forked from repo-mirrors/cnpg-postgres-containers
72 lines
2.1 KiB
Markdown
72 lines
2.1 KiB
Markdown
# Security Scans Action
|
||
|
||
This composite GitHub Action wraps all the security scanners used to
|
||
analyze CloudNativePG container images.
|
||
|
||
---
|
||
|
||
## Requirements
|
||
|
||
This composite action relies on the calling workflow’s `GITHUB_TOKEN`.
|
||
Make sure your calling workflow includes:
|
||
|
||
```
|
||
permissions:
|
||
contents: read
|
||
packages: read
|
||
security-events: write # required for SARIF upload
|
||
```
|
||
|
||
---
|
||
|
||
## Security scanners
|
||
|
||
- [Dockle](https://github.com/goodwithtech/dockle):
|
||
- Best-practice and configuration checks.
|
||
|
||
- [Snyk](https://github.com/snyk/actions):
|
||
- Detects vulnerabilities in OS packages, libraries, and dependencies.
|
||
- Generates a `snyk.sarif` that gets uploaded to GitHub Code Scanning
|
||
|
||
---
|
||
|
||
## Inputs
|
||
|
||
| Name | Description | Required | Default |
|
||
| ---------------- | -------------------------------------------------- | --------- | -------------- |
|
||
| `image` | The image to scan (e.g. `ghcr.io/org/image:tag`) | ✅ Yes | — |
|
||
| `registry_user` | The user used to pull the image | ✅ Yes | — |
|
||
| `registry_token` | The token used to pull the image | ✅ Yes | — |
|
||
| `snyk_token` | The Snyk authentication token | ❌ No | — |
|
||
| `dockerfile` | Path to the image’s Dockerfile (for Snyk scanning) | ❌ No | `./Dockerfile` |
|
||
|
||
Note:
|
||
- If a `snyk_token` is not provided, Snyk scans won't be performed.
|
||
- The `dockerfile` path is currently only required by Snyk.
|
||
|
||
---
|
||
|
||
## Usage
|
||
|
||
Example workflow:
|
||
|
||
```
|
||
jobs:
|
||
security-scan:
|
||
runs-on: ubuntu-latest
|
||
permissions:
|
||
contents: read
|
||
packages: read
|
||
security-events: write
|
||
steps:
|
||
- uses: actions/checkout@v5
|
||
- name: Security checks
|
||
uses: cloudnative-pg/postgres-containers/.github/actions/security-scans@main
|
||
with:
|
||
image: ghcr.io/org/image:tag
|
||
registry_user: ${{ github.actor }}
|
||
registry_token: ${{ secrets.GITHUB_TOKEN }}
|
||
snyk_token: ${{ secrets.SNYK_TOKEN }}
|
||
dockerfile: "./Dockerfile"
|
||
```
|