ci: add image scanning step

.github/actions/generate-platform/action.yaml

@@ -0,0 +1,90 @@
+---
+name: Generate platform
+description: Renders a kubara platform from the working-tree catalogs.
+
+inputs:
+  kubara:
+    description: Path to the kubara binary.
+    required: true
+  kubara-scripts:
+    description: Path to the kubara repository's .scripts directory.
+    required: true
+  work-dir:
+    description: Directory to generate into.
+    required: true
+  provider:
+    description: Terraform provider.
+    default: stackit
+  kubernetes-type:
+    description: Kubernetes flavour.
+    default: ske
+  dns-name:
+    default: kubara-tst.stackit.run
+  project-id:
+    default: 00000000-0000-0000-0000-000000000000
+  velero-s3-url:
+    default: https://object.storage.eu01.onstackit.cloud
+
+runs:
+  using: composite
+  steps:
+    - name: Generate platform
+      shell: bash
+      env:
+        HOME: ${{ runner.temp }}/kubara-home
+        KUBARA: ${{ inputs.kubara }}
+        SCRIPTS: ${{ inputs.kubara-scripts }}
+        WORK_DIR: ${{ inputs.work-dir }}
+        KUBARA_PROJECT_NAME: kubara
+        KUBARA_PROJECT_STAGE: tst
+        KUBARA_DOCKERCONFIG_BASE64: "000000"
+        KUBARA_ARGOCD_WIZARD_ACCOUNT_PASSWORD: "000000"
+        KUBARA_ARGOCD_HELM_REPO_USERNAME: git
+        KUBARA_ARGOCD_HELM_REPO_PASSWORD: "000000"
+        KUBARA_ARGOCD_HELM_REPO_URL: https://kubara.io/kubara.git
+        KUBARA_ARGOCD_GIT_HTTPS_URL: https://kubara.io/kubara.git
+        KUBARA_ARGOCD_GIT_PAT_OR_PASSWORD: "000000"
+        KUBARA_ARGOCD_GIT_USERNAME: git
+        KUBARA_CLUSTER_TYPE: hub
+        KUBARA_SSO_ORG: Kubara
+        KUBARA_SSO_TEAM: Test
+        KUBARA_KUBERNETES_VERSION: 1.35.0
+        KUBARA_TERRAFORM_PROVIDER: ${{ inputs.provider }}
+        KUBARA_KUBERNETES_TYPE: ${{ inputs.kubernetes-type }}
+        KUBARA_DNS_NAME: ${{ inputs.dns-name }}
+        KUBARA_STACKIT_PROJECT_ID: ${{ inputs.project-id }}
+        KUBARA_VELERO_S3_URL: ${{ inputs.velero-s3-url }}
+      run: |
+        set -euo pipefail
+        bootstrap="${GITHUB_WORKSPACE}/bootstrap"
+        general="${GITHUB_WORKSPACE}/general"
+        mkdir -p "$WORK_DIR"
+
+        # Cache the working-tree catalogs locally so `init` resolves them
+        # without reaching for the published versions.
+        for catalog in bootstrap general; do
+          (cd "$catalog" && "$KUBARA" catalog package "oci://ghcr.io/${GITHUB_REPOSITORY_OWNER}/catalogs/")
+        done
+
+        "$KUBARA" --work-dir "$WORK_DIR" init --prep
+        "$SCRIPTS/kubara-env-update.sh" "$WORK_DIR/.env"
+        "$KUBARA" --work-dir "$WORK_DIR" --catalog "$general" --catalog-overwrite init
+        "$SCRIPTS/kubara-config-update.sh" "$WORK_DIR/config.yaml"
+
+        # `init` writes the CLI's pinned catalog refs (…/general:1.1.0) into
+        # config.yaml. Left alone, `generate` would render the PUBLISHED catalog
+        # instead of this working tree — silently wrong on any version bump.
+        BOOTSTRAP="$bootstrap" GENERAL="$general" yq eval '
+          .bootstrapCatalog = strenv(BOOTSTRAP) |
+          .clusters[].catalogs = [strenv(GENERAL)]
+        ' -i "$WORK_DIR/config.yaml"
+
+        yq eval '
+          .clusters[0].services[].status = "enabled" |
+          .clusters[0].services.metallb.config.publicLoadBalancerIPs = "192.0.2.10" |
+          .clusters[0].services.metallb.config.loadBalancerAddressPool = ["192.0.2.10-192.0.2.20"] |
+          .clusters[0].services.velero.config.backupStorage.bucketName = "kubara-ci-velero" |
+          .clusters[0].services.velero.config.backupStorage.s3Url = strenv(KUBARA_VELERO_S3_URL)
+        ' -i "$WORK_DIR/config.yaml"
+
+        "$KUBARA" --work-dir "$WORK_DIR" generate

