diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 790bd257..da786855 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -20,13 +20,13 @@ jobs: tags: [ "spryker/php:8.1", "spryker/php:8.1-alpine3.20" ] platforms: [ "linux/amd64", "linux/arm64" ] - image: "alpine/3.20/8.2/Dockerfile" - tags: [ "spryker/php:8.2-alpine3.20" ] + tags: [ "spryker/php:latest", "spryker/php:8.2", "spryker/php:8.2-alpine3.20" ] platforms: [ "linux/amd64", "linux/arm64" ] - image: "alpine/3.20/8.3/Dockerfile" - tags: [ "spryker/php:8.3-alpine3.20" ] + tags: [ "spryker/php:8.3", "spryker/php:8.3-alpine3.20" ] platforms: [ "linux/amd64", "linux/arm64" ] - image: "alpine/3.20/8.4/Dockerfile" - tags: [ "spryker/php:8.4-alpine3.20" ] + tags: ["spryker/php:8.4-alpine3.20" ] platforms: [ "linux/amd64", "linux/arm64" ] ### Alpine 3.21 @@ -37,18 +37,18 @@ jobs: tags: [ "spryker/php:8.3-alpine3.21" ] platforms: [ "linux/amd64", "linux/arm64" ] - image: "alpine/3.21/8.4/Dockerfile" - tags: [ "spryker/php:8.4-alpine3.21" ] + tags: [ "spryker/php:8.4", "spryker/php:8.4-alpine3.21" ] platforms: [ "linux/amd64", "linux/arm64" ] ### Alpine 3.22 - image: "alpine/3.22/8.2/Dockerfile" - tags: [ "spryker/php:latest", "spryker/php:8.2", "spryker/php:8.2-alpine3.22" ] + tags: [ "spryker/php:8.2-alpine3.22" ] platforms: [ "linux/amd64", "linux/arm64" ] - image: "alpine/3.22/8.3/Dockerfile" - tags: [ "spryker/php:8.3", "spryker/php:8.3-alpine3.22" ] + tags: [ "spryker/php:8.3-alpine3.22" ] platforms: [ "linux/amd64", "linux/arm64" ] - image: "alpine/3.22/8.4/Dockerfile" - tags: ["spryker/php:8.4", "spryker/php:8.4-alpine3.22" ] + tags: ["spryker/php:8.4-alpine3.22" ] platforms: [ "linux/amd64", "linux/arm64" ] ### Alpine 3.23 diff --git a/.github/workflows/ecr-scheduled-security-scan.yml b/.github/workflows/ecr-scheduled-security-scan.yml index c317593d..f43a3671 100644 --- a/.github/workflows/ecr-scheduled-security-scan.yml +++ b/.github/workflows/ecr-scheduled-security-scan.yml @@ -111,14 +111,27 @@ jobs: - name: Fix vulnerability counts id: fixed-counts run: | + CRITICAL=${{ steps.docker-scan.outputs.critical }} + HIGH=${{ steps.docker-scan.outputs.high }} + MEDIUM=${{ steps.docker-scan.outputs.medium }} + LOW=${{ steps.docker-scan.outputs.low }} + INFO=${{ steps.docker-scan.outputs.informational }} + FINDINGS=$(aws ecr describe-image-scan-findings \ --repository-name "${{ secrets.AWS_ECR_REPO }}" \ --image-id imageTag="${{ matrix.image_tag }}" \ --query 'imageScanFindings.findings' \ - --output json) - - echo "total=$(echo "$FINDINGS" | jq 'length')" >> $GITHUB_OUTPUT - echo "undefined=$(echo "$FINDINGS" | jq '[.[] | select(.severity == "UNDEFINED" or .severity == null or .severity == "")] | length')" >> $GITHUB_OUTPUT + --output json 2>/dev/null) || FINDINGS="[]" + + if ! echo "$FINDINGS" | jq empty 2>/dev/null; then + FINDINGS="[]" + fi + + UNDEFINED=$(echo "$FINDINGS" | jq '[.[] | select(.severity == "UNDEFINED" or .severity == null or .severity == "")] | length') + TOTAL=$(( ${CRITICAL:-0} + ${HIGH:-0} + ${MEDIUM:-0} + ${LOW:-0} + ${INFO:-0} + ${UNDEFINED:-0} )) + + echo "total=$TOTAL" >> $GITHUB_OUTPUT + echo "undefined=$UNDEFINED" >> $GITHUB_OUTPUT - name: Report if: always()