upstream-ory-keto/.github/workflows/cve-scan.yaml

# AUTO-GENERATED, DO NOT EDIT!
# Please edit the original at https://github.com/ory/meta/blob/master/templates/repository/server/.github/workflows/cve-scan.yaml

name: Docker Image Scanners
on:
  workflow_dispatch:
  push:
    branches:
      - "master"
    tags:
      - "v*.*.*"
  pull_request:
    branches:
      - "master"

permissions:
  contents: read
  security-events: write

jobs:
  scanners:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7
      - name: Setup Env
        id: vars
        shell: bash
        run: |
          # Store values in local variables
          SHA_SHORT=$(git rev-parse --short HEAD)
          REPO_NAME=${{ github.event.repository.name }}

          IMAGE_NAME="oryd/${REPO_NAME}:${SHA_SHORT}"

          # Output values for debugging
          echo "Values to be set:"
          echo "SHA_SHORT:  ${SHA_SHORT}"
          echo "REPO_NAME:  ${REPO_NAME}"
          echo "IMAGE_NAME: ${IMAGE_NAME}"

          # Set GitHub Environment variables
          echo "SHA_SHORT=${SHA_SHORT}" >> "${GITHUB_ENV}"
          echo "IMAGE_NAME=${IMAGE_NAME}" >> "${GITHUB_ENV}"
      - name: Set up QEMU
        uses: docker/setup-qemu-action@v4
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
        with:
          driver: docker
      - name: Build images
        shell: bash
        run: |
          IMAGE_TAG="${{ env.SHA_SHORT }}" make docker

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v4
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Anchore Scanner
        uses: anchore/scan-action@v7
        id: grype-scan
        with:
          image: ${{ env.IMAGE_NAME }}
          fail-build: true
          severity-cutoff: high
          add-cpes-if-none: true
      - name: Inspect action SARIF report
        shell: bash
        if: ${{ always() }}
        run: |
          echo "::group::Anchore Scan Details"
          jq '.runs[0].results' ${{ steps.grype-scan.outputs.sarif }}
          echo "::endgroup::"
      - name: Anchore upload scan SARIF report
        if: always()
        uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: ${{ steps.grype-scan.outputs.sarif }}
      - name: Kubescape scanner
        uses: kubescape/github-action@main
        id: kubescape
        with:
          image: ${{ env.IMAGE_NAME }}
          verbose: true
          format: pretty-printer
          # can't whitelist CVE yet: https://github.com/kubescape/kubescape/pull/1568
          severityThreshold: critical
      - name: Dockle Linter
        uses: erzz/dockle-action@v1
        if: ${{ always() }}
        with:
          image: ${{ env.IMAGE_NAME }}
          exit-code: 42
          failure-threshold: high
      - name: Hadolint
        uses: hadolint/hadolint-action@v3.3.0
        id: hadolint
        if: ${{ always() }}
        with:
          dockerfile: .docker/Dockerfile-build
          verbose: true
          format: "json"
          failure-threshold: "error"
      - name: View Hadolint results
        if: ${{ always() }}
        shell: bash
        run: |
          echo "::group::Hadolint Scan Details"
          echo "${HADOLINT_RESULTS}" | jq '.'
          echo "::endgroup::"