.github/workflows/pr-checks.yaml

@@ -90,8 +90,6 @@ jobs:
       - name: Checkout catalogs
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      # Needed in both acquisition modes: the job below runs kubara's helper
-      # scripts (.ci/kubara/.scripts/*.sh) regardless of how the CLI is obtained.
       - name: Checkout kubara
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -322,3 +320,61 @@ jobs:
           name: terraform-validation-${{ matrix.target }}-${{ github.run_attempt }}-${{ github.sha }}-${{ github.run_number }}
           retention-days: ${{ env.ARTIFACT_RETENTION_DAYS }}
           path: ${{ env.REPORT_DIR }}/terraform
+
+  extract-images:
+    needs: integration-generate
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        target: [stackit-ske]
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Checkout CI scripts
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          sparse-checkout: |
+            .scripts
+            .github
+
+      - name: Download generated kubara artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: kubara-generated-${{ matrix.target }}-${{ github.run_attempt }}-${{ github.sha }}-${{ github.run_number }}
+
+      - name: Verify Helm
+        run: helm version --short
+
+      - name: Extract container images
+        env:
+          IMAGE_OUTPUT_FILE: ${{ github.workspace }}/reports/images.txt
+          HELM_CHART_VERSION_FILE: ${{ github.workspace }}/reports/chart.txt
+
+        run: |
+          mkdir -p reports
+          .scripts/image-version.sh
+
+      - name: Write image summary
+        if: always()
+        run: |
+          [[ -f reports/images.txt ]] || exit 0
+          echo "### Container Images" >> "$GITHUB_STEP_SUMMARY"
+          while read -r img; do
+            echo "- $img" >> "$GITHUB_STEP_SUMMARY"
+          done < reports/images.txt
+          [[ -f reports/chart.txt ]] || exit 0 
+          echo "### Helm Chart Image Versions" >> "$GITHUB_STEP_SUMMARY"
+          while read -r img; do
+            echo "- $img" >> "$GITHUB_STEP_SUMMARY"
+          done < reports/chart.txt
+
+      - name: Upload image list
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        if: always()
+        with:
+          name: container-images-${{ matrix.target }}-${{ github.run_attempt }}-${{ github.sha }}-${{ github.run_number }}
+          retention-days: ${{ env.ARTIFACT_RETENTION_DAYS }}
+          path: reports/
+

.github/workflows/publish-catalog.yaml

@@ -17,11 +17,20 @@ concurrency:
 env:
   # renovate: datasource=github-releases depName=kubara-io/kubara
   KUBARA_REF: "v0.13.0"
+  OUTPUT_GENERATED_DIR: ${{ github.workspace }}/output-generated
+  # setup-oras requires version without "v" in "vX.X.X"
+  # renovate: datasource=github-releases depName=oras-project/oras extractVersion=^v(?<version>.*)$
+  ORAS_VERSION: "1.3.1" 
+  REPORT_DIR: ${{ github.workspace }}/reports
+  ARTIFACT_RETENTION_DAYS: "15"
 
