Revert "ci: add trivy image scanning prior to release image push"#24
Conversation
This reverts commit 79d7464.
muhammad-tahir-nawaz
temporarily deployed
to
development
GitHub Actions
Inactive
Trivy Scan ResultsVulnerabilities Found |
Greptile SummaryThis PR reverts the Trivy image-scanning step added in #22 from the deployment pipeline, and separately adds PR-comment reporting for Trivy filesystem scan results and Go test results in
Confidence Score: 2/5Merging removes the only image-level vulnerability gate from the deployment pipeline and introduces two correctness bugs in the PR-reporting workflow. The deployment workflow now pushes Docker images directly to the GCP registry and deploys them without any image-layer vulnerability scan; the only remaining Trivy check is a source-filesystem scan on PRs, which does not cover the built image. Additionally, the Go test step in
Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[Push to branch] --> B[deployment.yaml]
B --> C[Authenticate GCP]
C --> D[Configure Docker]
D --> E[Download .env artifact]
E --> F["Build AND Push image\n(push: true)"]
F --> G{deploy_type?}
G -->|gke| H[GKE rollout restart]
G -->|cloudrun-service| I[Cloud Run deploy]
G -->|cloudrun-job| J[Cloud Run job update]
PR[Pull Request] --> K[trivy-go-tests.yaml]
K --> L[Trivy FS scan]
L --> M["Comment scan results on PR\n(if: always)"]
M --> N{run_go_tests?}
N -->|true| O["go test run 1\n(for PR comment)"]
O --> P["go test run 2\n(for failure check)"]
P --> Q{failures?}
Q -->|yes| R[exit 1]
Q -->|no| S[Pass]
style F fill:#f96,stroke:#c00
style O fill:#fa0,stroke:#c80
style P fill:#fa0,stroke:#c80
Reviews (1): Last reviewed commit: "Revert "Merge pull request #22 from wana..." | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
| # Run Go tests and check for failures in real-time | ||
| go test -v ${{ inputs.test_path }} | grep -E '^(--- PASS|--- FAIL)' | sed -E 's/^(--- PASS: )(.*)/\|\2\|Pass\|/; s/^(--- FAIL: )(.*)/\|\2\|Fail\|/' >> comment_go_tests.md | ||
|
|
||
| # Post test results to PR | ||
| gh pr comment ${{ github.event.pull_request.number }} --body-file comment_go_tests.md | ||
|
|
||
| # Check for failed tests and exit if any test fails | ||
| if go test -v ${{ inputs.test_path }} | grep -q '^--- FAIL'; then | ||
| echo "There are failed tests. Failing the job." | ||
| exit 1 | ||
| fi |
There was a problem hiding this comment.
| # Run Go tests and check for failures in real-time | |
| go test -v ${{ inputs.test_path }} | grep -E '^(--- PASS|--- FAIL)' | sed -E 's/^(--- PASS: )(.*)/\|\2\|Pass\|/; s/^(--- FAIL: )(.*)/\|\2\|Fail\|/' >> comment_go_tests.md | |
| # Post test results to PR | |
| gh pr comment ${{ github.event.pull_request.number }} --body-file comment_go_tests.md | |
| # Check for failed tests and exit if any test fails | |
| if go test -v ${{ inputs.test_path }} | grep -q '^--- FAIL'; then | |
| echo "There are failed tests. Failing the job." | |
| exit 1 | |
| fi | |
| # Run Go tests once, capture output, and check for failures | |
| set -o pipefail | |
| go test -v ${{ inputs.test_path }} | tee /tmp/go-test-output.txt; TEST_EXIT=${PIPESTATUS[0]} | |
| grep -E '^(--- PASS|--- FAIL)' /tmp/go-test-output.txt | \ | |
| sed -E 's/^(--- PASS: )(.*)/\|\2\|Pass\|/; s/^(--- FAIL: )(.*)/\|\2\|Fail\|/' >> comment_go_tests.md | |
| # Post test results to PR | |
| gh pr comment ${{ github.event.pull_request.number }} --body-file comment_go_tests.md | |
| # Fail the job if tests failed | |
| if [ "$TEST_EXIT" -ne 0 ]; then | |
| echo "There are failed tests. Failing the job." | |
| exit 1 | |
| fi |
| - name: Comment Trivy Results on the Pull Request | ||
| if: always() | ||
| run: | | ||
| echo '### Trivy Scan Results' > comment_trivy.md | ||
| if [ -s trivy-results.txt ]; then | ||
| echo '#### Vulnerabilities Found' >> comment_trivy.md | ||
| echo '```' >> comment_trivy.md | ||
| cat trivy-results.txt >> comment_trivy.md | ||
| echo '```' >> comment_trivy.md | ||
| else | ||
| echo '#### No vulnerabilities found :white_check_mark:' >> comment_trivy.md | ||
| fi | ||
|
|
||
| gh pr comment ${{ github.event.pull_request.number }} --body-file comment_trivy.md | ||
| env: | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
There was a problem hiding this comment.
