scan.yaml

name: Scan

on:
  # Run scans on all commits and PRs to verify new codes does not introduce new vulnerabilities.
  push:
    branches:
      - main
      - release-**
    tags: [ 'v[0-9]+.[0-9]+-tetrate-v[0-9]+' ]  # v1.16-tetrate-v7
  pull_request:
    branches:
      - main
      - release-**
  # Run nightly scans to upload any new CVEs to the security advisories
  schedule:
    - cron: "0 0 * * *"
  workflow_dispatch: { }

env:
  GOPROXY: https://proxy.golang.org

jobs:
  scan:
    runs-on: ubuntu-latest
    env:
      IMG: local/kubegres:scan
      PLATFORMS: linux/amd64
    steps:
      - uses: docker/setup-qemu-action@v3
        with:
          platforms: amd64
      - uses: docker/setup-buildx-action@v3
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with:
          go-version-file: go.mod
      - run: make docker-build
      - uses: anchore/scan-action@v3
        id: scan
        with:
          image: local/kubegres:scan-amd64
          # Only fail the build on PRs. Do not fail the build on the scheduled run, to let the workflow
          # continue and have the report uploaded.
          fail-build: ${{ github.event_name != 'schedule' }}
      - run: cat ${{ steps.scan.outputs.sarif }}
        if: always()  # Always print the report to the stdout.
      # Do not upload the security advisories on every commit or pull request.
      # Upload the security advisories only for the nightly scans.
      - uses: github/codeql-action/upload-sarif@v3
        if: ${{ github.event_name == 'schedule' }}
        with:
          sarif_file: ${{ steps.scan.outputs.sarif }}