Skip to content

Commit 7a75827

Browse files
sattvikcsattvikc
authored
fix: container security check cron (#1158)
1 parent 5fbe206 commit 7a75827

File tree

1 file changed

+134
-0
lines changed

1 file changed

+134
-0
lines changed

‎.github/workflows/container-check.yml‎

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
name: Container Security Scan
2+
3+
on:
4+
# Allow manual triggering
5+
workflow_dispatch:
6+
7+
# Run automatically once a day at 2 AM UTC
8+
schedule:
9+
- cron: '0 2 * * *'
10+
11+
jobs:
12+
container-scan:
13+
name: Scan SuperTokens PostgreSQL Container
14+
runs-on: ubuntu-latest
15+
16+
steps:
17+
- name: Run Azure Container Scan
18+
id: container-scan
19+
uses: Azure/container-scan@v0
20+
continue-on-error: true
21+
with:
22+
image-name: supertokens/supertokens-postgresql:latest
23+
severity-threshold: LOW
24+
run-quality-checks: false
25+
env:
26+
DOCKER_CONTENT_TRUST: 1
27+
28+
- name: Upload scan results
29+
id: upload-scan-results
30+
uses: actions/upload-artifact@v4
31+
with:
32+
name: container-scan-results
33+
path: |
34+
${{ steps.container-scan.outputs.scan-report-path }}
35+
retention-days: 30
36+
37+
- name: Generate Security Summary
38+
id: security-summary
39+
run: |
40+
echo "summary<<EOF" >> $GITHUB_OUTPUT
41+
42+
echo "**Image:** \`supertokens/supertokens-postgresql:latest\`\n" >> $GITHUB_OUTPUT
43+
echo "**Scan Date:** \`$(date -u)\`\n" >> $GITHUB_OUTPUT
44+
echo "\n" >> $GITHUB_OUTPUT
45+
46+
# Get the scan report path from the container scan output
47+
SCAN_REPORT_PATH="${{ steps.container-scan.outputs.scan-report-path }}"
48+
49+
if [ -f "$SCAN_REPORT_PATH" ]; then
50+
# Count vulnerabilities by severity using the correct JSON structure
51+
critical=$(jq '[.vulnerabilities[]? | select(.severity == "CRITICAL")] | length' "$SCAN_REPORT_PATH" 2>/dev/null || echo "0")
52+
high=$(jq '[.vulnerabilities[]? | select(.severity == "HIGH")] | length' "$SCAN_REPORT_PATH" 2>/dev/null || echo "0")
53+
medium=$(jq '[.vulnerabilities[]? | select(.severity == "MEDIUM")] | length' "$SCAN_REPORT_PATH" 2>/dev/null || echo "0")
54+
low=$(jq '[.vulnerabilities[]? | select(.severity == "LOW")] | length' "$SCAN_REPORT_PATH" 2>/dev/null || echo "0")
55+
56+
total_vulns=$(jq '[.vulnerabilities[]?] | length' "$SCAN_REPORT_PATH" 2>/dev/null || echo "0")
57+
58+
echo "**Total Vulnerabilities:** $total_vulns\n" >> $GITHUB_OUTPUT
59+
echo "\n" >> $GITHUB_OUTPUT
60+
61+
echo "- 🔴 **Critical**: $critical\n" >> $GITHUB_OUTPUT
62+
echo "- 🟠 **High**: $high\n" >> $GITHUB_OUTPUT
63+
echo "- 🟡 **Medium**: $medium\n" >> $GITHUB_OUTPUT
64+
echo "- 🟢 **Low**: $low\n" >> $GITHUB_OUTPUT
65+
echo "\n" >> $GITHUB_OUTPUT
66+
else
67+
echo "❌ **Scan results not found or scan failed**" >> $GITHUB_OUTPUT
68+
fi
69+
70+
echo "\n" >> $GITHUB_OUTPUT
71+
72+
echo "[📃 Download the full report](${{ steps.upload-scan-results.outputs.artifact-url }})\n" >> $GITHUB_OUTPUT
73+
74+
echo "EOF" >> $GITHUB_OUTPUT
75+
76+
- name: Add to Action Summary
77+
run: |
78+
echo "**Image:** \`supertokens/supertokens-postgresql:latest\`" >> $GITHUB_STEP_SUMMARY
79+
