fix-trivy-helm GHA (#3411)

juliusvonkohout · web-flow · commit 0575f06abe02 · 2026-03-20T17:19:14.000+01:00
* fix-trivy-helm GHA

Signed-off-by: Julius von Kohout &lt;45896133+juliusvonkohout@users.noreply.github.com&gt;

* Update paths format in Helm vs Kustomize workflow

Signed-off-by: Julius von Kohout &lt;45896133+juliusvonkohout@users.noreply.github.com&gt;

* Add kustomize_install.sh to workflow trigger paths

Signed-off-by: Julius von Kohout &lt;45896133+juliusvonkohout@users.noreply.github.com&gt;

* Update pull request paths in trivy.yaml

Signed-off-by: Julius von Kohout &lt;45896133+juliusvonkohout@users.noreply.github.com&gt;

* .

Signed-off-by: juliusvonkohout &lt;45896133+juliusvonkohout@users.noreply.github.com&gt;

* .

Signed-off-by: juliusvonkohout &lt;45896133+juliusvonkohout@users.noreply.github.com&gt;

* .

Signed-off-by: juliusvonkohout &lt;45896133+juliusvonkohout@users.noreply.github.com&gt;

* .

Signed-off-by: juliusvonkohout &lt;45896133+juliusvonkohout@users.noreply.github.com&gt;

---------

Signed-off-by: Julius von Kohout &lt;45896133+juliusvonkohout@users.noreply.github.com&gt;
Signed-off-by: juliusvonkohout &lt;45896133+juliusvonkohout@users.noreply.github.com&gt;
diff --git a/.github/workflows/admission_webhook_test.yaml b/.github/workflows/admission_webhook_test.yaml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
 
     - name: Install KinD, Create KinD cluster and Install kustomize
       run: ./tests/install_KinD_create_KinD_cluster_install_kustomize.sh
diff --git a/.github/workflows/centraldashboard_test.yaml b/.github/workflows/centraldashboard_test.yaml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
 
     - name: Install KinD, Create KinD cluster and Install kustomize
       run: ./tests/install_KinD_create_KinD_cluster_install_kustomize.sh
diff --git a/.github/workflows/dex_oauth2-proxy_test.yaml b/.github/workflows/dex_oauth2-proxy_test.yaml
@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
 
     - name: Install KinD, Create KinD cluster and Install kustomize
       run: ./tests/install_KinD_create_KinD_cluster_install_kustomize.sh
diff --git a/.github/workflows/helm-kustomize-comparison.yml b/.github/workflows/helm-kustomize-comparison.yml
@@ -2,13 +2,13 @@ name: Helm vs Kustomize Comparison
 
 on:
   pull_request:
-    branches: [master]
     paths:
-    - 'experimental/helm/charts/**'
-    - 'tests/helm_kustomize_compare.py'
-    - 'tests/helm_kustomize_compare.sh'
-    - 'tests/helm_kustomize_compare_all.sh'
-    - '.github/workflows/helm-kustomize-comparison.yml'
+    - experimental/helm/charts/**
+    - tests/kustomize_install.sh
+    - tests/helm_kustomize_compare.py
+    - tests/helm_kustomize_compare.sh
+    - tests/helm_kustomize_compare_all.sh
+    - .github/workflows/helm-kustomize-comparison.yml
   workflow_dispatch:
 
 permissions:
@@ -17,15 +17,16 @@ permissions:
 
 jobs:
   validate-helm-kustomize-equivalence:
+    continue-on-error: true
     runs-on: ubuntu-latest
     name: Compare All Scenarios
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
     - name: Set up Python
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v5
       with:
-        python-version: '3.9'
+        python-version: '3.12'
     - name: Install Python dependencies
       run: |
         python -m pip install --upgrade pip
diff --git a/.github/workflows/istio_validation.yaml b/.github/workflows/istio_validation.yaml
@@ -26,7 +26,7 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
 
     - name: Install KinD, Create KinD cluster and Install kustomize
       run: ./tests/install_KinD_create_KinD_cluster_install_kustomize.sh
diff --git a/.github/workflows/jupyter_web_application_test.yaml b/.github/workflows/jupyter_web_application_test.yaml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
 
