ci: add CodeQL and Grype image scan - #872
ramantehlan wants to merge 4 commits into
Conversation
Signed-off-by: Raman Tehlan <ramantehlan@gmail.com>
|
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
| with: | ||
| enable_ecr_auth: true | ||
| image_artifact_name: ${{ github.event.repository.name }} | ||
| artifactory_repository_url: ${{ vars.TRUEFOUNDRY_ARTIFACTORY_PRIVATE_REPOSITORY }} |
There was a problem hiding this comment.
Image scan uses private registry
Medium Severity
artifactory_repository_url is set to TRUEFOUNDRY_ARTIFACTORY_PRIVATE_REPOSITORY, but every image build in this repo publishes to TRUEFOUNDRY_ARTIFACTORY_PUBLIC_REPOSITORY. The Grype job will resolve or tag trueforge in the wrong registry, so the daily scan misses the images this repo actually ships.
Reviewed by Cursor Bugbot for commit 6a5312e. Configure here.
Signed-off-by: Raman Tehlan <ramantehlan@gmail.com>
Signed-off-by: Raman Tehlan <ramantehlan@gmail.com>
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 2 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 6b07562. Configure here.
| jobs: | ||
| image-scan: | ||
| name: Image Vulnerability Scan | ||
| uses: truefoundry/github-workflows-public/.github/workflows/update-grype-report.yml@main |
There was a problem hiding this comment.
Grype report cannot update repository
High Severity
update-grype-report.yml commits .grype.yaml updates and opens a pull request. This caller no longer grants contents: write or passes workflow_repo_token, so those write steps cannot succeed even if a scan image is built.
Reviewed by Cursor Bugbot for commit 6b07562. Configure here.
Signed-off-by: Raman Tehlan <ramantehlan@gmail.com>
| name: Resolve APP_VERSION | ||
| runs-on: ubuntu-latest | ||
| outputs: | ||
| app_version: ${{ steps.app.outputs.app_version }} | ||
| steps: | ||
| - uses: actions/checkout@v7 | ||
| - id: app | ||
| run: | | ||
| APP_VERSION=$(yq -r '.appVersion' charts/trueforge/Chart.yaml) | ||
| echo "app_version=$APP_VERSION" >> "$GITHUB_OUTPUT" | ||
|
|
||
| image-scan: |
| name: Image Vulnerability Scan | ||
| needs: [resolve] | ||
| uses: truefoundry/github-workflows-public/.github/workflows/update-grype-report.yml@main | ||
| with: | ||
| dockerfile_path: 'Dockerfile' | ||
| image_artifact_name: 'trueforge' | ||
| artifactory_repository_url: ${{ vars.TRUEFOUNDRY_ARTIFACTORY_PUBLIC_REPOSITORY }} | ||
| image_build_args: | | ||
| APP_VERSION=${{ needs.resolve.outputs.app_version }} |
This branch has not been deployed
2 participants
Summary
main, weekly schedule).truefoundry/workflowsupdate-grype-report.yml.workflow_dispatch(and image-scanpull_request) so these can be tested on this PR; remove after the first successful run.Test plan
Note
Low Risk
Changes are limited to new CI workflows and permissions for security scanning; no application or runtime behavior is modified.
Overview
Adds automated security scanning in GitHub Actions: a new CodeQL Advanced workflow and a Grype container image scan wired through existing TrueFoundry reusable workflows.
The CodeQL job runs on pushes and PRs to
main, on a weekly schedule, and (temporarily) viaworkflow_dispatch. It analyzes Actions, JavaScript/TypeScript, and Python withbuild-mode: none, uploads results withsecurity-events: write, and usesubuntu-latest(ormacos-latestfor Swift if added later).The Grype workflow resolves
appVersionfromcharts/trueforge/Chart.yaml, then callstruefoundry/github-workflows-public’supdate-grype-report.ymlto build from the repoDockerfileand scan thetrueforgeimage using the org Artifactory URL variable. It runs daily on a schedule plus temporarypull_requestandworkflow_dispatchtriggers so the pipeline can be validated on this PR before those extras are removed.Reviewed by Cursor Bugbot for commit c42363f. Bugbot is set up for automated code reviews on this repo. Configure here.