feat: fail docker-build on CRITICAL or HIGH vulnerabilities with fix available #98
Conversation
jbern0rd
changed the title
jbern0rd
changed the title
| file: ${{ inputs.dockerfile }} | ||
| platforms: ${{ inputs.platforms }} | ||
| push: ${{ inputs.push }} | ||
| load: true # Make the image available on runner |
There was a problem hiding this comment.
load: true is not compatible with multi-platform builds. Docker can only load a single architecture image locally.
| - name: Fail build on CRITICAL or HIGH vulnerabilities | ||
| if: ${{ inputs.security-scan }} | ||
| uses: aquasecurity/trivy-action@0.33.1 |
There was a problem hiding this comment.
Trivy is executed twice (around line 88).
In my opinion, we can merge this into a single scan using exit-code: 1.
If we still want to publish the report before failing, we can use continue-on-error and then check the exit code.
There was a problem hiding this comment.
Trivy is executed twice to allow for a full scan and a restrictive scan only on CRITICAL and HIGH.
This can be improved and is inspired by
https://github.com/aquasecurity/trivy-action?tab=readme-ov-file#skipping-setup-when-calling-trivy-action-multiple-times
| skip-setup-trivy: true | ||
| exit-code: 1 | ||
|
|
||
| - name: Build and push Docker image |
There was a problem hiding this comment.
There is a double build. I think we can push the already built image after it has been scanned, without rebuilding the image again.
There was a problem hiding this comment.
Only works if load can be used, in the other case, the tag is not created locally and the image is not available through docker client
| - name: Build and push Docker image | ||
| if: ${{ inputs.push }} | ||
| uses: docker/build-push-action@v6 | ||
| with: | ||
| build-args: ${{ inputs.build-args }} | ||
| context: ${{ inputs.context }} | ||
| file: ${{ inputs.dockerfile }} | ||
| platforms: ${{ inputs.platforms }} | ||
| push: true | ||
| tags: ${{ inputs.image-name }}:${{ inputs.image-tag }} |
There was a problem hiding this comment.
| - name: Build and push Docker image | |
| if: ${{ inputs.push }} | |
| uses: docker/build-push-action@v6 | |
| with: | |
| build-args: ${{ inputs.build-args }} | |
| context: ${{ inputs.context }} | |
| file: ${{ inputs.dockerfile }} | |
| platforms: ${{ inputs.platforms }} | |
| push: true | |
| tags: ${{ inputs.image-name }}:${{ inputs.image-tag }} | |
| - name: Push Docker image | |
| if: ${{ inputs.push }} | |
| run: docker push ${{ inputs.image-name }}:${{ inputs.image-tag }} |
There was a problem hiding this comment.
If I do this, with a single platform build, multi-platform build will be broken.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
This PR is being reviewed by Cursor Bugbot
Details
Your team is on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle for each member of your team.
To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.
| file: ${{ inputs.dockerfile }} | ||
| platforms: ${{ inputs.platforms }} | ||
| push: ${{ inputs.push }} | ||
| platforms: "linux/amd64" |
There was a problem hiding this comment.
Security scan only covers one platform, not all pushed
High Severity
The security scan only runs on the linux/amd64 image (hardcoded at line 83), but the final push step uses ${{ inputs.platforms }} which defaults to "linux/amd64,linux/arm64". This means arm64 images (and any other non-amd64 platforms) are pushed to the registry without being scanned for vulnerabilities. Different architectures can have different base images with different vulnerabilities, defeating the purpose of failing builds on CRITICAL or HIGH vulnerabilities.
Note
Tightens Docker image security in the CI workflow and defers pushing until after vulnerability checks.
linux/amd64image withload: true(no push) for scanningaquasecurity/trivy-actionto0.33.1and scan the built image viaimage-ref(remove tarball path)CRITICAL/HIGHvulnerabilities with fixes available (ignore-unfixed: true,exit-code: 1)inputs.platforms; add cleanup of scan artifacts and local imageWritten by Cursor Bugbot for commit 7e1a111. This will update automatically on new commits. Configure here.