ROX-30730: add scan-image-vulnerabilities action #72

tommartensen · 2025-12-08T15:29:11Z

Description

Workflow now scans Konflux and GHA-built images.
Workflow now triggered by new tags automatically (can be manually dispatched for other tags or as required).
Workflow uses composite action to stay DRY.

This PR mostly extracts the existing image scan logic into a composable action.

Validation

https://github.com/stackrox/stackrox/actions/runs/20063752468

Why did I not test with `test-gh-actions`?

The workflow there still uses quay.io ratings: https://github.com/stackrox/test-gh-actions/blob/main/.github/workflows/scripts/check-image-vulnerabilities.py and wasn't updated after stackrox/stackrox#10836.

msugakov

Skipped readme and some smaller details in the action.

release/check-image-vulnerabilities/action.yml

tommartensen · 2025-12-09T12:52:20Z

@msugakov
I have refactored the action into a bash script, that made it easier for me to address your concerns.

The action now:

allows for repository to be specified, ie allows rhacs-eng/... and stackrox-io/...
doesn't have superfluous outputs, but still uploads the artifact to the workflow run. I am including this for a future workflow that: downloads all scan results -> collects vulnerable images -> suggests fixes)

The script has the following improvements:

Consider moderate, important, critical CVEs
Always displays a status (❌ or ✅ ) with description and a table with total and fixable vulnerability count per category. One of the problems I had with the previous version of the workflow was that this information needed to be parsed by human manually.
Fail the action if there are fixable important or critical CVEs
Print a collapsed vulnerability table in Markdown with full details.
- GH automatically links CVEs to GHSA where available.

You can check how this looks in the summary for https://github.com/stackrox/stackrox/actions/runs/20063752468

msugakov

Made a pass. I'll likely find something else in subsequent iterations.

release/check-image-vulnerabilities/check-image-vulnerabilities.sh

release/check-image-vulnerabilities/action.yml

release/scan-image-vulnerabilities/action.yml

release/check-image-vulnerabilities/action.yml

This reverts commit 14030cb.

msugakov

Sorry, could cover only a small part today. Please expect follow-ups.

release/scan-image-vulnerabilities/scan-image-vulnerabilities.sh

msugakov · 2025-12-15T12:13:42Z

release/scan-image-vulnerabilities/scan-image-vulnerabilities.sh

+  IMAGE="${1:-}"
+  SUMMARY_PREFIX="${2:-}"
+  local result_path="scan-result.json"
+
+  check_not_empty \
+      IMAGE \
+      SUMMARY_PREFIX


I don't know bash pass-by-name semantics and so the question: would check_not_empty still work if IMAGE and SUMMARY_PREFIX are both declared local?

In my tiny test, it seems to work:

$ cat a.sh #!/usr/bin/env bash set -euo pipefail function main() { local image="blah" check image } function check() { typeset -n VAR="$1" echo "it is: $VAR" } main $ ./a.sh it is: blah

Yes it works - what is your suggestion or concern here?

IMAGE="${1:-}" SUMMARY_PREFIX="${2:-}"

aren't declared as local. Please declare them as local.

release/scan-image-vulnerabilities/scan-image-vulnerabilities.sh

msugakov

Finished the full pass.

release/scan-image-vulnerabilities/scan-image-vulnerabilities.sh

release/scan-image-vulnerabilities/README.md

release/scan-image-vulnerabilities/action.yml

release/scan-image-vulnerabilities/README.md

…total findings by not relying on roxctl summary

msugakov · 2025-12-19T12:22:25Z

release/scan-image-vulnerabilities/README.md

-
-Required: Yes
+Prefix for the vulnerability report in the GitHub step summary. Use this to help users of the action classify images into groups when multiple matrix scans are performed in a workflow.
+	


Suggested change

(keeping a newline but deleting a blank tab)

Done in 303fbdb, there was one more whitespace to fix.

msugakov · 2025-12-19T12:23:41Z

release/scan-image-vulnerabilities/README.md

+The action integrates with the [stackrox/central-login](https://github.com/stackrox/central-login) action, which uses OIDC login for authentication of the `roxctl` CLI.
+The ACS Central needs to be configured to allow exchanging tokens from GitHub Actions workflow runs. 
+
+Additionally, an image integration for Quay.io needs to be configured in the ACS Central.


