Bump fluxcd/flux2 from 3b42b200d376430f0e24d35f1a600447d92da531 to 896e0fa46d5107a05e953dd0a5261d78a145ec8c #2454
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Scan | |
| on: | |
| push: | |
| branches: [ main ] | |
| pull_request: | |
| branches: [ main ] | |
| schedule: | |
| - cron: '18 10 * * 3' | |
| permissions: | |
| contents: read # for actions/checkout to fetch code | |
| jobs: | |
| fossa: | |
| name: FOSSA | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 | |
| - name: Run FOSSA scan and upload build data | |
| uses: fossa-contrib/fossa-action@6728dc6fe9a068c648d080c33829ffbe56565023 # v2.0.0 | |
| with: | |
| # FOSSA Push-Only API Token | |
| fossa-api-key: b429fea44d610229ac091ed8d1223bb9 | |
| github-token: ${{ github.token }} | |
| codeql: | |
| name: CodeQL | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write # for codeQL to write security events | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@04daf014b50eaf774287bf3f0f1869d4b4c4b913 # v2.21.7 | |
| with: | |
| languages: go | |
| - name: Autobuild | |
| uses: github/codeql-action/autobuild@04daf014b50eaf774287bf3f0f1869d4b4c4b913 # v2.21.7 | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@04daf014b50eaf774287bf3f0f1869d4b4c4b913 # v2.21.7 | |
| trivy: | |
| name: Trivy | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0 | |
| - name: Build tofu-controller image | |
| run: | | |
| make docker-buildx | |
| - name: Run Trivy vulnerability scanner on controller image | |
| uses: aquasecurity/trivy-action@fbd16365eb88e12433951383f5e99bd901fc618f # v0.12.0 | |
| with: | |
| image-ref: 'ghcr.io/flux-iac/tofu-controller:latest' | |
| format: 'table' | |
| exit-code: '1' | |
| ignore-unfixed: true | |
| vuln-type: 'os,library' | |
| severity: 'CRITICAL,HIGH' | |
| - name: Run Trivy vulnerability scanner on runner image | |
| uses: aquasecurity/trivy-action@fbd16365eb88e12433951383f5e99bd901fc618f # v0.12.0 | |
| with: | |
| image-ref: 'ghcr.io/flux-iac/tf-runner:latest' | |
| format: 'table' | |
| exit-code: '1' | |
| ignore-unfixed: true | |
| vuln-type: 'os,library' | |
| severity: 'CRITICAL,HIGH' | |
| skip-files: '/usr/local/bin/terraform' # false positive | |
| - name: Run Trivy vulnerability scanner on runner image | |
| uses: aquasecurity/trivy-action@fbd16365eb88e12433951383f5e99bd901fc618f # v0.12.0 | |
| with: | |
| image-ref: 'ghcr.io/flux-iac/tf-runner-azure:latest' | |
| format: 'table' | |
| exit-code: '1' | |
| ignore-unfixed: true | |
| vuln-type: 'os,library' | |
| severity: 'CRITICAL,HIGH' | |
| skip-files: '/usr/local/bin/terraform' # false positive | |
| - name: Run Trivy vulnerability scanner on planner image | |
| uses: aquasecurity/trivy-action@fbd16365eb88e12433951383f5e99bd901fc618f # v0.12.0 | |
| with: | |
| image-ref: 'ghcr.io/flux-iac/branch-planner:latest' | |
| format: 'table' | |
| exit-code: '1' | |
| ignore-unfixed: true | |
| vuln-type: 'os,library' | |
| severity: 'CRITICAL,HIGH' | |
| skip-files: '/usr/local/bin/terraform' # false positive |