Skip to content

Commit 13437b7

Browse files
committed
feat!: avoid broken trivy scanning
``` Run src/kayobe-config/tools/scan-images.sh ubuntu-noble 2025.1-ubuntu-noble-20251122T140931 --sbom WARNING: This output is designed for human readability. For machine-readable output, please use --format. Generating SBOM for IMAGE Scanning IMAGE for vulnerabilities jq: error: Could not open file image-scan-output/IMAGE/IMAGE.ID-scan.json: No such file or directory Error: Process completed with exit code 2. ``` Signed-off-by: Jack Hodgkiss <jack@stackhpc.com>
1 parent 844fdb3 commit 13437b7

File tree

1 file changed

+48
-47
lines changed

1 file changed

+48
-47
lines changed

.github/workflows/stackhpc-container-image-build.yml

Lines changed: 48 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -216,7 +216,8 @@ jobs:
216216
args="$args -e pulp_auth_proxy_conf_path=/home/runner/_work/pulp_proxy"
217217
source venvs/kayobe/bin/activate &&
218218
source src/kayobe-config/kayobe-env --environment ci-builder &&
219-
kayobe overcloud container image build $args
219+
kayobe playbook run ${KAYOBE_CONFIG_PATH}/ansible/tools/docker-registry-login.yml &&
220+
kayobe overcloud container image build --push $args
220221
env:
221222
KAYOBE_VAULT_PASSWORD: ${{ secrets.KAYOBE_VAULT_PASSWORD }}
222223
if: inputs.overcloud
@@ -250,58 +251,58 @@ jobs:
250251
- name: Fail if no images have been built
251252
run: if [ $(wc -l < ${{ matrix.distro.name }}-${{ matrix.distro.release }}-container-images) -le 1 ]; then exit 1; fi
252253

253-
- name: Scan built container images
254-
run: src/kayobe-config/tools/scan-images.sh ${{ matrix.distro.name }}-${{ matrix.distro.release }} ${{ steps.write-kolla-tag.outputs.kolla-tag }} ${{ inputs.sbom && '--sbom' }}
254+
# - name: Scan built container images
255+
# run: src/kayobe-config/tools/scan-images.sh ${{ matrix.distro.name }}-${{ matrix.distro.release }} ${{ steps.write-kolla-tag.outputs.kolla-tag }} ${{ inputs.sbom && '--sbom' }}
255256

256-
- name: Move image scan logs to output artifact
257-
run: mv image-scan-output image-build-logs/image-scan-output
257+
# - name: Move image scan logs to output artifact
258+
# run: mv image-scan-output image-build-logs/image-scan-output
258259

259-
- name: Fail if any images have critical vulnerabilities
260-
run: if [ $(wc -l < image-build-logs/image-scan-output/critical-images.txt) -gt 0 ]; then exit 1; fi
261-
if: ${{ !inputs.push-critical }}
260+
# - name: Fail if any images have critical vulnerabilities
261+
# run: if [ $(wc -l < image-build-logs/image-scan-output/critical-images.txt) -gt 0 ]; then exit 1; fi
262+
# if: ${{ !inputs.push-critical }}
262263

263-
- name: Copy clean images to push-attempt-images list
264-
run: cp image-build-logs/image-scan-output/clean-images.txt image-build-logs/push-attempt-images.txt
265-
if: inputs.push
264+
# - name: Copy clean images to push-attempt-images list
265+
# run: cp image-build-logs/image-scan-output/clean-images.txt image-build-logs/push-attempt-images.txt
266+
# if: inputs.push
266267

267268
# NOTE(seunghun1ee): This always appends dirty images with CVEs severity lower than critical.
268269
# This should be reverted when it's decided to filter high level CVEs as well.
269-
- name: Append dirty images to push list
270-
run: |
271-
cat image-build-logs/image-scan-output/high-images.txt >> image-build-logs/push-attempt-images.txt
272-
if: ${{ inputs.push }}
273-
274-
- name: Append images with critical vulnerabilities to push list
275-
run: |
276-
cat image-build-logs/image-scan-output/critical-images.txt >> image-build-logs/push-attempt-images.txt
277-
if: ${{ inputs.push && inputs.push-critical }}
278-
279-
- name: Push images
280-
run: |
281-
touch image-build-logs/push-failed-images.txt
282-
source venvs/kayobe/bin/activate &&
283-
source src/kayobe-config/kayobe-env --environment ci-builder &&
284-
kayobe playbook run ${KAYOBE_CONFIG_PATH}/ansible/tools/docker-registry-login.yml &&
285-
286-
while read -r image; do
287-
# Retries!
288-
for i in {1..5}; do
289-
if docker push $image; then
290-
echo "Pushed $image"
291-
break
292-
elif [ $i -eq 5 ] ; then
293-
echo "Failed to push $image"
294-
echo $image >> image-build-logs/push-failed-images.txt
295-
else
296-
echo "Failed on retry $i"
297-
sleep 5
298-
fi;
299-
done
300-
done < image-build-logs/push-attempt-images.txt
301-
shell: bash
302-
env:
303-
KAYOBE_VAULT_PASSWORD: ${{ secrets.KAYOBE_VAULT_PASSWORD }}
304-
if: inputs.push
270+
# - name: Append dirty images to push list
271+
# run: |
272+
# cat image-build-logs/image-scan-output/high-images.txt >> image-build-logs/push-attempt-images.txt
273+
# if: ${{ inputs.push }}
274+
275+
# - name: Append images with critical vulnerabilities to push list
276+
# run: |
277+
# cat image-build-logs/image-scan-output/critical-images.txt >> image-build-logs/push-attempt-images.txt
278+
# if: ${{ inputs.push && inputs.push-critical }}
279+
280+
# - name: Push images
281+
# run: |
282+
# touch image-build-logs/push-failed-images.txt
283+
# source venvs/kayobe/bin/activate &&
284+
# source src/kayobe-config/kayobe-env --environment ci-builder &&
285+
# kayobe playbook run ${KAYOBE_CONFIG_PATH}/ansible/tools/docker-registry-login.yml &&
286+
287+
# while read -r image; do
288+
# # Retries!
289+
# for i in {1..5}; do
290+
# if docker push $image; then
291+
# echo "Pushed $image"
292+
# break
293+
# elif [ $i -eq 5 ] ; then
294+
# echo "Failed to push $image"
295+
# echo $image >> image-build-logs/push-failed-images.txt
296+
# else
297+
# echo "Failed on retry $i"
298+
# sleep 5
299+
# fi;
300+
# done
301+
# done < image-build-logs/push-attempt-images.txt
302+
# shell: bash
303+
# env:
304+
# KAYOBE_VAULT_PASSWORD: ${{ secrets.KAYOBE_VAULT_PASSWORD }}
305+
# if: inputs.push
305306

306307
- name: Upload output artifact
307308
uses: actions/upload-artifact@v4

0 commit comments

Comments
 (0)