Skip to content

Commit 4e28ad8

Browse files
juliojimenezjuliojimenez
authored
Merge pull request #4 from ClickHouse/docker-security
Docker Security
2 parents 117e73c + f675e37 commit 4e28ad8

File tree

1 file changed

+244
-0
lines changed

1 file changed

+244
-0
lines changed

‎.github/workflows/docker-security.yml‎

Lines changed: 244 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,244 @@
1+
# Add this to .github/workflows/docker-security.yml
2+
name: 🐳 Docker Security Scan
3+
on:
4+
push:
5+
branches: [main]
6+
paths:
7+
- 'Dockerfile'
8+
- 'entrypoint.sh'
9+
- '.github/workflows/docker-security.yml'
10+
pull_request:
11+
branches: [main]
12+
paths:
13+
- 'Dockerfile'
14+
- 'entrypoint.sh'
15+
- '.github/workflows/docker-security.yml'
16+
schedule:
17+
# Run weekly on Sundays at 2 AM UTC
18+
- cron: '0 0 * * 0'
19+
workflow_dispatch:
20+
21+
jobs:
22+
docker_security_scan:
23+
name: 🔍 Container Security Scan
24+
runs-on: ubuntu-latest
25+
26+
permissions:
27+
contents: read
28+
security-events: write
29+
actions: read
30+
31+
steps:
32+
- name: 🧾 Checkout
33+
uses: actions/checkout@v4
34+
35+
- name: 🔨 Build Docker Image
36+
run: |
37+
docker build -t clickbom:latest .
38+
docker tag clickbom:latest clickbom:${{ github.sha }}
39+
40+
- name: 🛡️ Run Trivy vulnerability scanner
41+
uses: aquasecurity/trivy-action@master
42+
with:
43+
image-ref: clickbom:latest
44+
format: 'sarif'
45+
output: 'trivy-results.sarif'
46+
severity: 'CRITICAL,HIGH,MEDIUM'
47+
48+
- name: 📤 Upload Trivy scan results to GitHub Security tab
49+
uses: github/codeql-action/upload-sarif@v3
50+
if: always()
51+
with:
52+
sarif_file: 'trivy-results.sarif'
53+
54+
- name: 🔍 Run Trivy for JSON output
55+
uses: aquasecurity/trivy-action@master
56+
with:
57+
image-ref: 'clickbom:latest'
58+
format: 'json'
59+
output: 'trivy-results.json'
60+
severity: 'CRITICAL,HIGH,MEDIUM,LOW'
61+
62+
- name: 📊 Generate Security Report
63+
run: |
64+
echo "# 🐳 Container Security Report" > security-report.md
65+
echo "Generated on: $(date)" >> security-report.md
66+
echo "" >> security-report.md
67+
68+
# Trivy Results Summary
69+
echo "## 🛡️ Trivy Scan Results" >> security-report.md
70+
if [ -f "trivy-results.json" ]; then
71+
CRITICAL=$(jq '[.Results[]?.Vulnerabilities[]? | select(.Severity == "CRITICAL")] | length' trivy-results.json 2>/dev/null || echo "0")
72+
HIGH=$(jq '[.Results[]?.Vulnerabilities[]? | select(.Severity == "HIGH")] | length' trivy-results.json 2>/dev/null || echo "0")
73+
MEDIUM=$(jq '[.Results[]?.Vulnerabilities[]? | select(.Severity == "MEDIUM")] | length' trivy-results.json 2>/dev/null || echo "0")
74+
LOW=$(jq '[.Results[]?.Vulnerabilities[]? | select(.Severity == "LOW")] | length' trivy-results.json 2>/dev/null || echo "0")
75+
76+
echo "- 🔴 Critical: $CRITICAL" >> security-report.md
77+
echo "- 🟠 High: $HIGH" >> security-report.md
78+
echo "- 🟡 Medium: $MEDIUM" >> security-report.md
79+
echo "- 🟢 Low: $LOW" >> security-report.md
80+
else
81+
echo "- No Trivy results found" >> security-report.md
