Public Access
generated from Philipp/template-git
Philipp
44c4b5a304
CI Tests / cross-check-mixed-sbom (sbom=true) (pull_request) Failing after 9m33s
CI Tests / cross-check-mixed-sbom (sbom=false) (pull_request) Successful in 10m38s
CI Tests / without-inbuild-sbom (sbom=false) (pull_request) Successful in 10m32s
CI Tests / without-inbuild-sbom (sbom=true) (pull_request) Successful in 3m9s
CI Tests / with-inbuild-sbom (sbom=true) (pull_request) Failing after 5m21s
CI Tests / with-inbuild-sbom (sbom=false) (pull_request) Successful in 5m25s
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Failing after 5m8s
88 lines
2.9 KiB
YAML
88 lines
2.9 KiB
YAML
name: CI Tests
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
pull_request:
|
|
branches:
|
|
- main
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
test:
|
|
name: ${{ matrix.image_set.name }} (sbom=${{ matrix.use_inbuild_sbom }})
|
|
runs-on: k8s
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
image_set:
|
|
# Test 1: Slim images with built-in SBOMs (2 architectures, 15-40 CVEs each)
|
|
- name: with-inbuild-sbom
|
|
head_image: debian:bookworm-slim
|
|
target_image: debian:bullseye-slim
|
|
architectures: amd64,arm64
|
|
expect_arch_col: true
|
|
|
|
# Test 2: Slim images without built-in SBOMs (1 architecture, 70-120 CVEs each)
|
|
- name: without-inbuild-sbom
|
|
head_image: debian:buster-slim
|
|
target_image: debian:stretch-slim
|
|
architectures: amd64
|
|
expect_arch_col: false
|
|
|
|
# Test 3: Cross-check (Head has built-in SBOM, Target does not, 15-70 CVEs each)
|
|
- name: cross-check-mixed-sbom
|
|
head_image: debian:bookworm-slim
|
|
target_image: debian:buster-slim
|
|
architectures: amd64
|
|
expect_arch_col: false
|
|
|
|
use_inbuild_sbom:
|
|
- "true"
|
|
- "false"
|
|
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Test CVE Differential Action
|
|
uses: ./
|
|
with:
|
|
head-image: ${{ matrix.image_set.head_image }}
|
|
target-image: ${{ matrix.image_set.target_image }}
|
|
target-branch: main
|
|
architectures: ${{ matrix.image_set.architectures }}
|
|
use-inbuild-sbom: ${{ matrix.use_inbuild_sbom }}
|
|
output-delta: cve-delta.md
|
|
output-summary: cve-summary.md
|
|
|
|
- name: Verify Report Generation & Content
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
test -s cve-delta.md || (echo "::error::cve-delta.md is empty or missing" && exit 1)
|
|
test -s cve-summary.md || (echo "::error::cve-summary.md is empty or missing" && exit 1)
|
|
|
|
# Verify that each scan produced at least 3 CVE findings
|
|
cve_count=$(grep -c "CVE-" cve-summary.md || echo 0)
|
|
echo "Total CVE entries found in summary report: $cve_count"
|
|
if [ "$cve_count" -lt 3 ]; then
|
|
echo "::error::Expected at least 3 CVEs in cve-summary.md, found only $cve_count"
|
|
exit 1
|
|
fi
|
|
|
|
echo "=== Delta Report Preview ==="
|
|
head -n 25 cve-delta.md
|
|
|
|
# Verify architectural column rendering behavior
|
|
if [ "${{ matrix.image_set.expect_arch_col }}" = "true" ]; then
|
|
grep -q "| Arch |" cve-delta.md || (echo "::error::Expected Arch column in multi-arch report" && exit 1)
|
|
else
|
|
if grep -q "| Arch |" cve-delta.md; then
|
|
echo "::error::Did not expect Arch column in single-arch report" && exit 1
|
|
fi
|
|
fi
|
|
echo "✅ All assertions passed (including >= 3 CVEs verification)."
|