New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

refactor(ci): update go and add cve check #375

Merged

universal-itengineer merged 57 commits into main from refactor/ci/update-go-add-trivy

Sep 18, 2024

Member

universal-itengineer commented Sep 17, 2024 •

edited

Loading

Description

Added CI weekly CVE check via trivy
Updated go version to 1.22.7 to prevent recent CVEs.
Remove unnecessary base go images
Updated base image alpine image to 3.17.10
Updated base image debian:bookworm-slim

Why do we need it, and what problem does it solve?

Improved protection of images against various vulnerabilities
Improved ci

What is the expected result?

All pods will be restarted.
VMs will be migrated, if workload settings set to livemigration in other case you should manually restart them.

Checklist

The code is covered by unit tests.
e2e tests passed.
Documentation updated according to the changes.
Changes were tested in the Kubernetes cluster manually.

github-actions bot assigned universal-itengineer

universal-itengineer changed the title ~~refactor(ci): update go and add trivy check~~ refactor(ci): update go and add cve check

universal-itengineer force-pushed the refactor/ci/update-go-add-trivy branch 4 times, most recently from 9faafb2 to 907e4b2 Compare

September 17, 2024 07:14

universal-itengineer requested review from diafour and hardcoretime

September 17, 2024 07:48

universal-itengineer force-pushed the refactor/ci/update-go-add-trivy branch 2 times, most recently from c343e41 to 2f3a860 Compare

September 17, 2024 09:55

diafour reviewed

View reviewed changes

.github/workflows/cve-weekly.yaml Outdated Show resolved Hide resolved

diafour reviewed

View reviewed changes

.github/workflows/cve-weekly.yaml Outdated Show resolved Hide resolved

diafour reviewed

View reviewed changes

Taskfile.yaml Outdated Show resolved Hide resolved

diafour reviewed

View reviewed changes

api/client/examples/list-resources/go.mod Outdated Show resolved Hide resolved

diafour reviewed

View reviewed changes

images/libguestfs/werf.inc.yaml Show resolved Hide resolved

universal-itengineer requested a review from diafour

September 17, 2024 13:29

diafour reviewed

View reviewed changes

Taskfile.yaml Outdated Show resolved Hide resolved

universal-itengineer force-pushed the refactor/ci/update-go-add-trivy branch from 267ca4b to c273c15 Compare

