Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: only output compare from docker scout and silently scan for cves #108

Merged
merged 2 commits into from
Aug 23, 2024
Merged

fix: only output compare from docker scout and silently scan for cves #108

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5c0e452
fix: only output compare from docker scout and silently scan for cves
rwaffen Aug 23, 2024
6c4433d
fix: remove sarif file from compare
rwaffen Aug 23, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 13 additions & 4 deletions .github/workflows/ci.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,15 +57,24 @@ jobs:
username: voxpupulibot
password: ${{ secrets.DOCKERHUB_BOT_PASSWORD }}

- name: Analyze Container Image
id: analyze-image
- name: Analyze container image for CVEs
id: analyze-image-cves
uses: docker/scout-action@v1
with:
command: cves,compare
to: 'ghcr.io/voxpupuli/puppetserver:${{ matrix.version }}-latest'
command: cves
image: 'local://ci/puppetserver:${{ matrix.version }}'
sarif-file: sarif.output.${{ matrix.version }}.${{ github.sha }}.json
write-comment: false

- name: Compare container image to latest from Registry
id: compare-image
uses: docker/scout-action@v1
with:
command: compare
image: 'local://ci/puppetserver:${{ matrix.version }}'
to: 'ghcr.io/voxpupuli/puppetserver:${{ matrix.version }}-latest'
summary: true
keep-previous-comments: true

- name: Upload SARIF result
id: upload-sarif
Expand Down