|
31397
|
23582
|
76
|
5
|
eefb0fed0ca13cafe27e806924d4cc2f19154087
|
0
|
Application image scan (ops-alertmanager)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-alertmanager)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-alertmanager:ci
target:
- ops-alertmanager
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788270616
|
1788270708
|
|
1
|
|
0
|
Edit
Delete
|
|
31398
|
23582
|
76
|
5
|
eefb0fed0ca13cafe27e806924d4cc2f19154087
|
0
|
Application image scan (ops-gateway)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-gateway)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-gateway:ci
target:
- ops-gateway
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788270616
|
1788270708
|
|
1
|
|
0
|
Edit
Delete
|
|
31399
|
23582
|
76
|
5
|
eefb0fed0ca13cafe27e806924d4cc2f19154087
|
0
|
Application image scan (ops-loki)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-loki)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-loki:ci
target:
- ops-loki
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788270616
|
1788270708
|
|
1
|
|
0
|
Edit
Delete
|
|
31400
|
23582
|
76
|
5
|
eefb0fed0ca13cafe27e806924d4cc2f19154087
|
0
|
Application image scan (ops-otel-collector)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-otel-collector)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-otel-collector:ci
target:
- ops-otel-collector
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788270616
|
1788270708
|
|
1
|
|
0
|
Edit
Delete
|
|
31401
|
23582
|
76
|
5
|
eefb0fed0ca13cafe27e806924d4cc2f19154087
|
0
|
Application image scan (ops-pager)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-pager)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-pager:ci
target:
- ops-pager
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788270616
|
1788270708
|
|
1
|
|
0
|
Edit
Delete
|
|
31402
|
23582
|
76
|
5
|
eefb0fed0ca13cafe27e806924d4cc2f19154087
|
0
|
Application image scan (ops-postgres)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-postgres)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-postgres:ci
target:
- ops-postgres
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788270616
|
1788270708
|
|
1
|
|
0
|
Edit
Delete
|
|
31403
|
23582
|
76
|
5
|
eefb0fed0ca13cafe27e806924d4cc2f19154087
|
0
|
Application image scan (ops-tempo)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-tempo)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-tempo:ci
target:
- ops-tempo
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788270616
|
1788270708
|
|
1
|
|
0
|
Edit
Delete
|
|
31404
|
23582
|
76
|
5
|
eefb0fed0ca13cafe27e806924d4cc2f19154087
|
0
|
Application image scan (ops-trace-storage)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-trace-storage)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-trace-storage:ci
target:
- ops-trace-storage
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788270616
|
1788270708
|
|
1
|
|
0
|
Edit
Delete
|
|
31405
|
23582
|
76
|
5
|
eefb0fed0ca13cafe27e806924d4cc2f19154087
|
0
|
Application image scan (web)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (web)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-web:ci
target:
- web
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788270616
|
1788270708
|
|
1
|
|
0
|
Edit
Delete
|
|
31467
|
23602
|
76
|
5
|
019f721377c4a8970dfc4064886129b1cbcbd089
|
0
|
Application image scan (api-fastify)
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (api-fastify)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-api-fastify:ci
target:
- api-fastify
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27393
|
2
|
1788361842
|
1788361928
|
1788361593
|
1788361928
|
|
1
|
|
0
|
Edit
Delete
|
|
31468
|
23602
|
76
|
5
|
019f721377c4a8970dfc4064886129b1cbcbd089
|
0
|
Application image scan (api-nestjs)
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (api-nestjs)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-api-nestjs:ci
target:
- api-nestjs
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27394
|
2
|
1788361928
|
1788362004
|
1788361593
|
1788362004
|
|
1
|
|
0
|
Edit
Delete
|
|
31469
|
23602
|
76
|