workflow_call without a PR context
When this workflow is invoked via workflow_call from a caller that was not triggered by a pull_request event (e.g., a push-triggered deployment workflow), github.event.pull_request.number evaluates to an empty string. The gh pr comment "" --body-file ... call will then fail with a usage error. Because the step has if: always(), it runs unconditionally — meaning any non-PR invocation will produce a failed step here.
| - name: Build and push Docker image | ||
| if: ${{ inputs.deploy_type != 'release-only' }} | ||
| id: build | ||
| uses: docker/build-push-action@v4 | ||
| with: | ||
| context: ${{ inputs.docker_context }} | ||
| file: ${{ inputs.docker_context }}/${{ inputs.dockerfile_path }} | ||
| push: false | ||
| load: true | ||
| push: true | ||
| tags: ${{ secrets.GCP_REGISTRY }}/${{ secrets.GCP_PROJECT }}/${{ inputs.image_path }}:latest | ||
| build-args: | | ||
| GH_ACCESS_TOKEN=${{ secrets.GH_ACCESS_TOKEN }} |
There was a problem hiding this comment.
This revert collapses the previous three-step sequence (build locally → scan with Trivy → push) into a single build-and-push step. As a result, Docker images are now pushed to the GCP registry and immediately deployed to GKE / Cloud Run without any image-layer vulnerability gate. The filesystem scan in trivy-go-tests.yaml runs against source files on pull requests, but it does not cover the final built image and does not run in this deployment pipeline. Any critical or high CVE introduced into a base image or installed dependency layer would reach production undetected.
There was a problem hiding this comment.
Pull request overview
This PR reverts the previous change that introduced Trivy image scanning in the deployment pipeline before pushing images, restoring a direct build-and-push flow. It also introduces new PR-commenting behavior in the Trivy/Go test workflow (including elevated PR write permissions), which appears outside the stated revert scope.
Changes:
- Remove Trivy image vulnerability scanning from the deployment workflow and switch back to building + pushing the image directly.
- Add PR commenting steps for Trivy FS scan output and Go unit test results in the
trivy-go-testsworkflow. - Grant
pull-requests: writepermission to support PR commenting.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
.github/workflows/trivy-go-tests.yaml |
Adds PR-commenting steps for Trivy and Go tests; introduces pull-requests: write permission. |
.github/workflows/deployment.yaml |
Removes Trivy image scanning and simplifies to build-and-push via docker/build-push-action. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| - name: Comment Trivy Results on the Pull Request | ||
| if: always() | ||
| run: | | ||
| echo '### Trivy Scan Results' > comment_trivy.md | ||
| if [ -s trivy-results.txt ]; then | ||
| echo '#### Vulnerabilities Found' >> comment_trivy.md | ||
| echo '```' >> comment_trivy.md | ||
| cat trivy-results.txt >> comment_trivy.md | ||
| echo '```' >> comment_trivy.md | ||
| else | ||
| echo '#### No vulnerabilities found :white_check_mark:' >> comment_trivy.md | ||
| fi | ||
|
|
||
| gh pr comment ${{ github.event.pull_request.number }} --body-file comment_trivy.md |
| # Run Go tests and check for failures in real-time | ||
| go test -v ${{ inputs.test_path }} | grep -E '^(--- PASS|--- FAIL)' | sed -E 's/^(--- PASS: )(.*)/\|\2\|Pass\|/; s/^(--- FAIL: )(.*)/\|\2\|Fail\|/' >> comment_go_tests.md | ||
|
|
||
| # Post test results to PR | ||
| gh pr comment ${{ github.event.pull_request.number }} --body-file comment_go_tests.md | ||
|
|
||
| # Check for failed tests and exit if any test fails | ||
| if go test -v ${{ inputs.test_path }} | grep -q '^--- FAIL'; then | ||
| echo "There are failed tests. Failing the job." | ||
| exit 1 | ||
| fi |
| permissions: | ||
| contents: read | ||
| pull-requests: write | ||
|
|
Reverts #22