Add Trivy image scan workflow - #444
Merged
Merged
Conversation
sidey79
changed the title
CPAN Build Report
|
CPAN Build Report
|
CPAN Build Report
|
CPAN Build Report
|
CPAN Build Report
|
CPAN Build Report
|
sidey79
force-pushed
the
feature/trivy-image-scan
branch
from
May 15, 2026 18:21
593926a to
acb1899
Compare
sidey79
force-pushed
the
feature/trivy-image-scan
branch
from
September 3, 2026 18:32
c92e913 to
4a45402
Compare
added 7 commits
September 3, 2026 21:18
HIGH/CRITICAL OS-layer CVEs without a fix available were failing every build; report findings in the job summary instead of failing.
Move the Trivy scan out of test_build into a dedicated trivy_scan job so it shows up as its own status check in the PR, independent from the build/test results. Images are rebuilt from the GHA layer cache populated by test_build, so this stays fast.
Add a table-format Trivy run alongside the existing SARIF scan so the list of findings is visible directly in the job log, not just as counts in the step summary.
Split the monolithic test_build job into build_test_images (builds each image variant once and pushes it to ghcr.io/<owner>/fhem-docker-ci under a run-specific tag) plus three independent test jobs (test_bats, test_integration_and_unit, test_bats_extended) that pull the pre-built image instead of rebuilding it. trivy_scan now also pulls from build_test_images instead of rebuilding, removing a redundant full build per variant. Build failures and test failures now show up as separate checks and the test jobs run in parallel. published_build now gates on the three test jobs instead of the removed test_build.
Add cleanup_test_images, gated on all four CI-image consumers succeeding, to delete the run-specific ghcr.io/.../fhem-docker-ci tags again. Runs are left alone on failure so a failed test's image stays pullable for debugging; that follow-up (time-based cleanup for failed runs) is intentionally left open for now.
The minimal (with-fhem) build was inserted between the bats and full builds. That's the one variant that previously only ran on its own builder (in trivy_scan), and having it in between broke the full build's cache-from with a BuildKit "ref ... not found" error when computing the 3rdparty COPY cache key, reproducibly across two runs. Moving it after full/bats-extended restores the exact build order the old, working test_build job used for those three variants.
…un's Prefix the ghcr.io/.../fhem-docker-ci tags with a branch slug, and have cleanup_test_images delete every version tagged for the branch instead of only the current run's eight tags. Previously, images from earlier runs on the same branch (superseded pushes) were never cleaned up. Also add a concurrency group (cancel-in-progress per branch/PR, but not for release runs) so a superseded run's cleanup can't race a still in-flight run on the same branch.
sidey79
marked this pull request as ready for review
September 4, 2026 17:06
trivy_scan runs pre-merge against the CI test image built by build_test_images, giving fast feedback on every PR. Add trivy_scan_published, which runs after published_build and scans the real ghcr.io/.../fhem-docker and fhem-minimal-docker tags that were actually pushed - but only when published_build actually pushed (same condition as its own push: input), since regular PRs without the publishImage label don't produce a published image at all.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds Trivy image vulnerability scanning to the existing
test_buildGitHub Actions job.The workflow now scans the locally built amd64 full image and minimal image for HIGH and CRITICAL OS/library vulnerabilities, stores SARIF reports as workflow artifacts, and fails the job after both scans have completed if Trivy reports blocking findings.
Validation
.github/workflows/build.ymlwith Python YAML loadergit diff --checkThe full Docker/GitHub Actions run is expected to execute in CI.