Skip to content

Commit c006f59

Browse files
gortizgortiz
authored
Add a new workflow to check vulnerabilities using trivy (#9044)
* Add a new workflow to check vulnerabilities using trivy * Add EOF new line * Run Pinot dependencies check only when dependency related files change
1 parent 9176db4 commit c006f59

File tree

5 files changed

+130
-0
lines changed

5 files changed

+130
-0
lines changed

‎.github/workflows/pinot_vuln_check.yml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
#
2+
# Licensed to the Apache Software Foundation (ASF) under one
3+
# or more contributor license agreements. See the NOTICE file
4+
# distributed with this work for additional information
5+
# regarding copyright ownership. The ASF licenses this file
6+
# to you under the Apache License, Version 2.0 (the
7+
# "License"); you may not use this file except in compliance
8+
# with the License. You may obtain a copy of the License at
9+
#
10+
# http://www.apache.org/licenses/LICENSE-2.0
11+
#
12+
# Unless required by applicable law or agreed to in writing,
13+
# software distributed under the License is distributed on an
14+
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15+
# KIND, either express or implied. See the License for the
16+
# specific language governing permissions and limitations
17+
# under the License.
18+
#
19+
20+
name: Pinot Dependencies
21+
on:
22+
push:
23+
branches:
24+
- master
25+
pull_request:
26+
branches:
27+
- master
28+
paths:
29+
- "**/pom.xml"
30+
- "**/package.json"
31+
- "**/package-lock.json"
32+
- "docker/images/pinot/**"
33+
- ".github/workflows/**"
34+
jobs:
35+
verify-docker:
36+
name: Verify Docker Image
37+
runs-on: ubuntu-latest
38+
steps:
39+
- uses: docker/setup-qemu-action@v1
40+
name: Set up QEMU
41+
- uses: docker/setup-buildx-action@v1
42+
name: Set up Docker Buildx
43+
- uses: actions/checkout@v3
44+
- name: Build the Docker image
45+
env:
46+
DOCKER_FILE_BASE_DIR: "docker/images/pinot"
47+
DOCKER_IMAGE_NAME: "apachepinot/pinot"
48+
BUILD_PLATFORM: "linux/amd64"
49+
PINOT_GIT_URL: ${{ github.event.inputs.gitUrl }}
50+
PINOT_BRANCH: ${{ env.GITHUB_REF }}
51+
TAGS: ${{ github.sha }}
52+
run: .github/workflows/scripts/docker/.pinot_docker_image_build.sh
53+
54+
- name: Run Trivy vulnerability scanner (sarif)
55+
uses: aquasecurity/trivy-action@master
56+
with:
57+
trivyignores: '.trivyignore'
58+
image-ref: 'apachepinot/pinot:${{ github.sha }}'
59+
format: 'sarif'
60+
output: 'trivy-results.sarif'
61+
vuln-type: 'os,library'
62+
severity: 'CRITICAL,HIGH'
63+
- name: Upload Trivy scan results to GitHub Security tab
64+
uses: github/codeql-action/upload-sarif@v2
65+
with:
66+
sarif_file: 'trivy-results.sarif'

‎.github/workflows/scripts/docker/.pinot_docker_image_build.sh‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
#!/bin/bash -x
2+
#
3+
# Licensed to the Apache Software Foundation (ASF) under one
4+
# or more contributor license agreements. See the NOTICE file
5+
# distributed with this work for additional information
6+
# regarding copyright ownership. The ASF licenses this file
7+
# to you under the Apache License, Version 2.0 (the
8+
# "License"); you may not use this file except in compliance
9+
# with the License. You may obtain a copy of the License at
10+
#
11+
# http://www.apache.org/licenses/LICENSE-2.0
12+
#
13+
# Unless required by applicable law or agreed to in writing,
14+
# software distributed under the License is distributed on an
15+
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
16+
# KIND, either express or implied. See the License for the
17+
# specific language governing permissions and limitations
18+
# under the License.
19+
#
20+
21+
if [ -z "${DOCKER_IMAGE_NAME}" ]; then
22+
DOCKER_IMAGE_NAME="apachepinot/pinot"
23+
fi
24+
if [ -z "${PINOT_GIT_URL}" ]; then
25+
PINOT_GIT_URL="https://github.com/apache/pinot.git"
26+
fi
27+
if [ -z "${PINOT_BRANCH}" ]; then
28+
PINOT_BRANCH="master"
29+
fi
30+
if [ -z "${BUILD_PLATFORM}" ]; then
31+
BUILD_PLATFORM="linux/arm64,linux/amd64"
32+
fi
33+
34+
COMMIT_ID=`git rev-parse --short HEAD`
35+
DATE=`date +%Y%m%d`
36+
VERSION=`mvn help:evaluate -Dexpression=project.version -q -DforceStdout`
37+
tags=()
38+
if [ -z "${TAGS}" ]; then
39+
tags=("${VERSION}-${COMMIT_ID}-${DATE}")
40+
tags+=("latest")
41+
else
42+
declare -a tags=($(echo ${TAGS} | tr "," " "))
43+
fi
44+
45+
DOCKER_BUILD_TAGS=""
46+
for tag in "${tags[@]}"
47+
do
48+
echo "Plan to build docker images for: ${DOCKER_IMAGE_NAME}:${tag}"
49+
DOCKER_BUILD_TAGS+=" --tag ${DOCKER_IMAGE_NAME}:${tag} "
50+
done
51+
52+
cd ${DOCKER_FILE_BASE_DIR}
53+
54+
docker buildx build \
55+
--no-cache \
56+
--platform=${BUILD_PLATFORM} \
57+
--file Dockerfile \
58+
--load \
59+
--build-arg PINOT_GIT_URL=${PINOT_GIT_URL} --build-arg PINOT_BRANCH=${PINOT_BRANCH} \
60+
${DOCKER_BUILD_TAGS} \
61+
.

‎.trivyignore‎

Whitespace-only changes.

‎pinot-distribution/pinot-source-assembly.xml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@
3939
<exclude>**/.github/**</exclude>
4040
<exclude>.codecov*</exclude>
4141
<exclude>.gitignore</exclude>
42+
<exclude>.trivyignore</exclude>
4243

4344
<!-- Do not inclue node_modules in pinot-controller -->
4445
<exclude>pinot-controller/src/main/resources/node_modules/**</exclude>

‎pom.xml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1659,6 +1659,7 @@
16591659
<exclude>HEADER</exclude>
16601660
<exclude>LICENSE*</exclude>
16611661
<exclude>NOTICE*</exclude>
1662+
<exclude>.trivyignore</exclude>
16621663

16631664
<!-- js, css files that are exact copies of the third-party works. In this case, the original header has to
16641665
be kept. Please refer to 'Treatment of Third-party works' in https://www.apache.org/legal/src-headers.html
@@ -1776,6 +1777,7 @@
17761777
<!-- Docker and Kubernetes (not part of the distribution) -->
17771778
<exclude>kubernetes/**</exclude>
17781779
<exclude>docker/**</exclude>
1780+
<exclude>.trivyignore</exclude>
17791781

17801782
<!-- Pinot-Druid Benchmark (not part of the distribution) -->
17811783
<exclude>contrib/**</exclude>

0 commit comments

Comments
 (0)