Suggestion:

Suggested change

Additionally, an image integration for Quay.io needs to be configured in the ACS Central.

Additionally, an image integration for Quay.io must be configured in the ACS Central so that it can pull images requested for scanning.

Done in 303fbdb

release/scan-image-vulnerabilities/action.yml

msugakov · 2025-12-19T12:50:30Z

release/scan-image-vulnerabilities/scan-image-vulnerabilities.sh

-function print_vulnerability_status() {
-  local -n vuln_counts_ref=$1
+# Prints the vulnerability status and an overview table of the findings counts.
+function print_findings_status() {


How about?

Suggested change

function print_findings_status() {

function print_summary() {

Done in 303fbdb

msugakov · 2025-12-19T12:51:34Z

release/scan-image-vulnerabilities/scan-image-vulnerabilities.sh

  local -n fixable_counts_ref=$2

-  if (( fixable_counts_ref[CRITICAL] > 0 || fixable_counts_ref[IMPORTANT] > 0 )); then
+  if [ "$(assert_fixable_findings_present fixable_counts_ref)" = "true" ]; then


Please use [[ instead of [ in bash. There's a couple places to fix.

Done in 303fbdb

msugakov · 2025-12-19T12:52:28Z

release/scan-image-vulnerabilities/scan-image-vulnerabilities.sh

+# Prints a markdown table of the findings, sorted by severity with fixable findings first.
 # Each row contains left, right and column separators added by jq's join function.
-function print_vulnerabilities_table() {
+function print_findings_table() {


Optional suggestion:

Suggested change

function print_findings_table() {

function print_details_table() {

Done in 303fbdb

msugakov · 2025-12-19T12:59:07Z

release/scan-image-vulnerabilities/scan-image-vulnerabilities.sh

+# Asserts if any fixable findings of relevant severity are present.
+function assert_fixable_findings_present() {
+  local -n fixable_counts_map="$1"
+  if (( fixable_counts_map[CRITICAL] > 0 || fixable_counts_map[IMPORTANT] > 0 )); then
+    echo "true"
+  else
+    echo "false"
+  fi
+}


Sorry, this one's going to be a bit vague as I just throw a code suggestion:

Suggested change

# Asserts if any fixable findings of relevant severity are present.

function assert_fixable_findings_present() {

local -n fixable_counts_map="$1"

if (( fixable_counts_map[CRITICAL] > 0 || fixable_counts_map[IMPORTANT] > 0 )); then

echo "true"

else

echo "false"

fi

}

# Checks if any fixable findings of relevant severity are present.

function are_blocking_vulns_present() {

local -n fixable_counts="$1"

if (( fixable_counts[CRITICAL] > 0 || fixable_counts[IMPORTANT] > 0 )); then

return 0

else

return 1

fi

}

0 means success or "yes", no-zero means failure, or "no". Perhaps it can be done via just return (( fixable_counts[CRITICAL] > 0 || fixable_counts[IMPORTANT] > 0 )) but I haven't tried.

After this, you can simply write

if are_blocking_vulns_present fixable_counts_ref; then # ...

and no need to compare strings.

The logic is still invert of what it should be, 0 == "clean", no-zero == "failure", but we need a good function name and I can't come up with one at the moment. Perhaps you can?

Done in 35cf37d.
I think that are_blocking_vulns_present sufficiently describes the content of the function.

