mirror of
https://github.com/k3s-io/k3s.git
synced 2026-04-06 09:55:01 -04:00
70 lines
2.4 KiB
YAML
70 lines
2.4 KiB
YAML
name: Trivy Scan Trigger
|
|
|
|
# This workflow is triggered when a pull request is labeled with 'scan-with-trivy'.
|
|
# This can only be initiated by a user who is a member of the k3s-io organization and has write permissions.
|
|
# It isolates the built of k3s within a unprivileged enviroment.
|
|
# The follow up unprivileged workflow will then use the artifact created here to run the scan
|
|
# and report the results back to the PR.
|
|
|
|
on:
|
|
pull_request:
|
|
types: [labeled]
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
trigger-scan:
|
|
if: github.event.label.name == 'scan-with-trivy'
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Verify actor is a member of k3s-io organization and has write permissions
|
|
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
|
|
with:
|
|
script: |
|
|
const org = 'k3s-io';
|
|
const actor = context.actor;
|
|
const { repo, owner } = context.repo;
|
|
|
|
try {
|
|
const result = await github.rest.orgs.checkMembershipForUser({
|
|
org,
|
|
username: actor,
|
|
});
|
|
} catch (error) {
|
|
core.setFailed(`User ${actor} is not an public member of the ${org} organization`);
|
|
}
|
|
|
|
const { data: { permission } } = await github.rest.repos.getCollaboratorPermissionLevel({
|
|
owner,
|
|
repo,
|
|
username: actor
|
|
});
|
|
|
|
if (permission !== 'admin' && permission !== 'write') {
|
|
core.setFailed(`User @${actor} does not have write permission. Scan can only be triggered by repository collaborators with write access.`);
|
|
}
|
|
|
|
- name: Checkout repository
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
|
|
|
- name: Build And Save K3s Image
|
|
run: |
|
|
make local-image
|
|
make tag-image-latest
|
|
docker save -o k3s.tar rancher/k3s:latest
|
|
|
|
- name: Create PR context artifact
|
|
env:
|
|
PR_NUM: ${{ github.event.pull_request.number }}
|
|
run: |
|
|
mkdir -p pr-context
|
|
echo "$PR_NUM" > pr-context/pr_number
|
|
mv k3s.tar pr-context/k3s.tar
|
|
|
|
- name: Upload PR context artifact
|
|
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
|
|
with:
|
|
name: pr-context-for-scan
|
|
path: pr-context/
|
|
retention-days: 1
|