Skip to content

Commit 45dba6a

Browse files
kenhyskenhys
authored
GitHub Actions: align summary order and add missing gem information (#461)
* github actions: use descendant order It is useful to check the result of fluentd first. Before: debian -> ruby -> fluentd After: fluentd -> ruby -> debian Signed-off-by: Kentaro Hayashi <hayashi@clear-code.com> * github actions: show bundled gems Show multi-versioned gems in (filter) and full list in (details) section. e.g. docker run --rm fluent/fluentd:v1.19.1-debian-amd64 gem list | grep "," json (2.13.2, default: 2.9.1) rexml (3.4.4, 3.4.0) Signed-off-by: Kentaro Hayashi <hayashi@clear-code.com> --------- Signed-off-by: Kentaro Hayashi <hayashi@clear-code.com>
1 parent 60bfba3 commit 45dba6a

1 file changed

Lines changed: 33 additions & 18 deletions

File tree

‎.github/workflows/scan-images.yml‎

Lines changed: 33 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -11,21 +11,38 @@ concurrency:
1111
cancel-in-progress: true
1212

1313
jobs:
14-
debian:
15-
name: Scan debian image with grype
14+
gem:
15+
name: Show bundled gems
1616
strategy:
1717
fail-fast: false
1818
runs-on: ubuntu-latest
1919
steps:
20-
- name: Pull and scan upstream trixie image
20+
- uses: actions/checkout@v6
21+
- name: Show bundled gems in Fluentd image
2122
run: |
22-
docker pull debian:trixie
23-
echo "# Scan debian image with grype (filter)" >> $GITHUB_STEP_SUMMARY
24-
docker run --rm anchore/grype:latest debian:trixie --ignore-states wont-fix | grep -v Negligible >> $GITHUB_STEP_SUMMARY
25-
echo "# Scan debian image with grype (details)" >> $GITHUB_STEP_SUMMARY
23+
# v1.19.1-debian-amd64
24+
IMAGE=$(make echo-all-images | cut -d' ' -f1|cut -d',' -f3)
25+
echo "# Show bundled gems in Fluentd image (filter)" >> $GITHUB_STEP_SUMMARY
26+
docker run --rm fluent/fluentd:$IMAGE gem list | grep "," >> $GITHUB_STEP_SUMMARY
27+
echo "# Show all bundled gems in Fluentd image (details)" >> $GITHUB_STEP_SUMMARY
28+
docker run --rm fluent/fluentd:$IMAGE gem list >> $GITHUB_STEP_SUMMARY
29+
fluentd:
30+
name: Scan Fluentd image with grype
31+
strategy:
32+
fail-fast: false
33+
runs-on: ubuntu-latest
34+
steps:
35+
- uses: actions/checkout@v6
36+
- name: Pull and scan Fluentd image
37+
run: |
38+
# v1.19.1-debian-amd64
39+
IMAGE=$(make echo-all-images | cut -d' ' -f1|cut -d',' -f3)
40+
echo "# Scan Fluentd image with grype (filter)" >> $GITHUB_STEP_SUMMARY
41+
docker run --rm anchore/grype:latest fluent/fluentd:$IMAGE --ignore-states wont-fix | grep -v Negligible >> $GITHUB_STEP_SUMMARY
42+
echo "# Scan Fluentd image with grype (details)" >> $GITHUB_STEP_SUMMARY
2643
echo "|NAME | INSTALLED | FIXED | IN | TYPE | VULNERABILITY | SEVERITY | EPSS | RISK | |" >> $GITHUB_STEP_SUMMARY
2744
echo "|---| ---|---|---|----|---|---|---|---|---|" >> $GITHUB_STEP_SUMMARY
28-
docker run --rm anchore/grype:latest debian:trixie | sed -e "s/won't fix/won'tfix/g" | grep -v "^NAME" | sed 's/^/|/; s/ */ | /g; s/$/ |/' >> $GITHUB_STEP_SUMMARY
45+
docker run --rm anchore/grype:latest fluent/fluentd:$IMAGE | sed -e "s/won't fix/won'tfix/g" | grep -v "^NAME" | sed 's/^/|/; s/ */ | /g; s/$/ |/' >> $GITHUB_STEP_SUMMARY
2946
ruby:
3047
name: Scan Ruby image with grype
3148
strategy:
@@ -41,20 +58,18 @@ jobs:
4158
echo "|NAME | INSTALLED | FIXED | IN | TYPE | VULNERABILITY | SEVERITY | EPSS | RISK | |" >> $GITHUB_STEP_SUMMARY
4259
echo "|---| ---|---|---|----|---|---|---|---|---|" >> $GITHUB_STEP_SUMMARY
4360
docker run --rm anchore/grype:latest ruby:3.4-slim | sed -e "s/won't fix/won'tfix/g" | grep -v "^NAME" | sed 's/^/|/; s/ */ | /g; s/$/ |/' >> $GITHUB_STEP_SUMMARY
44-
fluentd:
45-
name: Scan Fluentd image with grype
61+
debian:
62+
name: Scan debian image with grype
4663
strategy:
4764
fail-fast: false
4865
runs-on: ubuntu-latest
4966
steps:
50-
- uses: actions/checkout@v6
51-
- name: Pull and scan Fluentd image
67+
- name: Pull and scan upstream trixie image
5268
run: |
53-
# v1.19.1-debian-amd64
54-
IMAGE=$(make echo-all-images | cut -d' ' -f1|cut -d',' -f3)
55-
echo "# Scan Fluentd image with grype (filter)" >> $GITHUB_STEP_SUMMARY
56-
docker run --rm anchore/grype:latest fluent/fluentd:$IMAGE --ignore-states wont-fix | grep -v Negligible >> $GITHUB_STEP_SUMMARY
57-
echo "# Scan Fluentd image with grype (details)" >> $GITHUB_STEP_SUMMARY
69+
docker pull debian:trixie
70+
echo "# Scan debian image with grype (filter)" >> $GITHUB_STEP_SUMMARY
71+
docker run --rm anchore/grype:latest debian:trixie --ignore-states wont-fix | grep -v Negligible >> $GITHUB_STEP_SUMMARY
72+
echo "# Scan debian image with grype (details)" >> $GITHUB_STEP_SUMMARY
5873
echo "|NAME | INSTALLED | FIXED | IN | TYPE | VULNERABILITY | SEVERITY | EPSS | RISK | |" >> $GITHUB_STEP_SUMMARY
5974
echo "|---| ---|---|---|----|---|---|---|---|---|" >> $GITHUB_STEP_SUMMARY
60-
docker run --rm anchore/grype:latest fluent/fluentd:$IMAGE | sed -e "s/won't fix/won'tfix/g" | grep -v "^NAME" | sed 's/^/|/; s/ */ | /g; s/$/ |/' >> $GITHUB_STEP_SUMMARY
75+
docker run --rm anchore/grype:latest debian:trixie | sed -e "s/won't fix/won'tfix/g" | grep -v "^NAME" | sed 's/^/|/; s/ */ | /g; s/$/ |/' >> $GITHUB_STEP_SUMMARY

0 commit comments

Comments
 (0)