Skip to content

chore: applly image scan #25

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
muhammad-tahir-nawaz merged 1 commit into from
Jun 16, 2026
Merged

chore: applly image scan #25

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 18 additions & 2 deletions .github/workflows/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -132,18 +132,34 @@ jobs:
name: env-file
path: ${{ inputs.docker_context }}

- name: Build and push Docker image
- name: Build Docker image
if: ${{ inputs.deploy_type != 'release-only' }}
id: build
uses: docker/build-push-action@v4
with:
context: ${{ inputs.docker_context }}
file: ${{ inputs.docker_context }}/${{ inputs.dockerfile_path }}
push: true
push: false
load: true
tags: ${{ secrets.GCP_REGISTRY }}/${{ secrets.GCP_PROJECT }}/${{ inputs.image_path }}:latest
build-args: |
GH_ACCESS_TOKEN=${{ secrets.GH_ACCESS_TOKEN }}

- name: Run Trivy vulnerability scanner on image
if: ${{ inputs.deploy_type != 'release-only' }}
uses: aquasecurity/trivy-action@0.35.0
with:
scan-type: 'image'
image-ref: ${{ secrets.GCP_REGISTRY }}/${{ secrets.GCP_PROJECT }}/${{ inputs.image_path }}:latest
ignore-unfixed: true
format: 'table'
severity: 'CRITICAL,HIGH'
exit-code: '1'
Comment on lines +148 to +157

- name: Push Docker image
if: ${{ inputs.deploy_type != 'release-only' }}
run: docker push ${{ secrets.GCP_REGISTRY }}/${{ secrets.GCP_PROJECT }}/${{ inputs.image_path }}:latest

# --- GKE deploy ---
- name: Get GKE Credentials
if: ${{ inputs.deploy_type == 'gke' }}
Expand Down
41 changes: 3 additions & 38 deletions .github/workflows/trivy-go-tests.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,6 @@ on:

permissions:
contents: read
pull-requests: write

jobs:
trivy-scan-and-test:
Expand Down Expand Up @@ -68,43 +67,9 @@ jobs:
format: 'table'
output: 'trivy-results.txt'
severity: 'CRITICAL,HIGH,MEDIUM,LOW'
Comment on lines 67 to 69

@greptile-apps greptile-apps Bot Jun 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 The output: 'trivy-results.txt' parameter redirects Trivy results to a file instead of stdout. The PR comment step that previously surfaced this file was removed, and no artifact-upload step replaced it. When the scan fails with exit-code: '1', developers will see the job fail but have no way to see which vulnerabilities triggered it — the results file is silently discarded at the end of the runner. Either remove output (letting results print to the workflow log) or add an actions/upload-artifact step so the file is retrievable.

Suggested change
format: 'table'
output: 'trivy-results.txt'
severity: 'CRITICAL,HIGH,MEDIUM,LOW'
format: 'table'
severity: 'CRITICAL,HIGH,MEDIUM,LOW'

exit-code: '1'
exit-code: '1'

- name: Comment Trivy Results on the Pull Request
if: always()
run: |
echo '### Trivy Scan Results' > comment_trivy.md
if [ -s trivy-results.txt ]; then
echo '#### Vulnerabilities Found' >> comment_trivy.md
echo '```' >> comment_trivy.md
cat trivy-results.txt >> comment_trivy.md
echo '```' >> comment_trivy.md
else
echo '#### No vulnerabilities found :white_check_mark:' >> comment_trivy.md
fi

gh pr comment ${{ github.event.pull_request.number }} --body-file comment_trivy.md
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

- name: Run Go Unit Tests and Comment Results
- name: Run Go Unit Tests
if: ${{ inputs.run_go_tests }}
working-directory: ${{ inputs.working_directory }}
run: |
echo '### Go Unit Test Results' > comment_go_tests.md
echo '| Test Name | Status |' >> comment_go_tests.md
echo '| --------- | ------ |' >> comment_go_tests.md

# Run Go tests and check for failures in real-time
go test -v ${{ inputs.test_path }} | grep -E '^(--- PASS|--- FAIL)' | sed -E 's/^(--- PASS: )(.*)/\|\2\|Pass\|/; s/^(--- FAIL: )(.*)/\|\2\|Fail\|/' >> comment_go_tests.md

# Post test results to PR
gh pr comment ${{ github.event.pull_request.number }} --body-file comment_go_tests.md

# Check for failed tests and exit if any test fails
if go test -v ${{ inputs.test_path }} | grep -q '^--- FAIL'; then
echo "There are failed tests. Failing the job."
exit 1
fi
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: go test -v ${{ inputs.test_path }}
Loading