5
|
019f721377c4a8970dfc4064886129b1cbcbd089
|
0
|
Application image scan (ops-alertmanager)
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-alertmanager)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-alertmanager:ci
target:
- ops-alertmanager
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27395
|
2
|
1788362004
|
1788362081
|
1788361593
|
1788362081
|
|
1
|
|
0
|
Edit
Delete
|
|
31470
|
23602
|
76
|
5
|
019f721377c4a8970dfc4064886129b1cbcbd089
|
0
|
Application image scan (ops-gateway)
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-gateway)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-gateway:ci
target:
- ops-gateway
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27396
|
2
|
1788362081
|
1788362158
|
1788361593
|
1788362158
|
|
1
|
|
0
|
Edit
Delete
|
|
31471
|
23602
|
76
|
5
|
019f721377c4a8970dfc4064886129b1cbcbd089
|
0
|
Application image scan (ops-loki)
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-loki)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-loki:ci
target:
- ops-loki
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27397
|
2
|
1788362158
|
1788362235
|
1788361593
|
1788362235
|
|
1
|
|
0
|
Edit
Delete
|
|
31472
|
23602
|
76
|
5
|
019f721377c4a8970dfc4064886129b1cbcbd089
|
0
|
Application image scan (ops-otel-collector)
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-otel-collector)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-otel-collector:ci
target:
- ops-otel-collector
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27398
|
2
|
1788362235
|
1788362312
|
1788361593
|
1788362312
|
|
1
|
|
0
|
Edit
Delete
|
|
31473
|
23602
|
76
|
5
|
019f721377c4a8970dfc4064886129b1cbcbd089
|
0
|
Application image scan (ops-pager)
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-pager)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-pager:ci
target:
- ops-pager
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27399
|
2
|
1788362312
|
1788362392
|
1788361593
|
1788362392
|
|
1
|
|
0
|
Edit
Delete
|
|
31474
|
23602
|
76
|
5
|
019f721377c4a8970dfc4064886129b1cbcbd089
|
0
|
Application image scan (ops-postgres)
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-postgres)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-postgres:ci
target:
- ops-postgres
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27400
|
2
|
1788362392
|
1788362438
|
1788361593
|
1788362439
|
|
1
|
|
0
|
Edit
Delete
|
|
31475
|
23602
|
76
|
5
|
019f721377c4a8970dfc4064886129b1cbcbd089
|
0
|
Application image scan (ops-tempo)
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-tempo)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-tempo:ci
target:
- ops-tempo
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27401
|
2
|
1788362439
|
1788362455
|
1788361593
|
1788362455
|
|
1
|
|
0
|
Edit
Delete
|
|
31476
|
23602
|
76
|
5
|
019f721377c4a8970dfc4064886129b1cbcbd089
|
0
|
Application image scan (ops-trace-storage)
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-trace-storage)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-trace-storage:ci
target:
- ops-trace-storage
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27402
|
2
|
1788362455
|
1788362531
|
1788361593
|
1788362531
|
|
1
|
|
0
|
Edit
Delete
|
|
31477
|
23602
|
76
|
5
|
019f721377c4a8970dfc4064886129b1cbcbd089
|
0
|
Application image scan (web)
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (web)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-web:ci
target:
- web
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27403
|
2
|
1788362531
|
1788362547
|
1788361593
|
1788362548
|
|
1
|
|
0
|
Edit
Delete
|
|
31482
|
23603
|
76
|
5
|
c48ff8853fb96ecd420890a0e933711dc5fa6a1e
|
0
|
Application image scan (api-fastify)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (api-fastify)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-api-fastify:ci
target:
- api-fastify
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788370321
|
1788370347
|
|
1
|
|
0
|
Edit
Delete
|
|
31483
|
23603
|
76
|
5
|
c48ff8853fb96ecd420890a0e933711dc5fa6a1e
|
0
|