     - name: Install KinD, Create KinD cluster and Install kustomize
       run: ./tests/install_KinD_create_KinD_cluster_install_kustomize.sh
diff --git a/.github/workflows/kserve_models_web_application_test.yaml b/.github/workflows/kserve_models_web_application_test.yaml
@@ -25,7 +25,7 @@ jobs:
     timeout-minutes: 15
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
 
     - name: Install KinD, Create KinD cluster and Install kustomize
       run: ./tests/install_KinD_create_KinD_cluster_install_kustomize.sh
@@ -58,7 +58,7 @@ jobs:
       run: ./tests/kubeflow_profile_install.sh
 
     - name: Setup python 3.12
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v5
       with:
         python-version: 3.12
 
diff --git a/.github/workflows/kserve_test.yaml b/.github/workflows/kserve_test.yaml
@@ -27,7 +27,7 @@ jobs:
     timeout-minutes: 15
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
 
     - name: Install KinD, Create KinD cluster and Install kustomize
       run: ./tests/install_KinD_create_KinD_cluster_install_kustomize.sh
@@ -60,7 +60,7 @@ jobs:
       run: ./tests/kubeflow_profile_install.sh
 
     - name: Setup python 3.12
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@v5
       with:
         python-version: 3.12
 
diff --git a/.github/workflows/linting_bash_python_yaml_files.yaml b/.github/workflows/linting_bash_python_yaml_files.yaml
@@ -10,7 +10,7 @@ jobs:
   format_python_files:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
 
     - name: Python Files Formatting Guidelines
       run: |
@@ -35,7 +35,7 @@ jobs:
   format_YAML_files:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
       with:
         fetch-depth: 0
 
@@ -105,7 +105,7 @@ jobs:
   format_bash_files:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
       with:
         fetch-depth: 0
 
diff --git a/.github/workflows/model_catalog_test.yaml b/.github/workflows/model_catalog_test.yaml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
 
     - name: Install KinD, Create KinD cluster and Install kustomize
       run: ./tests/install_KinD_create_KinD_cluster_install_kustomize.sh
diff --git a/.github/workflows/notebook_controller_test.yaml b/.github/workflows/notebook_controller_test.yaml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
 
     - name: Install KinD, Create KinD cluster and Install kustomize
       run: ./tests/install_KinD_create_KinD_cluster_install_kustomize.sh
diff --git a/.github/workflows/profiles_test.yaml b/.github/workflows/profiles_test.yaml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
 
     - name: Install KinD, Create KinD cluster and Install kustomize
       run: ./tests/install_KinD_create_KinD_cluster_install_kustomize.sh
diff --git a/.github/workflows/ray_test.yaml b/.github/workflows/ray_test.yaml
@@ -20,7 +20,7 @@ jobs:
     timeout-minutes: 15
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
 
     - name: Install KinD, Create KinD cluster and Install kustomize
       run: ./tests/install_KinD_create_KinD_cluster_install_kustomize.sh
diff --git a/.github/workflows/tensorboard_controller_test.yaml b/.github/workflows/tensorboard_controller_test.yaml
@@ -18,7 +18,7 @@ jobs:
     timeout-minutes: 15
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
 
     - name: Install KinD, Create KinD cluster and Install kustomize
       run: ./tests/install_KinD_create_KinD_cluster_install_kustomize.sh
diff --git a/.github/workflows/tensorboards_web_application_test.yaml b/.github/workflows/tensorboards_web_application_test.yaml
@@ -18,7 +18,7 @@ jobs:
     timeout-minutes: 15
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
 
     - name: Install KinD, Create KinD cluster and Install kustomize
       run: ./tests/install_KinD_create_KinD_cluster_install_kustomize.sh
diff --git a/.github/workflows/trainer_test.yaml b/.github/workflows/trainer_test.yaml
@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
 
     - name: Install KinD, Create KinD cluster and Install kustomize
       run: ./tests/install_KinD_create_KinD_cluster_install_kustomize.sh
diff --git a/.github/workflows/training_operator_test.yaml b/.github/workflows/training_operator_test.yaml
@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
 
     - name: Install KinD, Create KinD cluster and Install kustomize
       run: ./tests/install_KinD_create_KinD_cluster_install_kustomize.sh
diff --git a/.github/workflows/trivy.yaml b/.github/workflows/trivy.yaml
@@ -6,8 +6,10 @@ on:
     - master
   pull_request:
     paths:
-    - '.github/workflows/trivy.yaml'
-    - 'tests/trivy_scan.py'
+    - tests/kustomize_install.sh
+    - .github/workflows/trivy.yaml
+    - tests/trivy_scan.py
+    - tests/trivy_install.sh
 
 permissions:
   contents: read
@@ -19,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
 