echo "" >> $GITHUB_STEP_SUMMARY
80+
echo "**Scan Date:** \`$(date -u)\`" >> $GITHUB_STEP_SUMMARY
81+
echo "" >> $GITHUB_STEP_SUMMARY
82+
83+
# Get the scan report path from the container scan output
84+
SCAN_REPORT_PATH="${{ steps.container-scan.outputs.scan-report-path }}"
85+
86+
if [ -f "$SCAN_REPORT_PATH" ]; then
87+
# Count vulnerabilities by severity using the correct JSON structure
88+
critical=$(jq '[.vulnerabilities[]? | select(.severity == "CRITICAL")] | length' "$SCAN_REPORT_PATH" 2>/dev/null || echo "0")
89+
high=$(jq '[.vulnerabilities[]? | select(.severity == "HIGH")] | length' "$SCAN_REPORT_PATH" 2>/dev/null || echo "0")
90+
medium=$(jq '[.vulnerabilities[]? | select(.severity == "MEDIUM")] | length' "$SCAN_REPORT_PATH" 2>/dev/null || echo "0")
91+
low=$(jq '[.vulnerabilities[]? | select(.severity == "LOW")] | length' "$SCAN_REPORT_PATH" 2>/dev/null || echo "0")
92+
93+
total_vulns=$(jq '[.vulnerabilities[]?] | length' "$SCAN_REPORT_PATH" 2>/dev/null || echo "0")
94+
95+
echo "**Total Vulnerabilities:** $total_vulns" >> $GITHUB_STEP_SUMMARY
96+
echo "" >> $GITHUB_STEP_SUMMARY
97+
98+
echo "- 🔴 **Critical**: $critical" >> $GITHUB_STEP_SUMMARY
99+
echo "- 🟠 **High**: $high" >> $GITHUB_STEP_SUMMARY
100+
echo "- 🟡 **Medium**: $medium" >> $GITHUB_STEP_SUMMARY
101+
echo "- 🟢 **Low**: $low" >> $GITHUB_STEP_SUMMARY
102+
echo "" >> $GITHUB_STEP_SUMMARY
103+
104+
echo "**Vulnerabilities:**" >> $GITHUB_STEP_SUMMARY
105+
echo "" >> $GITHUB_STEP_SUMMARY
106+
echo "| ID | Package | Severity | | Description |" >> $GITHUB_STEP_SUMMARY
107+
echo "|----|---------|----------|-|-------------|" >> $GITHUB_STEP_SUMMARY
108+
109+
# Extract and format vulnerabilities into a table with colored severity indicators, excluding LOW severity
110+
jq -r '.vulnerabilities[]? | select(.severity != "LOW") | "| \(.vulnerabilityId // "N/A") | \(.packageName // "N/A") | \(.severity // "UNKNOWN") | \(if .severity == "CRITICAL" then "🔴" elif .severity == "HIGH" then "🟠" elif .severity == "MEDIUM" then "🟡" else "🟢" end) | \((.description // "No description available") | gsub("\n"; " ")) |"' "$SCAN_REPORT_PATH" >> $GITHUB_STEP_SUMMARY
111+
echo "" >> $GITHUB_STEP_SUMMARY
112+
else
113+
echo "❌ **Scan results not found or scan failed**" >> $GITHUB_STEP_SUMMARY
114+
fi
115+
116+
echo "" >> $GITHUB_STEP_SUMMARY
117+
echo "[📃 Download the full report](${{ steps.upload-scan-results.outputs.artifact-url }})" >> $GITHUB_STEP_SUMMARY
118+
119+
- name: Post notification on Slack channel
120+
id: deployment_message
121+
uses: slackapi/slack-github-action@v2.1.0
122+
with:
123+
method: chat.postMessage
124+
token: ${{ secrets.SLACK_BOT_TOKEN }}
125+
payload: |
126+
channel: ${{ secrets.SLACK_CHANNEL_ID }}
127+
text: ""
128+
blocks:
129+
- type: "header"
130+
text:
131+
type: "plain_text"
132+
text: "${{ steps.container-scan.outcome == 'success' && '✅' || '❌' }} Vulnerability Report: ${{ steps.container-scan.outcome == 'success' && 'All okay' || 'Needs attention' }}"
133+
- type: "markdown"
134+
text: "${{ steps.security-summary.outputs.summary }}"

0 commit comments

Comments
 (0)