Application image scan (api-nestjs)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (api-nestjs)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-api-nestjs:ci
target:
- api-nestjs
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788370321
|
1788370347
|
|
1
|
|
0
|
Edit
Delete
|
|
31484
|
23603
|
76
|
5
|
c48ff8853fb96ecd420890a0e933711dc5fa6a1e
|
0
|
Application image scan (ops-alertmanager)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-alertmanager)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-alertmanager:ci
target:
- ops-alertmanager
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788370321
|
1788370347
|
|
1
|
|
0
|
Edit
Delete
|
|
31485
|
23603
|
76
|
5
|
c48ff8853fb96ecd420890a0e933711dc5fa6a1e
|
0
|
Application image scan (ops-gateway)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-gateway)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-gateway:ci
target:
- ops-gateway
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788370321
|
1788370347
|
|
1
|
|
0
|
Edit
Delete
|
|
31486
|
23603
|
76
|
5
|
c48ff8853fb96ecd420890a0e933711dc5fa6a1e
|
0
|
Application image scan (ops-loki)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-loki)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-loki:ci
target:
- ops-loki
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788370321
|
1788370347
|
|
1
|
|
0
|
Edit
Delete
|
|
31487
|
23603
|
76
|
5
|
c48ff8853fb96ecd420890a0e933711dc5fa6a1e
|
0
|
Application image scan (ops-otel-collector)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-otel-collector)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-otel-collector:ci
target:
- ops-otel-collector
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788370321
|
1788370347
|
|
1
|
|
0
|
Edit
Delete
|
|
31488
|
23603
|
76
|
5
|
c48ff8853fb96ecd420890a0e933711dc5fa6a1e
|
0
|
Application image scan (ops-pager)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-pager)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-pager:ci
target:
- ops-pager
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788370321
|
1788370347
|
|
1
|
|
0
|
Edit
Delete
|
|
31489
|
23603
|
76
|
5
|
c48ff8853fb96ecd420890a0e933711dc5fa6a1e
|
0
|
Application image scan (ops-postgres)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-postgres)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-postgres:ci
target:
- ops-postgres
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788370321
|
1788370347
|
|
1
|
|
0
|
Edit
Delete
|
|
31490
|
23603
|
76
|
5
|
c48ff8853fb96ecd420890a0e933711dc5fa6a1e
|
0
|
Application image scan (ops-tempo)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-tempo)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-tempo:ci
target:
- ops-tempo
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788370321
|
1788370347
|
|
1
|
|
0
|
Edit
Delete
|
|
31491
|
23603
|
76
|
5
|
c48ff8853fb96ecd420890a0e933711dc5fa6a1e
|
0
|
Application image scan (ops-trace-storage)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-trace-storage)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-trace-storage:ci
target:
- ops-trace-storage
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788370321
|
1788370347
|
|
1
|
|
0
|
Edit
Delete
|
|
31492
|
23603
|
76
|
5
|
c48ff8853fb96ecd420890a0e933711dc5fa6a1e
|
0
|
Application image scan (web)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (web)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-web:ci
target:
- web
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788370321
|
1788370347
|
|
1
|
|
0
|
Edit
Delete
|
|
31567
|
23628
|
76
|
5
|
7937b2adf8e2349bf89ebd91e94baac5cc2a46dd
|
0
|
Application image scan (api-fastify)
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (api-fastify)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-api-fastify:ci
target:
- api-fastify
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27455
|
2
|
1788477177
|
1788477261
|
1788476930
|
1788477261
|
|
1
|
|
0
|
Edit
Delete
|
|
31568
|
23628
|
76
|
5
|
7937b2adf8e2349bf89ebd91e94baac5cc2a46dd
|
0
|
Application image scan (api-nestjs)
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (api-nestjs)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-api-nestjs:ci