September 17, 2024 14:05

universal-itengineer requested a review from diafour

September 17, 2024 14:06

diafour reviewed

View reviewed changes

tools/cve/scan-main.sh Outdated Show resolved Hide resolved

universal-itengineer requested a review from diafour

September 17, 2024 18:04

universal-itengineer added 9 commits

September 18, 2024 10:00


          chore(module):virtualization api go 1.22.6

11f5cb9

Signed-off-by: Nikita korolev <nikita.korolev@flant.com>


          chore(module): api/list-resources go 1.22.6

6e0dd40

Signed-off-by: Nikita korolev <nikita.korolev@flant.com>


          chore(module): base image BASE_GOLANG_22_BOOKWORM to 1.22.6

ade8140

Signed-off-by: Nikita korolev <nikita.korolev@flant.com>


          chore(module): dvcr-artifact image to BASE_GOLANG_22_BOOKWORM

4ac7c2f

Signed-off-by: Nikita korolev <nikita.korolev@flant.com>


          chore(module): kube-api-proxy update image go to BASE_GOLANG_22_BOOKWORM

4441ff5

Signed-off-by: Nikita korolev <nikita.korolev@flant.com>


          resolve conflict

ba286dc

Signed-off-by: Nikita korolev <nikita.korolev@flant.com>


          chore(module): vm-route-forge, update image to BASE_GOLANG_22_BOOKWORM

17f3f60

Signed-off-by: Nikita korolev <nikita.korolev@flant.com>


          chore(module): update go version in workflows

565c282

Signed-off-by: Nikita korolev <nikita.korolev@flant.com>


          chore(ci): temporary add curent branch to ci

027fa6c

Signed-off-by: Nikita korolev <nikita.korolev@flant.com>

universal-itengineer and others added 20 commits

September 18, 2024 10:02


          chore: update qemu to 8.2.6-alt0.p10.1:p10+353259.100.4.1

516c5bf

Signed-off-by: Nikita korolev <nikita.korolev@flant.com>


          chore: kube-api-proxy golang.org/x/net,sys,term to 0.23.0

83bdc2e

Signed-off-by: Nikita korolev <nikita.korolev@flant.com>


          chore update github.com/docker/docker to v25.0.6+incompatible

9d18d31

Signed-off-by: Nikita korolev <nikita.korolev@flant.com>


          chore: exclude dvcr-art from final images

f38f940

Signed-off-by: Nikita korolev <nikita.korolev@flant.com>


          chore: virt-launcher add python3 setuptools==1:69.5.1-alt1

ce07676

Signed-off-by: Nikita korolev <nikita.korolev@flant.com>


          chore: change qemu-img version

3ff98d9

Signed-off-by: Nikita korolev <nikita.korolev@flant.com>


          chore: setuptools to 70.3.0

Signed-off-by: Nikita korolev <nikita.korolev@flant.com>


          chore: update setuptools in libguestfs,virt-handler

53758bb

Signed-off-by: Nikita korolev <nikita.korolev@flant.com>


          chore: refactor cve task and ci

209ea9c

Signed-off-by: Nikita korolev <nikita.korolev@flant.com>


          chore: delete temp cve-check taskfile

eca7e0a

Signed-off-by: Nikita korolev <nikita.korolev@flant.com>


          chore: cleanup ci

8dd538c

Signed-off-by: Nikita korolev <nikita.korolev@flant.com>


          chore: update go for shatal

6b33e56

Signed-off-by: Nikita korolev <nikita.korolev@flant.com>


          chore: temporary add dev branch

f1f1383

Signed-off-by: Nikita korolev <nikita.korolev@flant.com>


          chore: resolve comments

2a318fb

Signed-off-by: Nikita korolev <nikita.korolev@flant.com>


          Update tools/cve/scan-main.sh

edd55a4

Co-authored-by: Ivan Mikheykin <ivan.mikheykin@flant.com>
Signed-off-by: Nikita Korolev <141920865+universal-itengineer@users.noreply.github.com>


          chore: update scan script

024423c

Signed-off-by: Nikita korolev <nikita.korolev@flant.com>


          resolve conflict final

26adb57

Signed-off-by: Nikita korolev <nikita.korolev@flant.com>


          resolve conflict final

0cec76a

Signed-off-by: Nikita korolev <nikita.korolev@flant.com>


          chore: remove exclude builder and artifact from script

8cee6e3

Signed-off-by: Nikita korolev <nikita.korolev@flant.com>


          chore: remove unnecessary images from base images

7cd22f1

Signed-off-by: Nikita korolev <nikita.korolev@flant.com>

universal-itengineer force-pushed the refactor/ci/update-go-add-trivy branch from 5f80b73 to 4d881f4 Compare

September 18, 2024 07:08


          chore: update alpine image

c2dcc05

Signed-off-by: Nikita korolev <nikita.korolev@flant.com>

universal-itengineer force-pushed the refactor/ci/update-go-add-trivy branch from 4d881f4 to c2dcc05 Compare

September 18, 2024 07:19

universal-itengineer added 2 commits

September 18, 2024 10:51


          chore: rm pkg versions from edk2-builder

Signed-off-by: Nikita korolev <nikita.korolev@flant.com>


          chore: pkg versions back for img edk2-builder

2c83f4a

Signed-off-by: Nikita korolev <nikita.korolev@flant.com>

diafour reviewed

View reviewed changes

images/virt-launcher/werf.inc.yaml Outdated Show resolved Hide resolved


          ++ revert changes in edk2 builder

a7a41df

Signed-off-by: Ivan Mikheykin <ivan.mikheykin@flant.com>

diafour approved these changes

View reviewed changes

universal-itengineer merged commit a435890 into main

10 checks passed

universal-itengineer deleted the refactor/ci/update-go-add-trivy branch

September 18, 2024 12:30

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet