From af4a4ffe1dbde7e950210e59457a8106e9ffc560 Mon Sep 17 00:00:00 2001
From: ArkaSaha30 <arkasaha30@gmail.com>
Date: Fri, 5 Apr 2024 00:43:56 +0530
Subject: [PATCH] [3.4]Add trivy scan as a job in release workflow

Signed-off-by: ArkaSaha30 <arkasaha30@gmail.com>
---
 .github/workflows/release.yaml            | 90 ++++++++++++++++-------
 .github/workflows/trivy-nightly-scan.yaml | 37 ----------
 2 files changed, 64 insertions(+), 63 deletions(-)
 delete mode 100644 .github/workflows/trivy-nightly-scan.yaml

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index bb20f4645..550731523 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -4,29 +4,67 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
-    - id: goversion
-      run: echo "goversion=$(cat .go-version)" >> "$GITHUB_OUTPUT"
-    - uses: actions/setup-go@v2
-      with:
-        go-version: ${{ steps.goversion.outputs.goversion }}
-    - name: release
-      run: |
-        set -euo pipefail
-
-        git config --global user.email "github-action@etcd.io"
-        git config --global user.name "Github Action"
-        gpg --batch --gen-key <<EOF
-        %no-protection
-        Key-Type: 1
-        Key-Length: 2048
-        Subkey-Type: 1
-        Subkey-Length: 2048
-        Name-Real: Github Action
-        Name-Email: github-action@etcd.io
-        Expire-Date: 0
-        EOF
-        DRY_RUN=true ./scripts/release.sh --no-upload --no-docker-push --in-place 3.4.99
-    - name: test-image
-      run: |
-        VERSION=3.4.99 ./scripts/test_images.sh
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - id: goversion
+        run: echo "goversion=$(cat .go-version)" >> "$GITHUB_OUTPUT"
+      - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
+        with:
+          go-version: ${{ steps.goversion.outputs.goversion }}
+      - name: release
+        run: |
+          set -euo pipefail
+          
+          git config --global user.email "github-action@etcd.io"
+          git config --global user.name "Github Action"
+          gpg --batch --gen-key <<EOF
+          %no-protection
+          Key-Type: 1
+          Key-Length: 2048
+          Subkey-Type: 1
+          Subkey-Length: 2048
+          Name-Real: Github Action
+          Name-Email: github-action@etcd.io
+          Expire-Date: 0
+          EOF
+          DRY_RUN=true ./scripts/release.sh --no-upload --no-docker-push --in-place 3.4.99
+      - name: test-image
+        run: |
+          VERSION=3.4.99 ./scripts/test_images.sh
+      - name: save-image
+        run: |
+          docker image save -o /tmp/etcd-img.tar gcr.io/etcd-development/etcd
+      - name: upload-image
+        uses: actions/upload-artifact@v3
+        with:
+          name: etcd-img
+          path: /tmp/etcd-img.tar
+          retention-days: 1
+  trivy-scan:
+    needs: release
+    strategy:
+      fail-fast: false
+      matrix:
+        platforms: [ '', '-arm64', '-ppc64le' ]
+    permissions:
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+    runs-on: ubuntu-latest
+    steps:
+      - name: get-image
+        uses: actions/download-artifact@v3
+        with:
+          name: etcd-img
+          path: /tmp
+      - name: load-image
+        run: |
+          docker load < /tmp/etcd-img.tar
+      - name: trivy-scan
+        uses: aquasecurity/trivy-action@d710430a6722f083d3b36b8339ff66b32f22ee55 # v0.19.0
+        with:
+          image-ref: 'gcr.io/etcd-development/etcd:v3.4.99${{ matrix.platforms }}'
+          severity: 'CRITICAL,HIGH'
+          format: 'sarif'
+          output: 'trivy-results-${{ matrix.platforms }}.sarif'
+      - name: upload scan results
+        uses: github/codeql-action/upload-sarif@956f09c2ef1926b580554b9014cfb8a51abf89dd # v2.16.6
+        with:
+          sarif_file: 'trivy-results-${{ matrix.platforms }}.sarif'
diff --git a/.github/workflows/trivy-nightly-scan.yaml b/.github/workflows/trivy-nightly-scan.yaml
deleted file mode 100644
index f29125ee4..000000000
--- a/.github/workflows/trivy-nightly-scan.yaml
+++ /dev/null
@@ -1,37 +0,0 @@
-name: Trivy Nightly Scan
-on:
-  schedule:
-    - cron: '0 2 * * *' # run at 2 AM UTC
-
-permissions: read-all 
-jobs:
-  nightly-scan:
-    name: Trivy Scan nightly
-    strategy:
-      fail-fast: false
-      matrix:
-        # maintain the versions of etcd that need to be actively
-        # security scanned
-        versions: [v3.4.22]
-    permissions:
-      security-events: write  # for github/codeql-action/upload-sarif to upload SARIF results
-
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # v3.1.0
-        with:
-          ref: release-3.4
-      - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@9ab158e8597f3b310480b9a69402b419bc03dbd5 # master
-        with:
-          image-ref: 'gcr.io/etcd-development/etcd:${{ matrix.versions }}'
-          severity: 'CRITICAL,HIGH'
-          format: 'template'
-          template: '@/contrib/sarif.tpl'
-          output: 'trivy-results-3-4.sarif'
-
-      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@a669cc5936cc5e1b6a362ec1ff9e410dc570d190 # v2.1.36
-        with:
-          sarif_file: 'trivy-results-3-4.sarif'