d59b9105e9- Pin hi/go base image to digest (HI_GO_DIGEST ARG) in Containerfile - Pin syft install.sh URL to tagged release (was: main branch) - Verify cosign binary against cosign_checksums.txt before chmod +x - Fix npm: cp lockfile-resolved tree to global node_modules (was: npm install -g re-resolves deps outside lockfile) - Fix build-image IMAGE_DIGEST: drop broken FromImageDigest extraction; emit empty pre-push, real digest comes from push-image-by-digest --digestfile - Fix syft-scan-image: export to oci-archive, scan on host (was: syft inside container tried registry pull for unpushed image) - Fix push-image-by-digest TOCTOU: retag to release-tools:build-tmp before push; explicit :build-tmp destination so version tag is never created pre-sign - Add validate-skip-sign guard task to on-tag-publish: fails if SKIP_SIGN=true on any tag other than v1.0.0 - Fix README.md cosign.pub: replace mutable GitHub main-branch URL with commit-pinned Codeberg op1st-emea-b4mad URL
67 lines
2.3 KiB
YAML
67 lines
2.3 KiB
YAML
apiVersion: tekton.dev/v1
|
|
kind: Task
|
|
metadata:
|
|
name: release-tools-syft-scan-image
|
|
annotations:
|
|
tekton.dev/displayName: "syft SBOM scan of release-tools image"
|
|
spec:
|
|
params:
|
|
- name: IMAGE_REF
|
|
description: Full image reference to scan (tag or tag@digest).
|
|
type: string
|
|
- name: OUTPUT_FORMAT
|
|
description: syft output format.
|
|
type: string
|
|
default: cyclonedx-json
|
|
- name: STORAGE_DRIVER
|
|
description: buildah storage driver.
|
|
type: string
|
|
default: vfs
|
|
- name: SYFT_VERSION
|
|
description: syft version to install for scanning (pinned to same version baked into the image).
|
|
type: string
|
|
default: v1.44.0
|
|
workspaces:
|
|
- name: source
|
|
mountPath: /workspace/source
|
|
results:
|
|
- name: SBOM_PATH
|
|
description: Workspace-relative path of the emitted SBOM file.
|
|
steps:
|
|
- name: scan
|
|
image: quay.io/buildah/stable:latest
|
|
securityContext:
|
|
privileged: true
|
|
workingDir: $(workspaces.source.path)
|
|
script: |
|
|
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
IMAGE="$(params.IMAGE_REF)"
|
|
SBOM_FILE="$(workspaces.source.path)/release-tools-sbom.cdx.json"
|
|
|
|
SYFT_VERSION="$(params.SYFT_VERSION)"
|
|
ARCHIVE="/tmp/release-tools-scan.tar"
|
|
|
|
# Install syft on the host step container from the pinned release tag.
|
|
echo "Installing syft ${SYFT_VERSION}..."
|
|
curl -sSfL "https://raw.githubusercontent.com/anchore/syft/${SYFT_VERSION}/install.sh" \
|
|
| sh -s -- -b /usr/local/bin "${SYFT_VERSION}"
|
|
syft version
|
|
|
|
# Export the locally-built image to an OCI archive so syft can scan it
|
|
# without a registry pull. Running syft inside the image container would
|
|
# try a registry pull (the image is not pushed at PR-build time).
|
|
echo "Exporting ${IMAGE} to OCI archive..."
|
|
buildah push \
|
|
--storage-driver="$(params.STORAGE_DRIVER)" \
|
|
"${IMAGE}" \
|
|
"oci-archive:${ARCHIVE}"
|
|
|
|
echo "Scanning ${ARCHIVE} with syft..."
|
|
syft "oci-archive:${ARCHIVE}" \
|
|
--output "$(params.OUTPUT_FORMAT)=${SBOM_FILE}"
|
|
|
|
rm -f "${ARCHIVE}"
|
|
printf '%s' "release-tools-sbom.cdx.json" > "$(results.SBOM_PATH.path)"
|
|
echo "SBOM written to ${SBOM_FILE}"
|