41c7d318e9
Harden has failed every Sunday since 2026-09-27: the mc build (dead quay.io/minio/mc) aborted the job before a single trivy step ran, so for a month no image was scanned and nothing said so beyond an auto-filed issue per week. Harden (gen_config -> .gitea/workflows/harden.yml) - Each image is built -> scanned -> pushed on its own. A failed build is continue-on-error and skips only that image's scan and push; a gate step after the vuln report fails the job, so the breakage is still filed, never swallowed. - Builds use --pull --no-cache: --no-cache alone reused whatever stale base the runner had cached. - mc is scanned now too (it was built but excluded). Tooling pins (harden, deploy, rebuild-all, pkg-supply-chain) - trivy 0.76.0 via the tagged installer (it checks the release sha256) instead of install.sh from `main`. - crane 0.22.1 with its sha256 checked against the release checksums.txt, instead of an unverified `releases/latest` tarball. - Both are Renovate-tracked constants in backends/gitea.py. Package supply chain - docs/pnpm-lock.yaml is scanned nightly into data/pkg-vulns-docs.json and filed like uv.lock findings. - pkg_issues.py read only the first 50 open `ci` issues, so once CI failures piled up every known CVE past page one was invisible: re-filed nightly (174 open issues for 91 titles) and never closed. It now walks every page, closes all duplicates of a title, and runs the close pass even when a scan comes back clean — it used to return early there, i.e. exactly when the most issues resolve. Dry run against the live tracker with the new lock: closes all 174, files none. Refs #1365
74 lines
2.3 KiB
YAML
74 lines
2.3 KiB
YAML
# DO NOT EDIT — generated by gen_config.py from stack.toml
|
|
# Re-generate: uv run python dev/scripts/gen_config.py
|
|
|
|
name: Package Supply Chain
|
|
|
|
on:
|
|
push:
|
|
paths:
|
|
- "**/Dockerfile*"
|
|
- "pyproject.toml"
|
|
- "uv.lock"
|
|
- "docs/package.json"
|
|
- "docs/pnpm-lock.yaml"
|
|
workflow_dispatch:
|
|
schedule:
|
|
- cron: "0 6 * * *"
|
|
|
|
jobs:
|
|
pkg-supply-chain:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout
|
|
uses: https://github.com/actions/checkout@v4
|
|
|
|
- name: Set up uv
|
|
run: curl -LsSf https://astral.sh/uv/install.sh | sh
|
|
env:
|
|
UV_INSTALL_DIR: /usr/local/bin
|
|
|
|
- name: Install dependencies
|
|
run: uv sync --no-dev
|
|
|
|
- name: Package inventory
|
|
run: uv run python dev/scripts/pkg_inventory.py
|
|
|
|
- name: Check manifest freshness
|
|
run: uv run python dev/scripts/pkg_inventory.py --check
|
|
|
|
- name: Sync to Gitea package registry
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
|
|
run: uv run python dev/scripts/pkg_mirror_sync.py
|
|
|
|
- name: Drift detection
|
|
run: uv run python dev/scripts/pkg_drift.py
|
|
|
|
- name: Install trivy
|
|
run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/v0.76.0/contrib/install.sh | sh -s -- -b /usr/local/bin v0.76.0
|
|
|
|
- name: Vulnerability scan
|
|
run: |
|
|
set -euo pipefail
|
|
trivy fs --scanners vuln --format json -o data/pkg-vulns.json uv.lock
|
|
trivy fs --scanners vuln --format json -o data/pkg-vulns-pyproject.json pyproject.toml
|
|
# The docs site's build toolchain — never scanned before (116 CVEs, 2026-10-27).
|
|
trivy fs --scanners vuln --format json -o data/pkg-vulns-docs.json docs/pnpm-lock.yaml
|
|
|
|
- name: Auto-create issues for drift and vulns
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
|
|
run: uv run python dev/scripts/pkg_issues.py
|
|
|
|
- name: File failure issue
|
|
if: failure()
|
|
env:
|
|
GITEA_TOKEN: ${{ secrets.DEPLOY_TOKEN }}
|
|
run: |
|
|
uv sync --no-dev --quiet 2>/dev/null || true
|
|
uv run python -m api.diag.ci \
|
|
--workflow "Package Supply Chain" --job "pkg-supply-chain" \
|
|
--run "${{ github.run_number }}" \
|
|
--sha "${{ github.sha }}" \
|
|
--ref "${{ github.ref }}" || true
|