     # Install kustomize
     - name: Install kustomize
diff --git a/.github/workflows/volumes_web_application_test.yaml b/.github/workflows/volumes_web_application_test.yaml
@@ -26,7 +26,7 @@ jobs:
     timeout-minutes: 15
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
 
     - name: Install KinD, Create KinD cluster and Install kustomize
       run: ./tests/install_KinD_create_KinD_cluster_install_kustomize.sh
diff --git a/tests/kustomize_install.sh b/tests/kustomize_install.sh
@@ -0,0 +1,30 @@
+#!/bin/bash
+set -euxo pipefail
+
+KUSTOMIZE_VERSION="v5.8.1"
+USER_BINARY_DIRECTORY="$HOME/.local/bin"
+
+if [[ "${GITHUB_ACTIONS:-false}" == "true" ]]; then
+    USER_BINARY_DIRECTORY="/tmp/usr/local/bin"
+fi
+
+mkdir -p "${USER_BINARY_DIRECTORY}"
+export PATH="${USER_BINARY_DIRECTORY}:${PATH}"
+
+echo "Install Kustomize ..."
+{
+    KUSTOMIZE_ASSET="kustomize_${KUSTOMIZE_VERSION}_linux_amd64.tar.gz"
+    curl --fail --show-error --silent --location --remote-name "https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2F${KUSTOMIZE_VERSION}/${KUSTOMIZE_ASSET}"
+    curl --fail --show-error --silent --location "https://github.com/kubernetes-sigs/kustomize/releases/download/kustomize%2F${KUSTOMIZE_VERSION}/checksums.txt" | grep "  ${KUSTOMIZE_ASSET}$" > checksums.txt
+    if [ "$(wc -l < checksums.txt)" -ne 1 ]; then
+       echo "Failed to verify Kustomize checksums: expected exactly one checksum entry for ${KUSTOMIZE_ASSET}"
+       exit 1
+    fi
+    if ! sha256sum --check checksums.txt; then
+       echo "Failed to verify Kustomize checksums"
+       exit 1
+    fi
+    tar -xzvf "${KUSTOMIZE_ASSET}"
+    chmod a+x kustomize
+    mv kustomize "${USER_BINARY_DIRECTORY}/kustomize"
+} || { echo "Failed to install Kustomize"; exit 1; }
diff --git a/tests/trivy_install.sh b/tests/trivy_install.sh
@@ -1,4 +1,20 @@
 #!/bin/bash
-set -e
+set -euxo pipefail
+
+TRIVY_VERSION="v0.69.3"
+USER_BINARY_DIRECTORY="$HOME/.local/bin"
+
+if [[ "${GITHUB_ACTIONS:-false}" == "true" ]]; then
+    USER_BINARY_DIRECTORY="/tmp/usr/local/bin"
+fi
+
+mkdir -p "${USER_BINARY_DIRECTORY}"
+export PATH="${USER_BINARY_DIRECTORY}:${PATH}"
+
+echo "Install Trivy ..."
+{
+    curl --fail --show-error --silent --location \
+      https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | \
+      sh -s -- -b "${USER_BINARY_DIRECTORY}" "${TRIVY_VERSION}"
+} || { echo "Failed to install Trivy"; exit 1; }
 
-curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sudo sh -s -- -b /usr/local/bin v0.65.0
diff --git a/tests/trivy_scan.py b/tests/trivy_scan.py
@@ -17,6 +17,14 @@
 import glob
 from prettytable import PrettyTable
 
+def get_trivy_binary():
+    # Check both GitHub Actions and local installation directories
+    for directory in ["/tmp/usr/local/bin", os.path.expandvars("$HOME/.local/bin")]:
+        trivy_path = os.path.join(directory, "trivy")
+        if os.path.isfile(trivy_path):
+            return trivy_path
+    return "trivy"
+
 # Dictionary mapping Kubeflow workgroups to directories containing kustomization files
 wg_dirs = {
     "katib": "../applications/katib/upstream/installs",
@@ -176,7 +184,7 @@ def extract_images(version):
         try:
             result = subprocess.run(
                 [
-                    "trivy",
+                    get_trivy_binary(),
                     "image",
                     "--format",
                     "json",
