rusackas commented on code in PR #44035:
URL: https://github.com/apache/superset/pull/44035#discussion_r3963692978
##########
.github/workflows/docker.yml:
##########
@@ -213,6 +219,31 @@ jobs:
docker images $IMAGE_TAG
docker history $IMAGE_TAG
+ # Scan the built image for known vulnerabilities and publish results
+ # to the Security tab. Trivy did this until #38780 removed it: both
+ # aquasecurity/trivy-action and the trivy binary itself were
+ # compromised (twice) to steal GitHub Secrets from CI runs. Grype is a
+ # different tool from a different maintainer with no shared supply
+ # chain, and is already on the ASF Infra GitHub Actions allowlist.
+ - name: Scan built image for vulnerabilities
+ if: github.event_name == 'push' && github.ref == 'refs/heads/master'
&& matrix.build_preset == 'lean'
Review Comment:
Correct, added `.github/workflows/docker.yml` to the `docker` category in
`change_detector.py` so a workflow-only edit (like this PR) still triggers
`docker-build` instead of silently skipping it.
##########
.github/workflows/docker.yml:
##########
@@ -213,6 +219,31 @@ jobs:
docker images $IMAGE_TAG
docker history $IMAGE_TAG
+ # Scan the built image for known vulnerabilities and publish results
+ # to the Security tab. Trivy did this until #38780 removed it: both
+ # aquasecurity/trivy-action and the trivy binary itself were
+ # compromised (twice) to steal GitHub Secrets from CI runs. Grype is a
+ # different tool from a different maintainer with no shared supply
+ # chain, and is already on the ASF Infra GitHub Actions allowlist.
+ - name: Scan built image for vulnerabilities
+ if: github.event_name == 'push' && github.ref == 'refs/heads/master'
&& matrix.build_preset == 'lean'
+ id: grype-scan
+ uses: anchore/scan-action@27805bf3b4e84b4a5c980df22ed233c00390a439 #
v7.4.2
+ with:
+ image: ${{ env.IMAGE_TAG }}
+ output-format: sarif
+ severity-cutoff: high
+ only-fixed: true
+ # Informational only, matching the prior Trivy setup: this
+ # workflow does not gate merges on scan findings.
+ fail-build: false
+
+ - name: Upload vulnerability scan results to GitHub Security tab
+ if: github.event_name == 'push' && github.ref == 'refs/heads/master'
&& matrix.build_preset == 'lean'
+ uses:
github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 #
v4.37.9
+ with:
+ sarif_file: ${{ steps.grype-scan.outputs.sarif }}
Review Comment:
Fixed, added `continue-on-error: true` on both the scan and upload steps,
and gated the upload on the scan actually producing a SARIF file.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
