mirror of
https://github.com/aquasecurity/kube-bench.git
synced 2025-02-26 06:22:00 +00:00
c9985a6e9b
This is the scan result of Trivy. usr/local/bin/kube-bench (gobinary) Total: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 2, HIGH: 0, CRITICAL: 0) ┌─────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────────────┬──────────────────────────────────────────────────────────────┐ │ Library │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │ Title │ ├─────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────────────┼──────────────────────────────────────────────────────────────┤ │ stdlib │ CVE-2024-45336 │ MEDIUM │ fixed │ v1.23.4 │ 1.22.11, 1.23.5, 1.24.0-rc2 │ golang: net/http: net/http: sensitive headers incorrectly │ │ │ │ │ │ │ │ sent after cross-domain redirect │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2024-45336 │ │ ├────────────────┤ │ │ │ ├──────────────────────────────────────────────────────────────┤ │ │ CVE-2024-45341 │ │ │ │ │ golang: crypto/x509: crypto/x509: usage of IPv6 zone IDs can │ │ │ │ │ │ │ │ bypass URI name... │ │ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2024-45341 │ └─────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────────────┴──────────────────────────────────────────────────────────────┘ Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
103 lines
2.6 KiB
YAML
103 lines
2.6 KiB
YAML
---
|
|
name: Build
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
paths-ignore:
|
|
- "*.md"
|
|
- "LICENSE"
|
|
- "NOTICE"
|
|
pull_request:
|
|
paths-ignore:
|
|
- "*.md"
|
|
- "LICENSE"
|
|
- "NOTICE"
|
|
env:
|
|
GO_VERSION: "1.23.5"
|
|
KIND_VERSION: "v0.11.1"
|
|
KIND_IMAGE: "kindest/node:v1.21.1@sha256:69860bda5563ac81e3c0057d654b5253219618a22ec3a346306239bba8cfa1a6"
|
|
|
|
jobs:
|
|
lint:
|
|
name: Lint
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Setup Go
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version: ${{ env.GO_VERSION }}
|
|
- name: Checkout code
|
|
uses: actions/checkout@v4
|
|
- name: yaml-lint
|
|
uses: ibiqlik/action-yamllint@v3
|
|
- name: Setup golangci-lint
|
|
uses: golangci/golangci-lint-action@v6
|
|
with:
|
|
version: v1.61
|
|
args: --verbose --timeout 2m
|
|
unit:
|
|
name: Unit tests
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Setup Go
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version: ${{ env.GO_VERSION }}
|
|
- name: Checkout code
|
|
uses: actions/checkout@v4
|
|
- name: Run unit tests
|
|
run: make tests
|
|
- name: Upload code coverage
|
|
uses: codecov/codecov-action@v5
|
|
with:
|
|
file: ./coverage.txt
|
|
e2e:
|
|
name: E2e tests
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Setup Go
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version: ${{ env.GO_VERSION }}
|
|
- name: Checkout code
|
|
uses: actions/checkout@v4
|
|
- name: Setup Kubernetes cluster (KIND)
|
|
uses: engineerd/setup-kind@v0.6.2
|
|
with:
|
|
version: ${{ env.KIND_VERSION }}
|
|
image: ${{ env.KIND_IMAGE }}
|
|
name: kube-bench
|
|
- name: Test connection to Kubernetes cluster
|
|
run: |
|
|
kubectl cluster-info
|
|
kubectl describe node
|
|
- name: Run integration tests
|
|
run: |
|
|
make integration-test
|
|
- name: Compare output with expected output
|
|
uses: GuillaumeFalourd/diff-action@v1
|
|
with:
|
|
first_file_path: ./test.data
|
|
second_file_path: integration/testdata/Expected_output.data
|
|
expected_result: PASSED
|
|
release:
|
|
name: Release snapshot
|
|
runs-on: ubuntu-latest
|
|
needs: [e2e, unit]
|
|
steps:
|
|
- name: Setup Go
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version: ${{ env.GO_VERSION }}
|
|
- name: Checkout code
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
- name: Dry-run release snapshot
|
|
uses: goreleaser/goreleaser-action@v6
|
|
with:
|
|
distribution: goreleaser
|
|
version: v1.7.0
|
|
args: release --snapshot --skip-publish --rm-dist
|