Repository navigation
Conversation
🛡️ Trivy — Go dependency scan (HIGH,CRITICAL)
|
🛡️ Trivy — image scan (HIGH,CRITICAL)No HIGH or CRITICAL findings. |
nisargabd
changed the title
Adds a run-tests/security/build-and-push flow: gated lint, gotestsum with diff-scoped coverage, dependency+image Trivy scans gated on HIGH/CRITICAL, multi-registry multi-arch build-and-push on release tags. Both Dockerfiles switch to dhi.io base images (with public overrides for a local build without a DHI subscription), so the security and build-and-push jobs authenticate to dhi.io first.
nisargabd
force-pushed
the
chore/999-ci-cd-workflows
branch
from
September 3, 2026 09:41
c5404d9 to
0c8854c
Compare
… dependency [#999] security.yml's Trivy gate failed on unpatched CVEs in dhi.io/debian-base's bundled perl-base, ncurses, util-linux and zlib1g -- none of which the adapter uses. Neither can move to the fully static dhi.io/static image though: the adapter loads plugin .so files at runtime via Go's `plugin` package, which needs cgo and a real glibc dynamic linker to work at all. dhi.io/static's glibc variant is the middle ground -- keeps libc6 so plugin.Open still works, drops everything else the scan was flagging. That variant has no shell, so CMD's `sh -c "./server --config=$CONFIG_FILE"` can no longer expand the env var. Switched to an exec-form ENTRYPOINT and taught main.go to read CONFIG_FILE itself as the --config default.
…wn CVEs [#999] security.yml's trivy-deps scan flagged CVE-2026-56854 (x/crypto, CRITICAL) and CVE-2026-84304 (grpc, HIGH), both with fixed versions already published upstream.
Ran on every push including this branch and always failed here -- missing Gerrit credentials for the private Terraform-CICD repo it clones. workflow_dispatch stays, so it's still runnable by hand; kept, not deleted, pending a decision on whether it's folded into build-and-push.yml or removed outright.
…ersions [#999] This is CI setup, not a dependency-bump PR -- the two CVEs trivy-deps flags (CVE-2026-56854, CVE-2026-84304) are real and the scan catching them is working as intended; the actual bump is deferred to its own change.
Dockerfile.adapter goes back to the original public base images -- Dockerfile.adapter-with-plugins is the one actually deployed, so that's the one that needs the CVE fix. Keeps dhi.io/static's glibc-only variant (clears the unpatched perl-base/ncurses/util-linux/zlib1g CVEs, keeps libc6 so plugin.Open still works) but drops the main.go change entirely: Deployment/deployment.yaml now passes --config=$(CONFIG_FILE) via args, letting the kubelet do the substitution instead of a shell inside the container.
…dapter [#999] security.yml and build-and-push.yml still pointed at Dockerfile.adapter, which we just reverted back to the original, unpatched base images -- so the security gate was scanning the wrong Dockerfile and the CVE fix never took effect. Dockerfile.adapter-with-plugins is the one actually deployed and the one carrying the DHI glibc-only runtime fix.
Collaborator
Author
|
Superseded by the PR from chore/5-ci-cd-workflows — same work, retargeted to issue #5. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
run-tests.yml— lint (advisory) + tests viagotestsum, with diff-scoped coverage posted as a PR commentsecurity.yml— Trivy dependency scan + image scan, SARIF uploaded to the Security tab, gated on HIGH/CRITICAL findingsbuild-and-push.yml— multi-arch (amd64/arm64) image build onvX.Y.Ztags, Trivy release gate before push, multi-registry push (GHCR by default, DockerHub/ACR/GAR opt-in via repo variables)Makefile—build/test/test-ci/cover-diff/lint/trivy-*targets, the single source of truth both the workflows and a localmakecall useDockerfile.adapterandDockerfile.adapter-with-pluginsswitched todhi.io(Docker Hardened Images) base images; both keep build-arg overrides back to the previous public images (golang:1.26.1-bookworm,cgr.dev/chainguard/wolfi-base) for a local build without a DHI subscription.github/actions/dhi-login— composite action to authenticate to dhi.io, used bysecurity.ymlandbuild-and-push.ymlWhy
No consistent test/security/release pipeline existed for this repo. This adds one: gated tests with coverage feedback on PRs, dependency and image vulnerability scanning before merge, and a signed-off multi-arch release path on tag push.
Testing
go build ./cmd/adapter/...,go vet ./...,go test -race ./...all pass locally (one pre-existing, unrelated failure:pkg/plugin'svalid_config_with_so_filesubtest — a checked-in.sofixture built with a different Go runtime ABI than what's installed locally)make lint,make test-ci,make trivy-deps,make trivy-imagerun clean locallyIssue not yet filed —
#999is a placeholder; will update once a real ticket exists.Closes #999