82+
fi
83+
84+
echo "" >> security-report.md
85+
echo "## 📋 Recommendations" >> security-report.md
86+
echo "1. Review critical and high severity vulnerabilities" >> security-report.md
87+
echo "2. Update base image and dependencies regularly" >> security-report.md
88+
echo "3. Consider using distroless or minimal base images" >> security-report.md
89+
echo "4. Run security scans in CI/CD pipeline" >> security-report.md
90+
91+
- name: 📎 Upload Security Artifacts
92+
uses: actions/upload-artifact@v4
93+
if: always()
94+
with:
95+
name: security-scan-results
96+
path: |
97+
trivy-results.json
98+
trivy-results.sarif
99+
security-report.md
100+
retention-days: 30
101+
102+
- name: 🚨 Check for Critical Vulnerabilities
103+
run: |
104+
if [ -f "trivy-results.json" ]; then
105+
CRITICAL=$(jq '[.Results[]?.Vulnerabilities[]? | select(.Severity == "CRITICAL")] | length' trivy-results.json 2>/dev/null || echo "0")
106+
echo "Critical vulnerabilities found: $CRITICAL"
107+
108+
if [ "$CRITICAL" -gt 0 ]; then
109+
echo "::error::Found $CRITICAL critical vulnerabilities in the container image"
110+
echo "::error::Please review and fix critical vulnerabilities before deploying"
111+
# Uncomment the next line if you want to fail the build on critical vulnerabilities
112+
# exit 1
113+
fi
114+
fi
115+
116+
dockerfile_security_scan:
117+
name: 🐋 Dockerfile Security Scan
118+
runs-on: ubuntu-latest
119+
120+
steps:
121+
- name: 🧾 Checkout
122+
uses: actions/checkout@v4
123+
124+
- name: 🔍 Run Hadolint (Dockerfile Linter)
125+
uses: hadolint/[email protected]
126+
with:
127+
dockerfile: Dockerfile
128+
format: sarif
129+
output-file: hadolint-results.sarif
130+
no-color: true
131+
132+
- name: 📤 Upload Hadolint scan results
133+
uses: github/codeql-action/upload-sarif@v3
134+
if: always()
135+
with:
136+
sarif_file: hadolint-results.sarif
137+
138+
- name: 🔍 Run Checkov (Infrastructure as Code Security)
139+
uses: bridgecrewio/checkov-action@master
140+
if: always()
141+
with:
142+
directory: .
143+
framework: dockerfile
144+
output_format: sarif
145+
output_file_path: checkov-results.sarif
146+
147+
- name: 📤 Upload Checkov scan results
148+
uses: github/codeql-action/upload-sarif@v3
149+
if: always()
150+
with:
151+
sarif_file: checkov-results.sarif
152+
153+
container_sbom:
154+
name: 📋 Generate Container SBOM
155+
runs-on: ubuntu-latest
156+
needs: docker_security_scan
157+
158+
steps:
159+
- name: 🧾 Checkout
160+
uses: actions/checkout@v4
161+
162+
- name: 🔨 Build Docker Image
163+
run: |
164+
docker build -t clickbom:latest .
165+
166+
- name: 📋 Generate SBOM with Syft
167+
uses: anchore/sbom-action@v0
168+
with:
169+
image: clickbom:latest
170+
format: spdx-json
171+
output-file: container-sbom.spdx.json
172+
173+
- name: 📋 Generate SBOM with Docker Scout
174+
run: |
175+
# Install Docker Scout CLI
176+
curl -sSfL https://raw.githubusercontent.com/docker/scout-cli/main/install.sh | sh -s --
177+
178+
# Generate SBOM
179+
