Bump aquasecurity/trivy-action from 0.35.0 to 0.36.0 in the gh-actions group #87
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI (lint, build, scan, e2e) | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| security-events: write # für SARIF Upload (Trivy) | |
| jobs: | |
| lint: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| dockerfile: | |
| - Dockerfile-loganalyzer | |
| - Dockerfile-syslogng | |
| - Dockerfile-dbcleanup | |
| # optional: falls du zusätzlich einen "Dockerfile" im Root hast | |
| # - Dockerfile | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Hadolint | |
| uses: hadolint/hadolint-action@v3.3.0 | |
| with: | |
| dockerfile: ${{ matrix.dockerfile }} # <-- genau 1 Datei | |
| config: .hadolint.yaml | |
| failure-threshold: warning | |
| # ShellCheck (alle Shell-Skripte) | |
| - name: ShellCheck | |
| uses: ludeeus/action-shellcheck@2.0.0 | |
| with: | |
| scandir: . | |
| # Beispiel-Excludes – falls du welche brauchst: | |
| ignore_names: | | |
| *.log | |
| *.sql | |
| # Yamllint (.yml/.yaml) | |
| - name: Yamllint | |
| uses: ibiqlik/action-yamllint@v3 | |
| with: | |
| config_file: .yamllint.yaml | |
| file_or_dir: | | |
| . | |
| strict: true | |
| build_and_scan: | |
| runs-on: ubuntu-latest | |
| if: github.event_name != 'pull_request' | |
| needs: lint | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| image: | |
| - name: loganalyzer | |
| dockerfile: Dockerfile-loganalyzer | |
| context: . | |
| - name: syslogng | |
| dockerfile: Dockerfile-syslogng | |
| context: . | |
| - name: dbcleanup | |
| dockerfile: Dockerfile-dbcleanup | |
| context: . | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@v4 | |
| - name: Set up Buildx | |
| uses: docker/setup-buildx-action@v4 | |
| - name: Docker meta (tags + labels) | |
| id: meta | |
| uses: docker/metadata-action@v6 | |
| with: | |
| images: | | |
| ghcr.io/${{ github.repository_owner }}/${{ matrix.image.name }} | |
| tags: | | |
| type=ref,event=branch | |
| type=ref,event=pr | |
| type=sha | |
| labels: | | |
| org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }} | |
| org.opencontainers.image.revision=${{ github.sha }} | |
| - name: Build (multi-arch, no push) | |
| uses: docker/build-push-action@v7 | |
| with: | |
| context: ${{ matrix.image.context }} | |
| file: ${{ matrix.image.dockerfile }} | |
| platforms: linux/amd64,linux/arm64 | |
| push: false | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| # Trivy Image Scan (SARIF) | |
| - name: Trivy scan | |
| uses: aquasecurity/trivy-action@v0.36.0 | |
| with: | |
| scan-type: image | |
| image-ref: ${{ fromJSON(steps.meta.outputs.json).tags[0] }} | |
| format: sarif | |
| output: trivy-${{ matrix.image.name }}.sarif | |
| vuln-type: 'os,library' | |
| severity: 'CRITICAL,HIGH,MEDIUM' | |
| ignore-unfixed: true | |
| - name: Upload SARIF | |
| uses: github/codeql-action/upload-sarif@v4 | |
| with: | |
| sarif_file: trivy-${{ matrix.image.name }}.sarif | |
| trivy-pr-local: | |
| name: Trivy (PR, local image scan) | |
| if: github.event_name == 'pull_request' # läuft NUR bei PRs (inkl. Dependabot) | |
| runs-on: ubuntu-latest | |
| needs: lint | |
| strategy: | |
| matrix: | |
| include: | |
| - name: syslogng | |
| file: Dockerfile-syslogng | |
| context: . | |
| - name: loganalyzer | |
| file: Dockerfile-loganalyzer | |
| context: . | |
| - name: dbcleanup | |
| file: Dockerfile-dbcleanup | |
| context: . | |
| env: | |
| LOCAL_TAG: ${{ matrix.name }}:pr-${{ github.event.number || github.run_number }} | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Set up Buildx | |
| uses: docker/setup-buildx-action@v4 | |
| # Build ins lokale Docker laden (kein Push!) | |
| - name: Build (no push, load to daemon) | |
| uses: docker/build-push-action@v7 | |
| with: | |
| context: ${{ matrix.context }} | |
| file: ${{ matrix.file }} | |
| push: false | |
| load: true | |
| tags: ${{ env.LOCAL_TAG }} | |
| # Trivy scannt das lokale Image (kein GHCR-Pull nötig) | |
| - name: Trivy scan (local image) | |
| uses: aquasecurity/trivy-action@v0.36.0 | |
| with: | |
| scan-type: image | |
| image-ref: ${{ env.LOCAL_TAG }} | |
| format: 'table' | |
| ignore-unfixed: true | |
| output: trivy-${{ matrix.image.name }}.sarif | |
| vuln-type: 'os,library' | |
| severity: 'CRITICAL,HIGH,MEDIUM' | |
| e2e: | |
| runs-on: ubuntu-latest | |
| needs: build_and_scan | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - name: Write CI .env (override) | |
| run: | | |
| cat > .env.ci <<'EOF' | |
| TZ=Europe/Berlin | |
| DB_NAME=syslogdb | |
| DB_USER=syslog | |
| DB_PASSWORD=ciPassw0rd! | |
| DB_ROOT_PASSWORD=ciRootPassw0rd! | |
| SYSLOG_UDP_PORT=514 | |
| SYSLOG_TCP_PORT=514 | |
| LOGANALYZER_HTTP_PORT=8181 | |
| LOG_RETENTION_DAYS=7 | |
| DBCLEANUP_CRON=*/2 * * * * | |
| EOF | |
| - name: Compose up (detached, build) | |
| run: | | |
| docker compose --env-file .env.ci up -d --build | |
| # Warten bis DB & syslogng healthy (max 90s) | |
| for i in {1..30}; do | |
| unhealthy=$(docker compose ps --format json | jq -r '.[] | select(.Health!="" and .Health!="healthy") | .Name' | wc -l) | |
| [ "$unhealthy" -eq 0 ] && break | |
| sleep 3 | |
| done | |
| docker compose ps | |
| - name: Send test log via busybox logger (UDP) | |
| run: | | |
| NET=$(docker network ls --format '{{.Name}}' | grep syslogserver || true) | |
| MSG="ci-test-$(date +%s)" | |
| docker run --rm --network ${NET:-bridge} debian:trixie-slim bash -c \ | |
| "logger -n syslogng -P 514 -d \"$MSG\" || nc -u -w1 syslogng 514 <<<\"<14>$MSG\"" | |
| echo "TEST_MSG=$MSG" >> $GITHUB_ENV | |
| - name: Verify DB contains the test log | |
| run: | | |
| docker compose exec -T -e TEST_MSG="$TEST_MSG" database sh -lc ' | |
| mariadb -u"$MARIADB_USER" --password="$MARIADB_PASSWORD" -D "$MARIADB_DATABASE" -Nse \ | |
| "SELECT COUNT(*) AS cnt | |
| FROM SystemEvents | |
| WHERE Message LIKE '\''%'"$TEST_MSG"'%'\''\G" | |
| ' | tee /tmp/db_check.txt | |
| grep -q " 1. row" /tmp/db_check.txt | |
| - name: Show logs on failure | |
| if: failure() | |
| run: | | |
| docker compose logs --no-color > compose-logs.txt || true | |
| sed -n '1,400p' compose-logs.txt | |
| - name: Tear down | |
| if: always() | |
| run: docker compose down -v |