security_scan.yaml

# Copyright 2023 Iguazio
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#   http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

# Currently supported running against prebuilt images
name: Security Scan
run-name: Scanning ${{ inputs.tag }}

on:
  workflow_dispatch:
    inputs:
      tag:
        description: 'MLRun image tag to scan (unstable-cache, unstable-cache-13x, 1.3.0-wwwwwwww, 1.3.0 or any other tag)'
        required: false
        default: 'unstable'
      registry:
        description: 'MLRun image registry'
        required: false
        default: 'ghcr.io/'
      skip_images:
        description: 'Comma separated list of images to skip scanning'
        required: false
        # test images are not scanned as they are not used in production
        default: 'test'
      publish_results:
        description: 'Whether to publish results to Github or not (default empty - no publish)'
        required: false
        default: ''
      severity_threshold:
        description: 'The minimum severity of vulnerabilities to report ("negligible", "low", "medium", "high" and "critical".)'
        required: false
        default: 'medium'
        type: choice
        options:
          - 'negligible'
          - 'low'
          - 'medium'
          - 'high'
          - 'critical'
      only_fixed:
        description: 'Whether to scan only fixed vulnerabilities ("true" or "false")'
        required: false
        default: 'true'
        type: choice
        options:
          - 'true'
          - 'false'

jobs:
  matrix_prep:
    name: Prepare image list
    outputs:
      matrix: ${{ steps.set-matrix.outputs.matrix }}
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - id: set-matrix
        uses: ./.github/actions/image-matrix-prep
        with:
          skip_images: ${{ github.event.inputs.skip_images }}

  build_and_scan_docker_images:
    name: Scan ${{ matrix.image-name }} (Python ${{ matrix.python-version }})
    runs-on: ubuntu-latest
    needs: matrix_prep
    strategy:
      fail-fast: false
      matrix: ${{ fromJson(needs.matrix_prep.outputs.matrix) }}
    steps:
      - uses: actions/checkout@v4

      - name: Cleanup disk
        run: |
          "${GITHUB_WORKSPACE}/automation/scripts/github_workflow_free_space.sh"

      - name: Resolving image name
        id: resolve_image_name
        run: |
          echo "image_name=$(make pull-${{ matrix.image-name }} | tail -1)" >> $GITHUB_OUTPUT
        env:
          MLRUN_DOCKER_REGISTRY: ${{ github.event.inputs.registry }}
          MLRUN_VERSION: ${{ github.event.inputs.tag }}
          MLRUN_PYTHON_VERSION: ${{ matrix.python-version }}

      - name: Define output format
        id: output-format

        # this section is duplicated in the other jobs.
        # make sure to update all when changed.
        run: |
          if [[ -n "${{ github.event.inputs.publish_results }}" ]]; then \
            echo "format=sarif" >> $GITHUB_OUTPUT; \
            echo "fail_build=false" >> $GITHUB_OUTPUT; \
          else \
            echo "format=table" >> $GITHUB_OUTPUT; \
            echo "fail_build=true" >> $GITHUB_OUTPUT; \
          fi

      - name: Scan image
        uses: anchore/scan-action@v3
        id: scan
        with:
          image: ${{ steps.resolve_image_name.outputs.image_name }}
          only-fixed: ${{ github.event.inputs.only_fixed }}
          output-format: ${{ steps.output-format.outputs.format }}
          fail-build: ${{ steps.output-format.outputs.fail_build }}
          severity-cutoff: ${{ github.event.inputs.severity_threshold }}

      - name: Upload scan results
        if: github.event.inputs.publish_results != ''
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ${{ steps.scan.outputs.sarif }}
          category: ${{ matrix.image-name }}-${{ matrix.python-version }})

  scan_fs:
    name: Scan file system
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Define output format
        id: output-format

        # this section is duplicated in the other jobs.
        # make sure to update all when changed.
        run: |
          if [[ -n "${{ github.event.inputs.publish_results }}" ]]; then \
            echo "format=sarif" >> $GITHUB_OUTPUT; \
            echo "fail_build=false" >> $GITHUB_OUTPUT; \
          else \
            echo "format=table" >> $GITHUB_OUTPUT; \
            echo "fail_build=true" >> $GITHUB_OUTPUT; \
          fi

      - name: Scan fs
        uses: anchore/scan-action@v3
        id: scan
        with:
          path: "."
          only-fixed: ${{ github.event.inputs.only_fixed }}
          output-format: ${{ steps.output-format.outputs.format }}
          fail-build: ${{ steps.output-format.outputs.fail_build }}
          severity-cutoff: ${{ github.event.inputs.severity_threshold }}

      - name: Upload scan results
        if: github.event.inputs.publish_results != ''
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ${{ steps.scan.outputs.sarif }}
          category: "repository"