 jobs:
   publish:
     name: Publish catalog
     runs-on: ubuntu-latest
+    outputs:
+      catalog: ${{ steps.release.outputs.catalog }}
+      version: ${{ steps.release.outputs.version }}
     steps:
       - name: Checkout catalogs
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -108,3 +117,120 @@ jobs:
           "${RUNNER_TEMP}/kubara" catalog package \
             "oci://ghcr.io/${GITHUB_REPOSITORY_OWNER}/catalogs/"
           "${RUNNER_TEMP}/kubara" catalog push "$CATALOG_REF"
+
+  extract-images:
+    name: Extract container images
+    needs: publish
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Checkout catalogs
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Checkout kubara
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: kubara-io/kubara
+          ref: ${{ env.KUBARA_REF }}
+          path: .ci/kubara
+
+      - name: Install kubara release
+        env:
+          KUBARA_VERSION: ${{ env.KUBARA_REF }}
+        run: |
+          set -euo pipefail
+          version="${KUBARA_VERSION#v}"
+          archive="kubara_${version}_linux_amd64.tar.gz"
+          checksums="kubara_${version}_checksums.txt"
+          base_url="https://github.com/kubara-io/kubara/releases/download/${KUBARA_VERSION}"
+          temp_dir="$(mktemp -d)"
+          trap 'rm -rf "$temp_dir"' EXIT
+          curl -fsSL "$base_url/$archive" -o "$temp_dir/$archive"
+          curl -fsSL "$base_url/$checksums" -o "$temp_dir/$checksums"
+          checksum="$(awk -v file="$archive" '$2 == file {print $1}' "$temp_dir/$checksums")"
+          [[ -n "$checksum" ]]
+          echo "$checksum  $temp_dir/$archive" | sha256sum -c -
+          tar xzf "$temp_dir/$archive" -C "$RUNNER_TEMP" kubara
+          chmod +x "$RUNNER_TEMP/kubara"
+
+      - name: Install oras
+        uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2.0.1
+        with:
+          version: ${{ env.ORAS_VERSION }}
+
+
+      - name: Generate platform
+        uses: ./.github/actions/generate-platform
+        with:
+          kubara: ${{ runner.temp }}/kubara
+          kubara-scripts: ${{ github.workspace }}/.ci/kubara/.scripts
+          work-dir: ${{ env.OUTPUT_GENERATED_DIR }}
+
+      - name: Extract container images
+        working-directory: ${{ env.OUTPUT_GENERATED_DIR }}
+        env:
+          IMAGE_OUTPUT_FILE: ${{ env.REPORT_DIR }}/images.txt
+          HELM_CHART_VERSION_FILE: ${{ env.REPORT_DIR }}/chart.txt
+        run: |
+          mkdir -p "$REPORT_DIR"
+          "${GITHUB_WORKSPACE}/.scripts/image-version.sh"
+
+      - name: Write image summary
+        if: always()
+        run: |
+          [[ -f "$REPORT_DIR/images.txt" ]] || exit 0
+          echo "### Container Images" >> "$GITHUB_STEP_SUMMARY"
+          while read -r img; do
+            echo "- $img" >> "$GITHUB_STEP_SUMMARY"
+          done < "$REPORT_DIR/images.txt"
+          [[ -f "$REPORT_DIR/chart.txt" ]] || exit 0
+          echo "### Helm Chart Image Versions" >> "$GITHUB_STEP_SUMMARY"
+          while read -r img; do
+            echo "- $img" >> "$GITHUB_STEP_SUMMARY"
+          done < "$REPORT_DIR/chart.txt"
+
+      - name: Push image lists alongside catalog
+        env:
+          GHCR_TOKEN: ${{ github.token }}
+          CATALOG: ${{ needs.publish.outputs.catalog }}
+          VERSION: ${{ needs.publish.outputs.version }}
+        run: |
+          set -euo pipefail
+          cd "$REPORT_DIR"
+
+          files=()
+          for report in images chart; do
+            if [[ -f "${report}.txt" ]]; then
+              files+=("${report}.txt:text/plain")
+            fi
+          done
+          if ((${#files[@]} == 0)); then
+            echo "::error::No image reports produced; nothing to push"
+            exit 1
+          fi
+
+          endpoint="ghcr.io/${GITHUB_REPOSITORY_OWNER}/catalogs/${CATALOG}-images:${VERSION},latest"
+
+          printf '%s\n' "$GHCR_TOKEN" |
+            oras login ghcr.io --username "$GITHUB_ACTOR" --password-stdin
+
+          oras push "$endpoint" \
+            --artifact-type application/vnd.kubara.catalog.images.v1+text \
+            "${files[@]}"
+
+          echo "::notice::Attached image list to $endpoint"
+
+
+
+      - name: Upload image list
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        if: always()
+        with:
+          name: container-images-${{ github.ref_name }}-${{ github.run_attempt }}
+          retention-days: ${{ env.ARTIFACT_RETENTION_DAYS }}
+          path: ${{ env.REPORT_DIR }}/