target:
- api-nestjs
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27456
|
2
|
1788477261
|
1788477337
|
1788476930
|
1788477337
|
|
1
|
|
0
|
Edit
Delete
|
|
31569
|
23628
|
76
|
5
|
7937b2adf8e2349bf89ebd91e94baac5cc2a46dd
|
0
|
Application image scan (ops-alertmanager)
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-alertmanager)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-alertmanager:ci
target:
- ops-alertmanager
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27457
|
2
|
1788477337
|
1788477414
|
1788476930
|
1788477414
|
|
1
|
|
0
|
Edit
Delete
|
|
31570
|
23628
|
76
|
5
|
7937b2adf8e2349bf89ebd91e94baac5cc2a46dd
|
0
|
Application image scan (ops-gateway)
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-gateway)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-gateway:ci
target:
- ops-gateway
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27458
|
2
|
1788477415
|
1788477492
|
1788476930
|
1788477492
|
|
1
|
|
0
|
Edit
Delete
|
|
31571
|
23628
|
76
|
5
|
7937b2adf8e2349bf89ebd91e94baac5cc2a46dd
|
0
|
Application image scan (ops-loki)
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-loki)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-loki:ci
target:
- ops-loki
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27459
|
2
|
1788477492
|
1788477569
|
1788476930
|
1788477569
|
|
1
|
|
0
|
Edit
Delete
|
|
31572
|
23628
|
76
|
5
|
7937b2adf8e2349bf89ebd91e94baac5cc2a46dd
|
0
|
Application image scan (ops-otel-collector)
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-otel-collector)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-otel-collector:ci
target:
- ops-otel-collector
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27460
|
2
|
1788477569
|
1788477646
|
1788476930
|
1788477646
|
|
1
|
|
0
|
Edit
Delete
|
|
31573
|
23628
|
76
|
5
|
7937b2adf8e2349bf89ebd91e94baac5cc2a46dd
|
0
|
Application image scan (ops-pager)
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-pager)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-pager:ci
target:
- ops-pager
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27461
|
2
|
1788477646
|
1788477722
|
1788476930
|
1788477722
|
|
1
|
|
0
|
Edit
Delete
|
|
31574
|
23628
|
76
|
5
|
7937b2adf8e2349bf89ebd91e94baac5cc2a46dd
|
0
|
Application image scan (ops-postgres)
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-postgres)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-postgres:ci
target:
- ops-postgres
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27462
|
2
|
1788477722
|
1788477799
|
1788476930
|
1788477799
|
|
1
|
|
0
|
Edit
Delete
|
|
31575
|
23628
|
76
|
5
|
7937b2adf8e2349bf89ebd91e94baac5cc2a46dd
|
0
|
Application image scan (ops-tempo)
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-tempo)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-tempo:ci
target:
- ops-tempo
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27463
|
2
|
1788477799
|
1788477875
|
1788476930
|
1788477876
|
|
1
|
|
0
|
Edit
Delete
|
|
31576
|
23628
|
76
|
5
|
7937b2adf8e2349bf89ebd91e94baac5cc2a46dd
|
0
|
Application image scan (ops-trace-storage)
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-trace-storage)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-trace-storage:ci
target:
- ops-trace-storage
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27464
|
2
|
1788477876
|
1788477952
|
1788476930
|
1788477952
|
|
1
|
|
0
|
Edit
Delete
|
|
31577
|
23628
|
76
|
5
|
7937b2adf8e2349bf89ebd91e94baac5cc2a46dd
|
0
|
Application image scan (web)
|
1
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (web)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-web:ci
target:
- web
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
27465
|
2
|
1788477952
|
1788478371
|
1788476930
|
1788478371
|
|
1
|
|
0
|
Edit
Delete
|
|
31582
|
23629
|
76
|
5
|
dc3e82cb8b195f394a11166d717dfcb526353dcc
|
0
|
Application image scan (api-fastify)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (api-fastify)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-api-fastify:ci
target:
- api-fastify
