Skip to content

fix: only block release on fixed issues with higher severity than low #179

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Mar 20, 2025
Merged

fix: only block release on fixed issues with higher severity than low #179

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,8 @@ permissions:

jobs:
vuln-check:
name: Docker Image Vulnerability Check
uses: ./.github/workflows/vuln-check.yaml
name: Pre-release Docker Image Vulnerability Check
uses: ./.github/workflows/vuln-check-release.yaml
secrets: inherit
with:
branch: ${{ github.ref }}
Expand Down
7 changes: 1 addition & 6 deletions .github/workflows/vuln-check.yaml → .github/workflows/vuln-check-full.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,11 +7,6 @@ on:
description: "The branch on which to run the vulnerability check"
required: true
default: "main"
workflow_call:
Copy link
Collaborator

@obs-gh-alexlew obs-gh-alexlew Mar 20, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why are we removing this from the full check? I'd still maybe want to run this against an arbitrary branch

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Manual runs go through the workflow_dispatch (https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows#workflow_dispatch), which still has the branch input above.

If we think we would call this full run workflow as a step in a different workflow, then I can leave in the workflow_call. I didn't foresee that happening though

inputs:
branch:
required: true
type: string

permissions:
contents: read
Expand Down Expand Up @@ -57,7 +52,7 @@ jobs:
cp dist/linux_amd64/default_linux_amd64_v1/observe-agent .

- name: Build an image from Dockerfile
run: docker build -f packaging/docker/Dockerfile -t docker.io/${{ env.TEST_TAG}} .
run: docker build -f packaging/docker/Dockerfile -t docker.io/${{ env.TEST_TAG }} .

- name: Docker Scout
id: docker-scout
Expand Down
67 changes: 67 additions & 0 deletions .github/workflows/vuln-check-release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,67 @@
name: Pre-release Docker Image Vulnerability Check

on:
workflow_call:
inputs:
branch:
required: true
type: string

permissions:
contents: read

env:
TEST_TAG: observeinc/observe-agent:test

jobs:
vuln-check:
runs-on: ubuntu-observe-agent-8cpu
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: 0
ref: ${{ github.event.inputs.branch }}

- name: Login to Docker Hub
uses: docker/login-action@v3
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3

- name: Set up Go
uses: actions/setup-go@v5
with:
go-version: 1.23.7

- name: Run GoReleaser
uses: goreleaser/goreleaser-action@v6
with:
distribution: goreleaser-pro
version: 2.7.0
args: build --snapshot --id=default --skip=validate --single-target
env:
GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}

- name: Copy Binary
run: |
cp dist/linux_amd64/default_linux_amd64_v1/observe-agent .

- name: Build an image from Dockerfile
run: docker build -f packaging/docker/Dockerfile -t docker.io/${{ env.TEST_TAG }} .

- name: Docker Scout
id: docker-scout
uses: docker/scout-action@v1
with:
image: ${{ env.TEST_TAG }}
command: cves,recommendations
to-latest: true
ignore-base: true
ignore-unchanged: true
only-fixed: true
only-severities: medium,critical,high
exit-code: true
Loading