ci: image collection and scanning by davrad · Pull Request #461 · kubara-io/kubara

davrad · 2026-06-29T18:13:38Z

📝 Summary

This PR adds image scanning and Trivy analysis to the CI.
In addition it updates the goreleaser schema to include an image section into the header, such that in each release, all the image versions of the standard kubara catalog are also listed.

🧩 Type of change

⚠️ Is this a breaking change?

Yes, this change breaks existing functionality (explain in summary)

🧪 Testing

CI passed
Manually tested (local/dev cluster)
Unit tested
Not tested (explain why below)

🔗 Related Issues / Tickets

✅ Checklist

Code compiles and passes all tests
Linting and style checks pass
Comments added for complex logic
Documentation updated (if applicable)

📎 Additional Context (optional)

github-advanced-security · 2026-07-01T16:48:05Z

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

davrad · 2026-07-03T07:45:12Z

~~The Pipepiline currently runs into Caching issues.~~

Caching issues were addressed.

Signed-off-by: Jan Larwig <jan@larwig.com>

Matthiator

Really nice addition — rendering every chart and scanning all catalog images is a great step 🙌

I went through it in detail and left inline comments. The main thing before merge is that helm-checks currently goes red (see the config comment), plus a few path/error-handling edge cases in the release job and the extraction script. Nothing here is hard to fix. Happy to help with any of them!

A couple of tiny nits I didn't inline: typo helm template for for '$chart' (double "for"), the comment # pipefail that pipes break reads a bit confusingly, the config comment Enable every catalog service to the image/vuln report… is missing a word, and SCRIPT_DIR looks unused. All optional. 🙂

Matthiator · 2026-07-21T07:25:35Z

 apply_yaml_if_set KUBARA_DNS_NAME            ".clusters[0].terraform.dns.name"

+# Enable every catalog service to the image/vuln report and the release header cover all charts
+yq eval '(.clusters[0].services[] | .status) = "enabled"' -i "$CFG"


I think the intent is to enable everything so all charts get rendered for the scan — makes sense 👍

The catch: this same generated config is also consumed by the existing helm-checks job, which now renders reloader (disabled by default) and fails on its template-library dependency → the whole job goes red (that's the currently failing check).

Could we scope the "enable all" to a separate config used only for the extract/scan step, so helm-checks keeps its current service set? (Alternatively: make reloader renderable, or only enable services that render cleanly.)

Matthiator · 2026-07-21T07:25:36Z

+
+      - name: Extract images and set goreleaser header
+        run: |
+          MANAGED=/tmp/gen/managed-service-catalog/helm \


Small path mismatch here: the generated files live under /tmp/gen, but only MANAGED is overridden — and it points to managed-service-catalog/helm, while generate now produces platform-components/helm. CONFIG_FILE/CONFIGS also stay relative to the repo root, where there's no config.yaml.

As written the script would exit before GoReleaser, so the header wouldn't be filled. Something like:

MANAGED=/tmp/gen/platform-components/helm \ CONFIG_FILE=/tmp/gen/config.yaml \ CONFIGS=/tmp/gen/platform-configs/<cluster>/helm \ "$GITHUB_WORKSPACE"/.scripts/image-version.sh

should fix it. (Not caught by PR CI since release only runs on tag push.)

Matthiator · 2026-07-21T07:25:36Z

+
+
+render_dir="$(mktemp -d)"; trap 'rm -rf "$render_dir"' EXIT
+FAILED=()


Nice that failures get collected in FAILED — but the array is never checked afterwards, so a chart that fails dependency update/template is silently skipped and the job still passes. That means its images quietly disappear from the scan (this is exactly what happens to reloader).

Could we fail (or at least emit a visible ::warning::) when FAILED is non-empty?

Minor: on the helm dependency update line below, dep_out=$(… >/dev/null 2>&1) discards all output, so the later echo "$dep_out" never prints anything.

Matthiator · 2026-07-21T07:25:36Z

+          image-ref: ${{ matrix.image }}
+          version: ${{ env.TRIVY_VERSION }}
+          scanners: vuln
+          severity: HIGH


severity: HIGH only reports HIGH — CRITICAL findings are excluded from the SARIF. Did you mean severity: HIGH,CRITICAL? (Combined with exit-code: '0' the scan is report-only, which is totally fine if that's intended.)

Matthiator · 2026-07-21T07:25:36Z

+
+echo "Done Rendering!"
+
+[[ -n "$IMAGES" ]] || { echo "::warning::No image references found"; exit 0; }


With set -euo pipefail, if grep matches nothing the pipeline exits 1 and the script dies in the IMAGES="$( … )" assignment above — before ever reaching this friendly ::warning::No image references found / exit 0. OUTPUT_FILE then never gets written, and the workflow reads reports/images.txt unconditionally, so the has_images=false branch can't actually be reached.

A || true on the grep (or writing the file first) would restore the intended empty-case handling.

