From 607772283dd101b8217fb451b8a5d166147081ff Mon Sep 17 00:00:00 2001 From: ychangkim Date: Mon, 20 Jul 2026 18:08:06 +0900 Subject: [PATCH] refactor: scan images directly with trivy, output per-image CVE JSON MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Skip SBOM generation entirely since cve-edge-post.yml only needs vulnerability counts, not CycloneDX artifacts — scan each image with `trivy image` directly and aggregate with python3 (drop jq dependency). Output is now a JSON array with one entry per image instead of a single merged summary. --- .github/workflows/cve-edge-post.yml | 110 +++++++++++++++++----------- doc/scripts/Dockerfile | 4 +- 2 files changed, 70 insertions(+), 44 deletions(-) diff --git a/.github/workflows/cve-edge-post.yml b/.github/workflows/cve-edge-post.yml index 56e41d8..8678b34 100644 --- a/.github/workflows/cve-edge-post.yml +++ b/.github/workflows/cve-edge-post.yml @@ -1,13 +1,14 @@ name: helm-catalog-cve-edge-post # manifests/helm 카탈로그의 컨테이너 이미지 취약점을 스캔해 단일 JSON 요약으로 출력한다. -# sbom.yml 과 동일한 SBOM+trivy 파이프라인(doc/scripts/*.sh)을 재사용하고, -# trivy-reports/*.json(이미지별 원본 스캔 결과)을 jq 로 집계해 다음 포맷을 만든다. +# SBOM 산출물 자체는 필요 없으므로(sbom.yml 과 달리), extract-helm-images.sh 로 이미지 +# 목록만 뽑은 뒤 각 이미지를 `trivy image` 로 직접 스캔한다(SBOM 생성 단계 생략). # -# {"low": 0, "high": 0, "medium": 0, "critical": 0, -# "scanned_at": "2026-07-13T06:19:44Z", "summary": "CVE-xxxx-xxxxx, ..."} +# [{"image": "...", "low": 0, "high": 0, "medium": 0, "critical": 0, +# "scanned_at": "2026-07-13T06:19:44Z", "summary": "CVE-xxxx-xxxxx, ..."}, ...] # -# summary 는 발견된 CRITICAL CVE ID 전체를 콤마로 나열한다(중복 제거). +# 이미지별로 배열 원소 하나. summary 는 해당 이미지에서 발견된 CRITICAL CVE ID 전체를 +# 콤마로 나열한다(중복 제거). # 생성된 JSON 은 POST https://edge.gke.paasup.io/api/v1/cve-scans 로 전송한다. # (X-CVE-API-Key 헤더 필요 — Repo Secret CVE_API_KEY, SSL 검증은 --insecure 로 스킵) # @@ -29,7 +30,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 120 container: - image: docker.io/paasup/sbom-pipeline + image: ${{ vars.SBOM_PIPELINE_IMAGE }} env: OUT_DIR: ${{ github.workspace }}/sbom-out TRIVY_CACHE_DIR: ${{ github.workspace }}/sbom-out/cache @@ -38,7 +39,7 @@ jobs: - name: Preflight — 도구 확인 run: | set -e - for t in helm trivy python3 bash git jq; do + for t in helm trivy python3 bash git; do command -v "$t" >/dev/null || { echo "::error::컨테이너에 $t 없음 (vars.SBOM_PIPELINE_IMAGE 확인)"; exit 1; } done helm version --short; trivy --version | head -1 @@ -51,8 +52,8 @@ jobs: # 사설 레지스트리 인증: 시크릿으로 docker config.json 을 만들어 trivy 가 읽게 한다. - name: 레지스트리 인증 구성 env: - DOCKERHUB_USER: ${{ secrets.DOCKERHUB_PAASUP_USER }} - DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_PAASUP_TOKEN }} + DOCKERHUB_USER: ${{ secrets.DOCKERHUB_USER }} + DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }} NGC_API_KEY: ${{ secrets.NGC_API_KEY }} run: | mkdir -p "$OUT_DIR/.docker" @@ -74,51 +75,76 @@ jobs: run: bash doc/scripts/extract-helm-images.sh "$GITHUB_WORKSPACE/manifests/helm" "$OUT_DIR" - name: 스캔 대상 결정 (전체) - run: cp "$OUT_DIR/images_final.tsv" "$OUT_DIR/images_scan.tsv" - - - name: SBOM 생성 (CycloneDX) env: LIMIT: ${{ github.event.inputs.limit || '0' }} run: | - if [ -s "$OUT_DIR/images_scan.tsv" ]; then - bash doc/scripts/generate-sbom.sh "$OUT_DIR/images_scan.tsv" "$OUT_DIR" + if [ "$LIMIT" -gt 0 ] 2>/dev/null; then + cut -f3 "$OUT_DIR/images_final.tsv" | sort -u | head -n "$LIMIT" > "$OUT_DIR/images_scan.txt" else - echo "대상 이미지 없음 — SBOM 생성 생략"; mkdir -p "$OUT_DIR/sbom" + cut -f3 "$OUT_DIR/images_final.tsv" | sort -u > "$OUT_DIR/images_scan.txt" fi + wc -l "$OUT_DIR/images_scan.txt" - - name: 취약점 스캔 (SBOM 입력, 오프라인) + # SBOM 산출물은 필요 없으므로 trivy image 로 이미지를 직접 스캔한다(SBOM 생성 단계 생략). + - name: 취약점 스캔 (trivy image 직접 실행) run: | - if