69 lines
2.2 KiB
YAML
69 lines
2.2 KiB
YAML
name: scan
|
|
|
|
# Weekly vulnerability check that does not depend on a push. The base image digests
|
|
# in docker/Dockerfile are pinned and refreshed by hand, so a new fixable HIGH or
|
|
# CRITICAL advisory in the pinned image, or a new advisory in the locked
|
|
# dependencies, turns this run red: the reminder to refresh the digests (see the
|
|
# comment at the top of docker/Dockerfile) or bump the dependency.
|
|
#
|
|
# Same rules as ci.yml: third-party actions pinned to a commit SHA, resources named
|
|
# per run and removed by name, no pruning.
|
|
|
|
on:
|
|
schedule:
|
|
- cron: '17 5 * * 1'
|
|
workflow_dispatch:
|
|
|
|
env:
|
|
UV_PYTHON_DOWNLOADS: never
|
|
UV_NO_PROGRESS: "1"
|
|
|
|
jobs:
|
|
image-scan:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
env:
|
|
SCAN_IMAGE: aegis-ci-${{ github.run_id }}-scan:test
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
|
with:
|
|
persist-credentials: false
|
|
- name: Build image
|
|
run: docker build -f docker/Dockerfile -t "${SCAN_IMAGE}" .
|
|
- name: Install Trivy
|
|
shell: bash
|
|
run: |
|
|
bin_dir="${RUNNER_TEMP:-/tmp}/trivy-bin"
|
|
bash scripts/ci/install_trivy.sh "${bin_dir}"
|
|
echo "${bin_dir}" >> "$GITHUB_PATH"
|
|
- name: Scan image
|
|
shell: bash
|
|
run: bash scripts/ci/scan_image.sh "${SCAN_IMAGE}"
|
|
- name: Cleanup
|
|
if: always()
|
|
shell: bash
|
|
run: bash scripts/ci/cleanup_job_resources.sh "${SCAN_IMAGE}"
|
|
|
|
dependency-audit:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 15
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
|
|
with:
|
|
persist-credentials: false
|
|
- name: Set up Python
|
|
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
|
|
with:
|
|
python-version: "3.12"
|
|
- name: Set up uv
|
|
uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
|
|
with:
|
|
version: "0.12.5"
|
|
enable-cache: false
|
|
- name: Install dependencies
|
|
run: uv sync --locked
|
|
- name: Dependency audit
|
|
run: bash scripts/ci/pip_audit.sh
|