Public Access
generated from Philipp/template-git
ci: add matrix test workflow for debian slim images in .gitea #15
+87
-87
@@ -1,87 +1,87 @@
|
|||||||
name: CI Tests
|
name: CI Tests
|
||||||
|
|
||||||
on:
|
on:
|
||||||
push:
|
push:
|
||||||
branches:
|
branches:
|
||||||
- main
|
- main
|
||||||
pull_request:
|
pull_request:
|
||||||
branches:
|
branches:
|
||||||
- main
|
- main
|
||||||
workflow_dispatch:
|
workflow_dispatch:
|
||||||
|
|
||||||
jobs:
|
jobs:
|
||||||
test:
|
test:
|
||||||
name: ${{ matrix.image_set.name }} (sbom=${{ matrix.use_inbuild_sbom }})
|
name: ${{ matrix.image_set.name }} (sbom=${{ matrix.use_inbuild_sbom }})
|
||||||
runs-on: k8s
|
runs-on: k8s
|
||||||
strategy:
|
strategy:
|
||||||
fail-fast: false
|
fail-fast: false
|
||||||
matrix:
|
matrix:
|
||||||
image_set:
|
image_set:
|
||||||
# Test 1: Slim images with built-in SBOMs (2 architectures, 15-40 CVEs each)
|
# Test 1: Slim images with built-in SBOMs (2 architectures, 15-40 CVEs each)
|
||||||
- name: with-inbuild-sbom
|
- name: with-inbuild-sbom
|
||||||
head_image: debian:bookworm-slim
|
head_image: debian:bookworm-slim
|
||||||
target_image: debian:bullseye-slim
|
target_image: debian:bullseye-slim
|
||||||
architectures: amd64,arm64
|
architectures: amd64,arm64
|
||||||
expect_arch_col: true
|
expect_arch_col: true
|
||||||
|
|
||||||
# Test 2: Slim images without built-in SBOMs (1 architecture, 70-120 CVEs each)
|
# Test 2: Slim images without built-in SBOMs (1 architecture, 70-120 CVEs each)
|
||||||
- name: without-inbuild-sbom
|
- name: without-inbuild-sbom
|
||||||
head_image: debian:buster-slim
|
head_image: debian:buster-slim
|
||||||
target_image: debian:stretch-slim
|
target_image: debian:stretch-slim
|
||||||
architectures: amd64
|
architectures: amd64
|
||||||
expect_arch_col: false
|
expect_arch_col: false
|
||||||
|
|
||||||
# Test 3: Cross-check (Head has built-in SBOM, Target does not, 15-70 CVEs each)
|
# Test 3: Cross-check (Head has built-in SBOM, Target does not, 15-70 CVEs each)
|
||||||
- name: cross-check-mixed-sbom
|
- name: cross-check-mixed-sbom
|
||||||
head_image: debian:bookworm-slim
|
head_image: debian:bookworm-slim
|
||||||
target_image: debian:buster-slim
|
target_image: debian:buster-slim
|
||||||
architectures: amd64
|
architectures: amd64
|
||||||
expect_arch_col: false
|
expect_arch_col: false
|
||||||
|
|
||||||
use_inbuild_sbom:
|
use_inbuild_sbom:
|
||||||
- "true"
|
- 'true'
|
||||||
- "false"
|
- 'false'
|
||||||
|
|
||||||
steps:
|
steps:
|
||||||
- name: Checkout repository
|
- name: Checkout repository
|
||||||
uses: actions/checkout@v4
|
uses: actions/checkout@v4
|
||||||
|
|
||||||
- name: Test CVE Differential Action
|
- name: Test CVE Differential Action
|
||||||
uses: ./
|
uses: ./
|
||||||
with:
|
with:
|
||||||
head-image: ${{ matrix.image_set.head_image }}
|
head-image: ${{ matrix.image_set.head_image }}
|
||||||
target-image: ${{ matrix.image_set.target_image }}
|
target-image: ${{ matrix.image_set.target_image }}
|
||||||
target-branch: main
|
target-branch: main
|
||||||
architectures: ${{ matrix.image_set.architectures }}
|
architectures: ${{ matrix.image_set.architectures }}
|
||||||
use-inbuild-sbom: ${{ matrix.use_inbuild_sbom }}
|
use-inbuild-sbom: ${{ matrix.use_inbuild_sbom }}
|
||||||
output-delta: cve-delta.md
|
output-delta: cve-delta.md
|
||||||
output-summary: cve-summary.md
|
output-summary: cve-summary.md
|
||||||
|
|
||||||
- name: Verify Report Generation & Content
|
- name: Verify Report Generation & Content
|
||||||
shell: bash
|
shell: bash
|
||||||
run: |
|
run: |
|
||||||
set -euo pipefail
|
set -euo pipefail
|
||||||
|
|
||||||
test -s cve-delta.md || (echo "::error::cve-delta.md is empty or missing" && exit 1)
|
test -s cve-delta.md || (echo "::error::cve-delta.md is empty or missing" && exit 1)
|
||||||
test -s cve-summary.md || (echo "::error::cve-summary.md is empty or missing" && exit 1)
|
test -s cve-summary.md || (echo "::error::cve-summary.md is empty or missing" && exit 1)
|
||||||
|
|
||||||
# Verify that each scan produced at least 3 CVE findings
|
# Verify that each scan produced at least 3 CVE findings
|
||||||
cve_count=$(grep -c "CVE-" cve-summary.md || echo 0)
|
cve_count=$(grep -c "CVE-" cve-summary.md || echo 0)
|
||||||
echo "Total CVE entries found in summary report: $cve_count"
|
echo "Total CVE entries found in summary report: $cve_count"
|
||||||
if [ "$cve_count" -lt 3 ]; then
|
if [ "$cve_count" -lt 3 ]; then
|
||||||
echo "::error::Expected at least 3 CVEs in cve-summary.md, found only $cve_count"
|
echo "::error::Expected at least 3 CVEs in cve-summary.md, found only $cve_count"
|
||||||
exit 1
|
exit 1
|
||||||
fi
|
fi
|
||||||
|
|
||||||
echo "=== Delta Report Preview ==="
|
echo "=== Delta Report Preview ==="
|
||||||
head -n 25 cve-delta.md
|
head -n 25 cve-delta.md
|
||||||
|
|
||||||
# Verify architectural column rendering behavior
|
# Verify architectural column rendering behavior
|
||||||
if [ "${{ matrix.image_set.expect_arch_col }}" = "true" ]; then
|
if [ "${{ matrix.image_set.expect_arch_col }}" = "true" ]; then
|
||||||
grep -q "| Arch |" cve-delta.md || (echo "::error::Expected Arch column in multi-arch report" && exit 1)
|
grep -q "| Arch |" cve-delta.md || (echo "::error::Expected Arch column in multi-arch report" && exit 1)
|
||||||
else
|
else
|
||||||
if grep -q "| Arch |" cve-delta.md; then
|
if grep -q "| Arch |" cve-delta.md; then
|
||||||
echo "::error::Did not expect Arch column in single-arch report" && exit 1
|
echo "::error::Did not expect Arch column in single-arch report" && exit 1
|
||||||
fi
|
fi
|
||||||
fi
|
fi
|
||||||
echo "✅ All assertions passed (including >= 3 CVEs verification)."
|
echo "✅ All assertions passed (including >= 3 CVEs verification)."
|
||||||
Reference in new issue
Block a user