erzz / dockle-action

Github Action to run Dockle and report in workflows, pipeline and PR's

dockle-action's Issues

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

This repository currently has no open or pending branches.

Detected dependencies

github-actions

.github/workflows/release.yml

.github/workflows/tests.yml

• actions/checkout v4
• actions/upload-artifact v4
• actions/checkout v4
• actions/upload-artifact v4

---

• Check this box to trigger a request for Renovate to run again on this repository

create floating releases

(without breaking semantic-release 🤷🏻‍♂️ )

Unable to resolve action `erzz/dockle-action@v1`, unable to find version `v1`

The examples in the README file all point to version v1, however that tag does not seem to exist in this repo

Using master or v1.1.1 works fine.

README file should be updated to point to an existing tag

Sarif report not processed

I see my report was not processed :

Waiting for processing to finish
  Analysis upload status is pending.
  Analysis upload status is failed.
  Error: Code Scanning could not process the submitted SARIF file:
  locationFromSarifResult: expected at least one location,locationFromSarifResult: expected at least one location,
  Error: Code Scanning could not process the submitted SARIF file:
  locationFromSarifResult: expected at least one location,locationFromSarifResult: expected at least one location,
      at Object.waitForProcessing (/home/runner/work/_actions/github/codeql-action/v2/lib/upload-lib.js:334:[19](https://github.com/metacontroller/metacontroller/actions/runs/3056690261/jobs/4931107049#step:7:21))
      at async run (/home/runner/work/_actions/github/codeql-action/v2/lib/upload-sarif-action.js:60:13)
      at async runWrapper (/home/runner/work/_actions/github/codeql-action/v2/lib/upload-sarif-action.js:75:9)

report

{
  "version": "2.1.0",
  "$schema": "https://json.schemastore.org/sarif-2.1.0-rtm.[5](https://github.com/metacontroller/metacontroller/actions/runs/3056690261/jobs/4931107049#step:6:6).json",
  "runs": [
    {
      "tool": {
        "driver": {
          "informationUri": "https://github.com/goodwithtech/dockle",
          "name": "Dockle",
          "rules": [
            {
              "id": "CIS-DI-0005",
              "shortDescription": {
                "text": "Enable Content trust for Docker"
              },
              "helpUri": "https://github.com/goodwithtech/dockle/blob/master/CHECKPOINT.md#CIS-DI-0005"
            },
            {
              "id": "CIS-DI-000[6](https://github.com/metacontroller/metacontroller/actions/runs/3056690261/jobs/4931107049#step:6:7)",
              "shortDescription": {
                "text": "Add HEALTHCHECK instruction to the container image"
              },
              "helpUri": "https://github.com/goodwithtech/dockle/blob/master/CHECKPOINT.md#CIS-DI-0006"
            }
          ]
        }
      },
      "results": [
        {
          "ruleId": "CIS-DI-0005",
          "ruleIndex": 0,
          "level": "note",
          "message": {
            "text": "export DOCKER_CONTENT_TRUST=1 before docker pull/build"
          }
        },
        {
          "ruleId": "CIS-DI-0006",
          "ruleIndex": 1,
          "level": "note",
          "message": {
            "text": "not found HEALTHCHECK statement"
          }
        }
      ]
    }
  ]
}

I suspect it expects some location for each element

dockle latest version

The parsing for the latest dockle version no longer works. The dockle repository seems to have deleted the v0.4.5 release or its tag. But it still works if I set dockle-version: "0.4.5".

update google auth examples

• current examples are little outdated
• perhaps also include an OIDC version
• perhaps examples from other registry providers

Add sarif upload to the tests

Given the reported issue #18 we should add a case to the tests for SARIF reporting.

Hit GitHub API rate limit when getting the dockle version

When the action runs more than one time in a job we hit the GitHub API Rate Limit meaning that we can't get the version, and if the version is empty, it tries to download a dockle version that it doesn't exists like here: https://github.com/cloudnative-pg/postgres-containers/actions/runs/3768952223/jobs/6407766763