docker scout sbom clickbom:latest --format spdx --output container-sbom-scout.spdx.json || echo "Docker Scout SBOM generation failed"
180+
181+
- name: 📎 Upload Container SBOM
182+
uses: actions/upload-artifact@v4
183+
with:
184+
name: container-sbom
185+
path: |
186+
container-sbom.spdx.json
187+
container-sbom-scout.spdx.json
188+
retention-days: 30
189+
190+
security_summary:
191+
name: 📊 Security Summary
192+
runs-on: ubuntu-latest
193+
needs: [docker_security_scan, dockerfile_security_scan, container_sbom]
194+
if: always()
195+
196+
steps:
197+
- name: 📥 Download Security Artifacts
198+
uses: actions/download-artifact@v3
199+
with:
200+
name: security-scan-results
201+
path: security-results/
202+
203+
- name: 📥 Download Container SBOM
204+
uses: actions/download-artifact@v3
205+
with:
206+
name: container-sbom
207+
path: sbom-results/
208+
209+
- name: 📊 Create Security Summary
210+
run: |
211+
echo "# 🔒 ClickBOM Container Security Summary" >> $GITHUB_STEP_SUMMARY
212+
echo "**Scan Date:** $(date)" >> $GITHUB_STEP_SUMMARY
213+
echo "" >> $GITHUB_STEP_SUMMARY
214+
215+
if [ -f "security-results/trivy-results.json" ]; then
216+
echo "## 🛡️ Vulnerability Scan Results" >> $GITHUB_STEP_SUMMARY
217+
CRITICAL=$(jq '[.Results[]?.Vulnerabilities[]? | select(.Severity == "CRITICAL")] | length' security-results/trivy-results.json 2>/dev/null || echo "0")
218+
HIGH=$(jq '[.Results[]?.Vulnerabilities[]? | select(.Severity == "HIGH")] | length' security-results/trivy-results.json 2>/dev/null || echo "0")
219+
MEDIUM=$(jq '[.Results[]?.Vulnerabilities[]? | select(.Severity == "MEDIUM")] | length' security-results/trivy-results.json 2>/dev/null || echo "0")
220+
LOW=$(jq '[.Results[]?.Vulnerabilities[]? | select(.Severity == "LOW")] | length' security-results/trivy-results.json 2>/dev/null || echo "0")
221+
222+
echo "| Severity | Count |" >> $GITHUB_STEP_SUMMARY
223+
echo "|----------|-------|" >> $GITHUB_STEP_SUMMARY
224+
echo "| 🔴 Critical | $CRITICAL |" >> $GITHUB_STEP_SUMMARY
225+
echo "| 🟠 High | $HIGH |" >> $GITHUB_STEP_SUMMARY
226+
echo "| 🟡 Medium | $MEDIUM |" >> $GITHUB_STEP_SUMMARY
227+
echo "| 🟢 Low | $LOW |" >> $GITHUB_STEP_SUMMARY
228+
echo "" >> $GITHUB_STEP_SUMMARY
229+
230+
if [ "$CRITICAL" -gt 0 ] || [ "$HIGH" -gt 0 ]; then
231+
echo "⚠️ **Action Required:** Critical or High severity vulnerabilities found!" >> $GITHUB_STEP_SUMMARY
232+
else
233+
echo "✅ **Good News:** No critical or high severity vulnerabilities found!" >> $GITHUB_STEP_SUMMARY
234+
fi
235+
fi
236+
237+
echo "" >> $GITHUB_STEP_SUMMARY
238+
echo "## 📋 Artifacts Generated" >> $GITHUB_STEP_SUMMARY
239+
echo "- Container vulnerability scan results (SARIF format)" >> $GITHUB_STEP_SUMMARY
240+
echo "- Dockerfile security scan results" >> $GITHUB_STEP_SUMMARY
241+
echo "- Container SBOM (Software Bill of Materials)" >> $GITHUB_STEP_SUMMARY
242+
echo "- Security summary report" >> $GITHUB_STEP_SUMMARY
243+
echo "" >> $GITHUB_STEP_SUMMARY
244+
echo "📥 Download artifacts from the workflow run to view detailed results." >> $GITHUB_STEP_SUMMARY

0 commit comments

Comments
 (0)