rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use official anchore github actions

Browse Source 
Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
This commit is contained in:
Sacha Al Himdani
2025-09-10 17:44:19 +02:00
parent 02c1009c23
commit d828db46a3
4 changed files with 32 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
.github/workflows/make.yaml vendored
View File

@@ -29,7 +29,7 @@ jobs:
- uses: "docker/setup-qemu-action@v3"
- uses: "docker/setup-buildx-action@v3"
- uses: "sigstore/cosign-installer@v3"
- uses: "anchore/sbom-action/download-syft@v0"
- uses: "anchore/sbom-action/download-syft@da167eac915b4e86f08b264dbdbc867b61be6f0c" # v0.20.5
- uses: "goreleaser/goreleaser-action@v6"
with:
distribution: "goreleaser"
@@ -72,33 +72,16 @@ jobs:
coverage.html
retention-days: 30
- run: "make lint"
- name: Generate SBOM
uses: anchore/sbom-action@da167eac915b4e86f08b264dbdbc867b61be6f0c #v0.20.5
with:
path: ./
format: cyclonedx-json
output-file: sbom.json
vulnerability-scan:
name: "vulnerability-scan"
runs-on: "ubuntu-24.04"
permissions:
contents: "read"
steps:
- uses: "actions/checkout@v4"
- name: Run vulnerability scan
uses: anchore/scan-action@1638637db639e0ade3258b51db49a9a137574c3e #v6.5.1
with:
fetch-depth: 0
- uses: "actions/setup-go@v5"
with:
go-version: "1.25"
- uses: "actions/setup-node@v4"
with:
node-version: 22
- run: "npm ci"
- name: "Install Syft"
uses: "anchore/sbom-action/download-syft@v0"
- name: "Install Grype"
run: |
curl -sSfL https://raw.githubusercontent.com/anchore/grype/v0.85.0/install.sh | sh -s -- -b /usr/local/bin
- name: "Generate SBOM"
run: |
syft dir:. --output cyclonedx-json --source-name probo --source-version ${{ github.sha }} > sbom.json
- name: "Scan SBOM for vulnerabilities"
run: |
echo "Scanning SBOM for vulnerabilities..."
grype sbom:sbom.json --fail-on critical --output table
echo "Vulnerability scan completed successfully - no critical vulnerabilities found"
path: ./
fail-build: true
severity-cutoff: critical

27
.github/workflows/release.yaml vendored
View File

@@ -37,13 +37,6 @@ jobs:
- name: Install dependencies
run: npm ci
- name: Install Syft
uses: anchore/sbom-action/download-syft@v0
- name: Install Grype
run: |
curl -sSfL https://raw.githubusercontent.com/anchore/grype/v0.85.0/install.sh | sh -s -- -b /usr/local/bin
- name: Install Cosign
uses: sigstore/cosign-installer@v3
@@ -71,15 +64,19 @@ jobs:
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Generate SBOM for attestation
run: |
syft dir:. --output cyclonedx-json --source-name probo --source-version ${{ github.ref_name }} > sbom.json
- name: Generate SBOM
uses: anchore/sbom-action@da167eac915b4e86f08b264dbdbc867b61be6f0c #v0.20.5
with:
path: ./
format: cyclonedx-json
output-file: sbom.json
- name: Scan SBOM for vulnerabilities
run: |
echo "Scanning SBOM for vulnerabilities..."
grype sbom:sbom.json --fail-on critical --output table
echo "Vulnerability scan completed successfully - no critical vulnerabilities found"
- name: Run vulnerability scan
uses: anchore/scan-action@1638637db639e0ade3258b51db49a9a137574c3e #v6.5.1
with:
path: ./
fail-build: true
severity-cutoff: critical
- name: Generate subject for attestation
id: hash

5
.grype.yaml Normal file
View File

@@ -0,0 +1,5 @@
ignore:
- vulnerability: "CVE-2024-3566"
package:
name: "stdlib"
reason: "CERT VU#123335: Go is Not Affected"

6
GNUmakefile
View File

@@ -87,15 +87,15 @@ sbom:
.PHONY: scan-sbom
scan-sbom: sbom
$(GRYPE) sbom:sbom.json --fail-on high
$(GRYPE) sbom:sbom.json --config .grype.yaml --fail-on high
.PHONY: scan-sbom-docker
scan-sbom-docker: sbom-docker
$(GRYPE) sbom:sbom-docker.json --fail-on high
$(GRYPE) sbom:sbom-docker.json --config .grype.yaml --fail-on high
.PHONY: scan-docker
scan-docker: docker-build
$(GRYPE) docker:$(DOCKER_IMAGE_NAME):$(DOCKER_TAG_NAME) --fail-on high
$(GRYPE) docker:$(DOCKER_IMAGE_NAME):$(DOCKER_TAG_NAME) --config .grype.yaml --fail-on high
.PHONY: scan
scan: scan-sbom scan-sbom-docker scan-docker