diff --git a/.github/workflows/cve-notifier.yml b/.github/workflows/cve-notifier.yml new file mode 100644 index 0000000..070d3cd --- /dev/null +++ b/.github/workflows/cve-notifier.yml @@ -0,0 +1,60 @@ +name: CVE Notifier + +on: + schedule: + # Every Monday at 08:00 UTC + - cron: "0 8 * * 1" + # Allow manual trigger for on-demand triggers or debug + workflow_dispatch: {} + +permissions: + contents: read + +jobs: + cve-notifier: + name: Run CVE Notifier + runs-on: ubuntu-latest + timeout-minutes: 30 + steps: + - name: Checkout github-actions + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + + # Checkout CVE notifier tool + # It is expected to checkout it from frawless user + - name: Checkout frawless/cve-notifier + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + repository: frawless/cve-notifier + ref: 39bd3f7b0339578fb83b9e6d7029fd8e6b361a43 + path: cve-notifier + + - name: Copy projects.yaml config + run: cp configs/cve-notifier-projects.yaml cve-notifier/config/projects.yaml + + - name: Set up Python + uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 + with: + python-version: "3.11" + + - name: Install Poetry + run: pip install poetry + + - name: Install dependencies + working-directory: cve-notifier + run: poetry install --only main + + - name: Run CVE Notifier + working-directory: cve-notifier + run: | + poetry run security-report run \ + --config config/projects.yaml \ + --output-dir ./output \ + --refresh \ + --snyk \ + --fossa \ + --send-slack \ + --slack-channel "${{ secrets.SLACK_WEBHOOK_URL }}" + env: + SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} + FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }} + SNYK_ORG_ID: ${{ secrets.SNYK_ORG_ID }} diff --git a/configs/cve-notifier-projects.yaml b/configs/cve-notifier-projects.yaml new file mode 100644 index 0000000..0f447c5 --- /dev/null +++ b/configs/cve-notifier-projects.yaml @@ -0,0 +1,114 @@ +schemaVersion: 2 + +report: + windowDays: 7 + containerArchitecture: amd64 + +providers: + fossa: + # Strimzi team id + team: "46084" + +repositories: + + strimzi-kafka-operator: + github: strimzi/strimzi-kafka-operator + projectName: strimzi-kafka-operator + containers: + images: + - name: strimzi/operator + component: cluster-operator + fossaProject: operator + - name: strimzi/kafka + component: kafka + fossaProject: kafka + - name: strimzi/maven-builder + component: maven-builder + fossaProject: maven-builder + - name: strimzi/buildah + component: buildah + fossaProject: buildah + + snyk: + mavenGroupIds: + - io.strimzi + targetGroups: + - id: main + displayName: "main / latest" + mavenRef: main + containerRef: latest + - id: release-1.3 + displayName: "1.3.x / 1.3.0" + mavenRef: release-1.3.x + containerRef: 1.3.0 + + fossa: + mavenProject: custom+162/operators + targetGroups: + - id: main + displayName: "main / latest" + mavenRef: main + containerRef: latest + - id: release-1.3 + displayName: "1.3.x / 1.3.0" + mavenRef: release-1.3.x + containerRef: 1.3.0 + + strimzi-kafka-bridge: + github: strimzi/strimzi-kafka-bridge + projectName: strimzi-kafka-bridge + containers: + images: + - name: strimzi/kafka-bridge + component: kafka-bridge + fossaProject: kafka-bridge-container + snyk: + mavenProjects: + - io.strimzi:kafka-bridge + targetGroups: + - id: main + displayName: "main / latest" + mavenRef: main + containerRef: latest + - id: release-1.2 + displayName: "1.2.x / 1.2.0" + mavenRef: release-1.2.x + containerRef: 1.2.0 + + fossa: + mavenProject: custom+162/kafka-bridge + targetGroups: + - id: main + displayName: "main / latest" + mavenRef: main + containerRef: latest + - id: release-1.2 + displayName: "1.2.x / 1.2.0" + mavenRef: release-1.2.x + containerRef: 1.2.0 + fossaBranch: 1.2.0 + + drain-cleaner: + github: strimzi/drain-cleaner + projectName: drain-cleaner + containers: + images: + - name: strimzi/drain-cleaner + component: drain-cleaner + fossaProject: drain-cleaner-container + snyk: + mavenProjects: + - io.strimzi:strimzi-drain-cleaner + targetGroups: + - id: main + displayName: "main / latest" + mavenRef: main + containerRef: latest + + fossa: + mavenProject: custom+162/drain-cleaner + targetGroups: + - id: main + displayName: "main / latest" + mavenRef: main + containerRef: latest