ls "$OUT_DIR/sbom/"*.cdx.json >/dev/null 2>&1; then - bash doc/scripts/scan-sbom.sh "$OUT_DIR" - else - echo "SBOM 없음 — 스캔 생략"; mkdir -p "$OUT_DIR/trivy-reports" - fi + set -uo pipefail + REPORTS_DIR="$OUT_DIR/trivy-reports" + mkdir -p "$REPORTS_DIR" + [ -s "$OUT_DIR/images_scan.txt" ] || { echo "대상 이미지 없음 — 스캔 생략"; exit 0; } - # trivy-reports/*.json (이미지별 원본 Trivy 결과)을 jq 로 병합 집계. + echo ">> trivy DB 워밍 중..." + trivy image --download-db-only + + xargs -P "${PARALLEL:-3}" -I{} bash -c ' + img="$1"; reports="$2" + safe=$(printf "%s" "$img" | tr "/:@" "___") + echo ">> 스캔: $img" + trivy image --quiet --skip-db-update \ + --format json --timeout 15m --output "$reports/$safe.json" "$img" \ + || echo "::warning::스캔 실패: $img" + ' _ {} "$REPORTS_DIR" < "$OUT_DIR/images_scan.txt" + + # trivy-reports/*.json (이미지별 원본 Trivy 결과)을 python3 로 이미지별 집계. - name: CVE JSON 생성 run: | - SCANNED_AT="$(date -u +%Y-%m-%dT%H:%M:%SZ)" - REPORTS_DIR="$OUT_DIR/trivy-reports" + python3 - "$OUT_DIR/trivy-reports" "$OUT_DIR/cve-summary.json" <<'PY' + import sys, os, json, glob + from datetime import datetime, timezone - if ls "$REPORTS_DIR"/*.json >/dev/null 2>&1; then - RESULT="$(jq -s --arg scanned_at "$SCANNED_AT" ' - [.[] | .Results[]? | .Vulnerabilities[]? ] as $vulns - | { - low: ([$vulns[] | select(.Severity=="LOW")] | length), - high: ([$vulns[] | select(.Severity=="HIGH")] | length), - medium: ([$vulns[] | select(.Severity=="MEDIUM")] | length), - critical: ([$vulns[] | select(.Severity=="CRITICAL")] | length), - scanned_at: $scanned_at, - summary: ([$vulns[] | select(.Severity=="CRITICAL") | .VulnerabilityID] | unique | join(", ")) - } - ' "$REPORTS_DIR"/*.json)" - else - RESULT="$(jq -n --arg scanned_at "$SCANNED_AT" \ - '{low:0, high:0, medium:0, critical:0, scanned_at: $scanned_at, summary: ""}')" - fi + reports_dir, out_path = sys.argv[1], sys.argv[2] + scanned_at = datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ") + results = [] - echo "$RESULT" | tee "$OUT_DIR/cve-summary.json" - echo "$RESULT" >> "$GITHUB_STEP_SUMMARY" + for path in sorted(glob.glob(os.path.join(reports_dir, "*.json"))): + with open(path) as f: + data = json.load(f) + image = data.get("ArtifactName", os.path.basename(path)) + counts = {"LOW": 0, "HIGH": 0, "MEDIUM": 0, "CRITICAL": 0} + critical_ids = set() + for result in data.get("Results") or []: + for vuln in result.get("Vulnerabilities") or []: + sev = vuln.get("Severity") + if sev in counts: + counts[sev] += 1 + if sev == "CRITICAL": + critical_ids.add(vuln["VulnerabilityID"]) + results.append({ + "image": image, + "low": counts["LOW"], + "high": counts["HIGH"], + "medium": counts["MEDIUM"], + "critical": counts["CRITICAL"], + "scanned_at": scanned_at, + "summary": ", ".join(sorted(critical_ids)), + }) + + with open(out_path, "w") as f: + json.dump(results, f) + print(json.dumps(results, indent=2)) + PY + + cat "$OUT_DIR/cve-summary.json" >> "$GITHUB_STEP_SUMMARY" - name: CVE 스캔 결과 전송 if: always() diff --git a/doc/scripts/Dockerfile b/doc/scripts/Dockerfile index bef8f60..248671a 100644 --- a/doc/scripts/Dockerfile +++ b/doc/scripts/Dockerfile @@ -5,7 +5,7 @@ # 로 사용되는 이미지. doc/scripts/*.sh 를 컨테이너 내부에서 직접 실행한다. # 상세: doc/sbom-pipeline.md # -# 도구: helm(v3) + trivy + python3 + bash + git + jq +# 도구: helm(v3) + trivy + python3 + bash + git # 베이스: debian(glibc) — GitHub Actions container 안에서 node 기반 액션 # (actions/checkout, upload-artifact)이 동작하려면 glibc 필요. # (alpine/musl 은 node 실행 실패 가능 → debian 사용) @@ -18,7 +18,7 @@ FROM debian:stable-slim RUN apt-get update && apt-get install -y --no-install-recommends \ - curl ca-certificates git python3 bash jq \ + curl ca-certificates git python3 bash \ && rm -rf /var/lib/apt/lists/* # helm v3