Tag PR image build as latest before scanning

This is less effort than passing the tag across steps 🤷‍♂️ Signed-off-by: Brad Davidson <brad.davidson@rancher.com> (cherry picked from commit 378edb93) Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Tag PR image build as latest before scanning
a8b292b1 · Brad Davidson · Brad Davidson · f4fcfef2 · a8b292b1 · a8b292b1
Commit a8b292b1 authored Sep 04, 2024 by Brad Davidson Committed by Brad Davidson Sep 06, 2024
Hide whitespace changes
Inline Side-by-side

Showing with 17 additions and 1 deletion

trivy.yaml .github/workflows/trivy.yaml +2 -1

tag-image-latest scripts/tag-image-latest +15 -0

No files found.
--- a/.github/workflows/trivy.yaml
+++ b/.github/workflows/trivy.yaml
@@ -27,11 +27,12 @@ jobs:
      run: |
        make local
        make package-image
+        make tag-image-latest

    - name: Run Trivy vulnerability scanner
      uses: aquasecurity/trivy-action@0.24.0
      with:
-        image-ref: 'rancher/k3s'
+        image-ref: 'rancher/k3s:latest'
        format: 'table'
        severity: "HIGH,CRITICAL"
        output: "trivy-report.txt"

--- a/scripts/tag-image-latest
+++ b/scripts/tag-image-latest
+#!/bin/bash
+set -e
+
+cd $(dirname $0)/..
+
+. ./scripts/version.sh
+
+TAG=${TAG:-${VERSION_TAG}${SUFFIX}}
+REPO=${REPO:-rancher}
+IMAGE_NAME=${IMAGE_NAME:-k3s}
+
+IMAGE=${REPO}/${IMAGE_NAME}:${TAG}
+LATEST=${REPO}/${IMAGE_NAME}:latest
+docker image tag ${IMAGE} ${LATEST}
+echo Tagged ${IMAGE} as ${LATEST}