Maksim ShulgaandMaxim Shulga
c2a634c13f
* Scan the built image for vulnerabilities and fix what's fixable Ran trivy against the built image locally: 67 HIGH/CRITICAL findings, 65 of them in debian:bookworm-slim packages with no upstream fix yet. The remaining 2 were both setuptools 66.1.1 (CVE-2024-6345, CVE-2025-47273) — bundled by ensurepip when the venv is created, not pinned by requirements.txt, so nothing was upgrading it. - Upgrade setuptools to >=78.1.1 in the Dockerfile, which fixes both CVEs. Verified with a local rebuild + rescan: 0 HIGH/CRITICAL fixable findings remain. - Add a Trivy scan step to the CI `test` job, after the smoke test. Uses --ignore-unfixed so the build fails only on findings this repo can act on, not on upstream Debian CVEs with no available patch. - Check off the corresponding P0 item in IMPROVEMENTS.md; note that scheduled (as opposed to PR/push-triggered) scanning is still open. * Fix trivy-action tag (needs v prefix) * Tighten scan-coverage wording per review Copilot review on PR #29 flagged "every pull request and push" as ambiguous: the test job's push trigger is scoped to master and tags, not every branch. Spell that out. --------- Co-authored-by: Maxim Shulga <maxim.shulga@alludo.com>
106 lines
2.7 KiB
YAML
106 lines
2.7 KiB
YAML
name: Docker
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- master
|
|
tags:
|
|
- '*'
|
|
|
|
pull_request:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
env:
|
|
IMAGE: snegov/seafile-client
|
|
|
|
jobs:
|
|
# Application failures must be distinguishable from packaging failures, so
|
|
# the unit tests do not depend on the image build.
|
|
unit-test:
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- uses: actions/setup-python@v7
|
|
with:
|
|
python-version: '3.11'
|
|
cache: pip
|
|
|
|
- name: Install dependencies
|
|
run: pip install -r requirements-dev.txt
|
|
|
|
- name: Run unit tests
|
|
run: pytest -q
|
|
|
|
test:
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
- name: Validate compose example
|
|
run: docker compose --file compose.example.yaml config --quiet
|
|
|
|
- name: Build image
|
|
uses: docker/build-push-action@v7
|
|
with:
|
|
context: .
|
|
push: false
|
|
load: true
|
|
tags: ${{ env.IMAGE }}:ci
|
|
|
|
# Exercises the real seaf-cli and seaf-daemon in the built image, which
|
|
# the unit tests cannot do. The runner is x86_64, matching the AppImage.
|
|
- name: Container smoke test
|
|
run: tests/smoke.sh ${{ env.IMAGE }}:ci
|
|
|
|
# ignore-unfixed: the debian:bookworm-slim base carries CVEs with no
|
|
# upstream fix yet; failing on those would block every build on
|
|
# findings nothing in this repo can act on. A fixable HIGH/CRITICAL
|
|
# finding still fails the build.
|
|
- name: Scan image for vulnerabilities
|
|
uses: aquasecurity/trivy-action@v0.36.0
|
|
with:
|
|
image-ref: ${{ env.IMAGE }}:ci
|
|
severity: HIGH,CRITICAL
|
|
ignore-unfixed: true
|
|
exit-code: '1'
|
|
|
|
push:
|
|
needs: [unit-test, test]
|
|
|
|
runs-on: ubuntu-latest
|
|
if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/')
|
|
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
|
|
# Every tag of a release must resolve to one manifest digest, so the
|
|
# image is built once and all tags are attached to that single build.
|
|
- name: Collect tags and labels
|
|
id: meta
|
|
uses: docker/metadata-action@v6
|
|
with:
|
|
images: ${{ env.IMAGE }}
|
|
tags: |
|
|
type=ref,event=tag
|
|
flavor: |
|
|
latest=true
|
|
|
|
- name: Log in to Docker Hub
|
|
uses: docker/login-action@v4
|
|
with:
|
|
username: ${{ secrets.DOCKER_USERNAME }}
|
|
password: ${{ secrets.DOCKER_TOKEN }}
|
|
|
|
- name: Build and push
|
|
uses: docker/build-push-action@v7
|
|
with:
|
|
context: .
|
|
push: true
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
labels: ${{ steps.meta.outputs.labels }}
|