The variable needs to be named fixable_counts_map if we want to keep the local -n. If it was named fixable_counts, it would create a circular dependency.

tommartensen self-assigned this Dec 8, 2025

tommartensen changed the title ~~ROX-30730: add action for iamge-vulnerability-check~~ ROX-30730: add action for image-vulnerability-check Dec 8, 2025

tommartensen marked this pull request as ready for review December 8, 2025 15:40

tommartensen requested a review from a team as a code owner December 8, 2025 15:40

tommartensen mentioned this pull request Dec 8, 2025

ROX-30730: Scan Konflux images with GHA stackrox/stackrox#17985

Open

5 tasks

tommartensen requested a review from msugakov December 8, 2025 15:50

msugakov reviewed Dec 8, 2025

View reviewed changes

tommartensen marked this pull request as draft December 9, 2025 10:41

tommartensen marked this pull request as ready for review December 9, 2025 12:54

tommartensen requested a review from msugakov December 9, 2025 12:54

msugakov reviewed Dec 10, 2025

View reviewed changes

tommartensen added 18 commits December 13, 2025 11:41

ROX-30730: add action for iamge-vulnerability-check

a1ae34d

remove superfluous step ID

ffefc4f

Revert "remove superfluous step ID"

61ef929

This reverts commit 14030cb.

prepend only quay.io, require repository to be the passed in parameter

6bb87b8

quote bash command

9bbec44

refactor: markdown table, only fail if fixable CVEs

7d11292

make script executable

bbbfed2

cleanups

904332d

update documentation

48015ea

update summary

c9fe987

add title prefix

85a652f

fix typo

4c9379e

fix formatting

d6f9927

handle no vulnerabilities found

7025a2a

add message explaining status

09af701

re-format

a6584fd

add comments for the csv->markdown conversion

6e4b676

touches

75c2a6d

tommartensen added 3 commits December 13, 2025 11:41

update README

92b555b

prefer 'scan' or 'check' terminology

05a2a6e

addressing reviewer feedback

e6f53b0

tommartensen force-pushed the tm/ROX-image-vuln-check branch from e060327 to e6f53b0 Compare December 13, 2025 11:45

update script description

02bdcb2

msugakov changed the title ~~ROX-30730: add action for image-vulnerability-check~~ ROX-30730: add scan-image-vulnerabilities action Dec 15, 2025

tommartensen requested a review from msugakov December 15, 2025 12:56

msugakov reviewed Dec 15, 2025

View reviewed changes

msugakov reviewed Dec 16, 2025

View reviewed changes

tommartensen added 5 commits December 19, 2025 11:15

update README to address review comments

eb950c6

extract vuln table header from jq

380f2f4

put fixable findings first in table, then unfixable; fix counting of …

01751fb

…total findings by not relying on roxctl summary

s/vulnerabilities/findings

7334b3b

refactor fixable findings assertion to common function

b7c19e5

tommartensen requested a review from msugakov December 19, 2025 11:41

msugakov reviewed Dec 19, 2025

View reviewed changes

tommartensen added 2 commits January 5, 2026 17:02

apply code suggestions

303fbdb

resolve are_blocking_vulns_present hint

35cf37d

tommartensen requested a review from msugakov January 5, 2026 17:44


		Required: Yes
		Prefix for the vulnerability report in the GitHub step summary. Use this to help users of the action classify images into groups when multiple matrix scans are performed in a workflow.

	Additionally, an image integration for Quay.io needs to be configured in the ACS Central.
	Additionally, an image integration for Quay.io must be configured in the ACS Central so that it can pull images requested for scanning.

	function print_findings_status() {
	function print_summary() {

	function print_findings_table() {
	function print_details_table() {

ROX-30730: add scan-image-vulnerabilities action #72

Are you sure you want to change the base?

ROX-30730: add scan-image-vulnerabilities action #72

Uh oh!

Conversation

tommartensen commented Dec 8, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Validation

Why did I not test with test-gh-actions?

Uh oh!

msugakov left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

tommartensen commented Dec 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

msugakov left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

msugakov left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

msugakov left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

msugakov Dec 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

tommartensen commented Dec 8, 2025 •

edited

Loading

Why did I not test with `test-gh-actions`?

tommartensen commented Dec 9, 2025 •

edited

Loading

msugakov Dec 19, 2025 •

edited

Loading