/sts" . | |
| git rev-parse HEAD > evidence/source.txt | |
| go version -m "$RUNNER_TEMP/build/sts" > evidence/buildinfo.txt | |
| sha256sum "$RUNNER_TEMP/build/sts" > evidence/binary-sha256.txt | |
| docker build --platform "linux/$ARCH" --provenance=false \ | |
| -t "$IMAGE" -f docker/Dockerfile.goreleaser "$RUNNER_TEMP/build" | |
| docker image inspect "$IMAGE" > evidence/image.json | |
| - name: Check actual CLI timezone output in the container | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| bash docker/test-timezones.sh "$IMAGE" "$ARCH" | tee evidence/timezones.txt | |
| docker run --rm "$IMAGE" version -o json > evidence/version.json | |
| docker run --rm "$IMAGE" --help > evidence/help.txt | |
| - name: Install checksum-verified scanners | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| tools="$RUNNER_TEMP/scanners" | |
| mkdir -p "$tools" | |
| cd "$tools" | |
| trivy_archive="trivy_0.74.0_Linux-${TRIVY_ARCH}.tar.gz" | |
| grype_archive="grype_0.118.0_linux_${ARCH}.tar.gz" | |
| curl -fsSLO "https://github.com/aquasecurity/trivy/releases/download/v0.74.0/$trivy_archive" | |
| curl -fsSLO https://github.com/aquasecurity/trivy/releases/download/v0.74.0/trivy_0.74.0_checksums.txt | |
| grep " $trivy_archive\$" trivy_0.74.0_checksums.txt | sha256sum -c - | |
| tar -xzf "$trivy_archive" trivy | |
| curl -fsSLO "https://github.com/anchore/grype/releases/download/v0.118.0/$grype_archive" | |
| curl -fsSLO https://github.com/anchore/grype/releases/download/v0.118.0/grype_0.118.0_checksums.txt | |
| grep " $grype_archive\$" grype_0.118.0_checksums.txt | sha256sum -c - | |
| tar -xzf "$grype_archive" grype | |
| echo "$tools" >> "$GITHUB_PATH" | |
| - name: Scan vulnerabilities including UNKNOWN and scan secrets separately | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| trivy image --image-src docker --scanners vuln --list-all-pkgs \ | |
| --format json --output evidence/trivy-vuln.json "$IMAGE" | |
| grype "docker:$IMAGE" -o json=evidence/grype.json \ | |
| -o cyclonedx-json=evidence/grype-inventory.json | |
| trivy image --image-src docker --scanners secret --exit-code 1 \ | |
| --format json --output "$RUNNER_TEMP/secrets.json" "$IMAGE" | |
| cp "$RUNNER_TEMP/secrets.json" evidence/trivy-secret.json | |
| trivy version --format json > evidence/trivy-version.json | |
| grype version > evidence/grype-version.txt | |
| grype db status -o json > evidence/grype-db.json | |
| - name: Retain candidate evidence | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4 | |
| with: | |
| name: container-timezones-${{ matrix.arch }} | |
| path: evidence/ | |
| retention-days: 30 | |
| - name: Require supported OS, package inventory and clean vulnerability reports | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| jq -e '.Metadata.OS.Family == "sles" and .Metadata.OS.EOSL != true and | |
| ([.Results[]? | select(.Class == "os-pkgs") | .Packages[]?] | length > 0) and | |
| ([.Results[]?.Vulnerabilities[]?] | length == 0)' evidence/trivy-vuln.json | |
| echo 'Require Grype RPM inventory from its CycloneDX report' | |
| jq -e '[.components[]? | select((.purl // "") | startswith("pkg:rpm/"))] | |
| | length > 0' evidence/grype-inventory.json | |
| echo 'Require zero Grype vulnerability matches' | |
| jq -e '.matches | type == "array" and length == 0' evidence/grype.json |