Matthiator · 2026-07-21T07:25:36Z

+
+MANAGED="${MANAGED:-${PWD}/platform-components/helm}"
+CONFIG_FILE="${CONFIG_FILE:-config.yaml}"
+CLUSTER_NAME="$(yq -r '.clusters[0].name' "$CONFIG_FILE")"


Tiny thing: yq reads $CONFIG_FILE here before the [[ -f … ]] / command -v checks below, so a missing file/tool produces a cryptic command-substitution error instead of your nice diagnostic. Moving the checks above this line would surface the friendly message.

Matthiator · 2026-07-21T07:25:36Z

+# metalb, loki and velero need custom configs
+yq eval '.clusters[0].services.metallb.config.publicLoadBalancerIPs = "203.0.113.10"' -i "$CFG"
+yq eval '.clusters[0].services.metallb.config.loadBalancerAddressPool = ["203.0.113.0/24"]' -i "$CFG"
+yq eval '.clusters[0].storage.bucketNames.chunks = "loki"' -i "$CFG"


This writes .clusters[0].storage.bucketNames.chunks, but I couldn't find a matching field in the config schema (the Loki chunks bucket comes from the static platform-components/helm/loki/values.yaml). It may be silently ignored — worth double-checking whether this actually has the intended effect.

Matthiator · 2026-07-21T07:25:36Z

+
+IMAGES="$(
+  cat "$render_dir"/*.yaml |
+    grep -E '^[[:space:]]*image:' |


Quick note on coverage: since extraction is a grep image: over the helm template output, it catches all standard container / init-container / sidecar images (good!), but by design it misses:

runtime-injected images (mutating webhooks, Kyverno, operator-set images via flags),

image refs passed via args/env rather than an image: field,

- image: list-item lines — the regex only matches image: after whitespace, not after - .

Not a blocker, but might be worth a comment noting this is best-effort, so "scan passed" isn't read as "every running image was scanned."

tuunit · 2026-07-22T05:56:48Z

closed in favour of #501

davrad force-pushed the feat/add-image-check branch 2 times, most recently from 23d42ed to cd48076 Compare June 29, 2026 18:52

tuunit changed the title ~~Feat/add image check~~ ci: image collection and scanning Jul 1, 2026

tuunit reviewed Jul 2, 2026

View reviewed changes

Comment thread .scripts/image-version.sh

davrad marked this pull request as ready for review July 3, 2026 07:19

davrad requested a review from a team July 3, 2026 07:19

davrad force-pushed the feat/add-image-check branch from 4ef46cb to 375297f Compare July 3, 2026 07:20

davrad force-pushed the feat/add-image-check branch 3 times, most recently from 576ead3 to 7b31aea Compare July 10, 2026 14:53

tuunit requested changes Jul 14, 2026

View reviewed changes

Comment thread .scripts/kubara-config-update.sh

davrad and others added 10 commits July 14, 2026 09:41

feat: add image-version.sh to ci

c154249

feat: add files for the pipeline

5bfeeca

feat: add trivy scanning to the ci

90abd36

fix: update typos

a30bb79

fix: address sarif upload issues

5ddfa64

fix: address caching issues with trivy

c3c02ff

fix: fix typo

cfe8960

feat: render all images in ci

70fa56f

fix: remove whitespace in velero config

fb67d24

ci: fix dns name handling

279eb27

Signed-off-by: Jan Larwig <jan@larwig.com>

tuunit force-pushed the feat/add-image-check branch from e494143 to 279eb27 Compare July 14, 2026 08:11

Matthiator reviewed Jul 21, 2026

View reviewed changes

tuunit closed this Jul 22, 2026

Navigation Menu

Uh oh!

ci: image collection and scanning - #461

ci: image collection and scanning#461
davrad wants to merge 10 commits into
mainfrom
feat/add-image-check

davrad commented Jun 29, 2026 •

edited

Loading

Uh oh!

github-advanced-security AI commented Jul 1, 2026

Uh oh!

Uh oh!

davrad commented Jul 3, 2026 •

edited

Loading

Uh oh!

Uh oh!

Matthiator left a comment

Uh oh!

Matthiator Jul 21, 2026

Uh oh!

Matthiator Jul 21, 2026

Uh oh!

Matthiator Jul 21, 2026

Uh oh!

Matthiator Jul 21, 2026

Uh oh!

Matthiator Jul 21, 2026

Uh oh!

Matthiator Jul 21, 2026

Uh oh!

Matthiator Jul 21, 2026

Uh oh!

Matthiator Jul 21, 2026

Uh oh!

tuunit commented Jul 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants



		render_dir="$(mktemp -d)"; trap 'rm -rf "$render_dir"' EXIT
		FAILED=()


		echo "Done Rendering!"

		[[ -n "$IMAGES" ]] \|\| { echo "::warning::No image references found"; exit 0; }

Uh oh!

Conversation

davrad commented Jun 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📝 Summary

🧩 Type of change

⚠️ Is this a breaking change?

🧪 Testing

🔗 Related Issues / Tickets

✅ Checklist

📎 Additional Context (optional)

Uh oh!

github-advanced-security AI commented Jul 1, 2026

What Enabling Code Scanning Means:

Uh oh!

Uh oh!

davrad commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Matthiator left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tuunit commented Jul 22, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

davrad commented Jun 29, 2026 •

edited

Loading

davrad commented Jul 3, 2026 •

edited

Loading