DevOps/truecharts
2
0
Fork 0
Code Issues Pull Requests Actions 27 Packages Projects Releases 1 Wiki Activity

feat(docs): re-enable container security scanning

Browse Source
This commit is contained in:
Kjeld Schouten-Lebbing
2022-12-23 17:16:09 +01:00
parent 4536b6a821
commit 7e005f58ab
1 changed files with 15 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/secgen.yaml
+14 -5
View File
@@ -52,6 +52,14 @@ jobs:
shell: bash shell: bash
run: | run: |
#!/bin/bash #!/bin/bash
render(){
local chart="$1"
local chartname="$2"
local train="$3"
echo "Rendering helm-template for ${chartname}"
mkdir -p ${chart}/render
helm template ${chart} --output-dir ${chart}/render || echo "Helm template failed..."
}
helm_sec_scan() { helm_sec_scan() {
local chart="$1" local chart="$1"
local chartname="$2" local chartname="$2"
@@ -65,15 +73,14 @@ jobs:
echo "" >> website/docs/charts/${train}/${chartname}/helm-security.md echo "" >> website/docs/charts/${train}/${chartname}/helm-security.md
echo "##### Scan Results" >> website/docs/charts/${train}/${chartname}/helm-security.md echo "##### Scan Results" >> website/docs/charts/${train}/${chartname}/helm-security.md
echo "" >> website/docs/charts/${train}/${chartname}/helm-security.md echo "" >> website/docs/charts/${train}/${chartname}/helm-security.md
helm template ${chart} --output-dir ${chart}/render || echo "Helm template failed..."
trivy config -f template --template "@./templates/trivy-config.tpl" ${chart}/render >> website/docs/charts/${train}/${chartname}/helm-security.md || echo "trivy scan failed..." trivy config -f template --template "@./templates/trivy-config.tpl" ${chart}/render >> website/docs/charts/${train}/${chartname}/helm-security.md || echo "trivy scan failed..."
rm -rf ${chart}/render
} }
container_sec_scan() { container_sec_scan() {
local chart="$1" local chart="$1"
local chartname="$2" local chartname="$2"
local train="$3" local train="$3"
echo "Scanning container security for ${chartname}" echo "Scanning container security for ${chartname}"
mkdir -p ${chart}/render
echo "# Container Security" >> website/docs/charts/${train}/${chartname}/container-security.md echo "# Container Security" >> website/docs/charts/${train}/${chartname}/container-security.md
echo "" >> website/docs/charts/${train}/${chartname}/container-security.md echo "" >> website/docs/charts/${train}/${chartname}/container-security.md
echo "##### Detected Containers" >> website/docs/charts/${train}/${chartname}/container-security.md echo "##### Detected Containers" >> website/docs/charts/${train}/${chartname}/container-security.md
@@ -96,16 +103,18 @@ jobs:
local chartname="$2" local chartname="$2"
local train="$3" local train="$3"
echo "sanitising website output for ${chartname}..." echo "sanitising website output for ${chartname}..."
rm -rf ${chart}/render
sed -i 's|<br>|<br />|g' website/docs/charts/${train}/${chartname}/helm-security.md sed -i 's|<br>|<br />|g' website/docs/charts/${train}/${chartname}/helm-security.md
#sed -i 's|<br>|<br />|g' website/docs/charts/${train}/${chartname}/container_sec_scan.md sed -i 's|<br>|<br />|g' website/docs/charts/${train}/${chartname}/container_sec_scan.md
sed -i 's|<hr>|<hr />|g' website/docs/charts/${train}/${chartname}/helm-security.md sed -i 's|<hr>|<hr />|g' website/docs/charts/${train}/${chartname}/helm-security.md
#sed -i 's|<hr>|<hr />|g' website/docs/charts/${train}/${chartname}/container_sec_scan.md sed -i 's|<hr>|<hr />|g' website/docs/charts/${train}/${chartname}/container_sec_scan.md
} }
for train in enterprise stable incubator dependency; do for train in enterprise stable incubator dependency; do
echo "Processing Charts for Train: ${train}..." echo "Processing Charts for Train: ${train}..."
for chart in $(ls "charts/${train}"); do for chart in $(ls "charts/${train}"); do
render "charts/${train}/${chart}" ${chart} ${train}
helm_sec_scan "charts/${train}/${chart}" ${chart} ${train} helm_sec_scan "charts/${train}/${chart}" ${chart} ${train}
# container_sec_scan "charts/${train}/${chart}" ${chart} ${train} container_sec_scan "charts/${train}/${chart}" ${chart} ${train}
cleanfiles "charts/${train}/${chart}" ${chart} ${train} cleanfiles "charts/${train}/${chart}" ${chart} ${train}
done done
done done