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788478715
|
1788479196
|
|
1
|
|
0
|
Edit
Delete
|
|
31583
|
23629
|
76
|
5
|
dc3e82cb8b195f394a11166d717dfcb526353dcc
|
0
|
Application image scan (api-nestjs)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (api-nestjs)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-api-nestjs:ci
target:
- api-nestjs
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788478715
|
1788479196
|
|
1
|
|
0
|
Edit
Delete
|
|
31584
|
23629
|
76
|
5
|
dc3e82cb8b195f394a11166d717dfcb526353dcc
|
0
|
Application image scan (ops-alertmanager)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-alertmanager)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-alertmanager:ci
target:
- ops-alertmanager
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788478715
|
1788479196
|
|
1
|
|
0
|
Edit
Delete
|
|
31585
|
23629
|
76
|
5
|
dc3e82cb8b195f394a11166d717dfcb526353dcc
|
0
|
Application image scan (ops-gateway)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-gateway)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-gateway:ci
target:
- ops-gateway
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788478715
|
1788479196
|
|
1
|
|
0
|
Edit
Delete
|
|
31586
|
23629
|
76
|
5
|
dc3e82cb8b195f394a11166d717dfcb526353dcc
|
0
|
Application image scan (ops-loki)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-loki)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-loki:ci
target:
- ops-loki
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788478715
|
1788479196
|
|
1
|
|
0
|
Edit
Delete
|
|
31587
|
23629
|
76
|
5
|
dc3e82cb8b195f394a11166d717dfcb526353dcc
|
0
|
Application image scan (ops-otel-collector)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-otel-collector)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-otel-collector:ci
target:
- ops-otel-collector
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788478715
|
1788479196
|
|
1
|
|
0
|
Edit
Delete
|
|
31588
|
23629
|
76
|
5
|
dc3e82cb8b195f394a11166d717dfcb526353dcc
|
0
|
Application image scan (ops-pager)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-pager)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-pager:ci
target:
- ops-pager
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788478715
|
1788479196
|
|
1
|
|
0
|
Edit
Delete
|
|
31589
|
23629
|
76
|
5
|
dc3e82cb8b195f394a11166d717dfcb526353dcc
|
0
|
Application image scan (ops-postgres)
|
0
|
name: Governance
"on":
pull_request:
name: Governance
"on":
pull_request:
push:
branches:
- main
jobs:
application-image-vulnerability-scan:
name: Application image scan (ops-postgres)
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
with:
fetch-depth: "0"
- name: Build immutable application target
run: docker build --target "${{ matrix.target }}" --tag "${{ matrix.image }}" --file deploy/production/Dockerfile .
env:
DOCKER_BUILDKIT: "1"
- if: matrix.target == 'ops-postgres'
name: Verify hardened PostgreSQL runtime
run: node scripts/check-postgres-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-alertmanager'
name: Verify reduced Alertmanager runtime
run: node scripts/check-alertmanager-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-loki'
name: Verify rebuilt Loki runtime
run: node scripts/check-loki-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-tempo'
name: Verify rebuilt Tempo runtime
run: node scripts/check-tempo-image.mjs "${{ matrix.image }}"
- if: matrix.target == 'ops-otel-collector'
name: Verify minimal OTel Collector runtime
run: node scripts/check-otel-collector-image.mjs "${{ matrix.image }}"
- name: Reject application HIGH or CRITICAL vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25
with:
exit-code: "1"
format: table
ignore-unfixed: "false"
image-ref: ${{ matrix.image }}
scanners: vuln
severity: CRITICAL,HIGH
trivy-version: v0.74.0
vuln-type: os,library
strategy:
fail-fast: "false"
matrix:
image:
- deos-scan-ops-postgres:ci
target:
- ops-postgres
permissions:
contents: read
...
|
application-image-vulnerability-scan
|
["static-governance"]
|
["ubuntu-latest"]
|
0
|
4
|
0
|
0
|
1788478715
|
1788479196
|
|
1
|
|
0
|
Edit
Delete
|