diff --git a/.circleci/config.yml b/.circleci/config.yml index 142f11e25b9c3..5263622d9d0d1 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -5157,13 +5157,14 @@ workflows: - scan-images-in-quay: context: - quay-rhacs-eng-readonly - filters: - tags: - only: /.*/ - branches: - ignore: /.*/ - requires: - - build +# TODO(do-not-merge): Hack to check if it's working +# filters: +# tags: +# only: /.*/ +# branches: +# ignore: /.*/ +# requires: +# - build - openshift-ci-upgrade-test: context: diff --git a/release/scripts/vuln_check.sh b/release/scripts/vuln_check.sh index 0c1f529b43f94..9878a345f4733 100755 --- a/release/scripts/vuln_check.sh +++ b/release/scripts/vuln_check.sh @@ -11,7 +11,14 @@ GITROOT="$(git rev-parse --show-toplevel)" # Helper method to call curl command to quay function quay_curl { - curl -sS --fail -H "Authorization: Bearer ${QUAY_RHACS_ENG_BEARER_TOKEN}" -s -X GET "https://quay.io/api/v1/repository/rhacs-eng/${1}" + http_response=$(curl --retry 5 -s -v -o response.txt -w "%{http_code}" -H "Authorization: Bearer ${QUAY_RHACS_ENG_BEARER_TOKEN}" -s -X GET "https://quay.io/api/v1/repository/rhacs-eng/${1}") + if [ $http_response != 200 ]; then + echo "Server returned error: $http_response" + cat response.txt >&2 + exit $http_response + else + cat response.txt + fi } # Check image scan results in quay.io and alert on new fixable vulns @@ -87,18 +94,20 @@ function compare_fixable_vulns { FAIL_SCRIPT=false # determine all image tags -RELEASE_TAG=$(make --no-print-directory --quiet -C "${GITROOT}" tag) -COLLECTOR_TAG=$(make --no-print-directory --quiet -C "${GITROOT}" collector-tag) -SCANNER_TAG=$(make --no-print-directory --quiet -C "${GITROOT}" scanner-tag) -DOCS_PRERELEASE_TAG=$(make --no-print-directory --quiet -C "${GITROOT}" docs-tag) +#TODO(do-not-merge): Hack to check if it's working +RELEASE_TAG=3.68.1-0-g84d393a886 +COLLECTOR_TAG=3.6.0 +SCANNER_TAG=2.21.5 +DOCS_PRERELEASE_TAG=d4821715-f57a81c2-b6d8cf96 ALLOWED_VULNS=$(jq -c '.[]' "$DIR/allowed_vulns.json") +# check docs image - using the pre-release tag (not the release tag) +compare_fixable_vulns "docs" "$DOCS_PRERELEASE_TAG" + # check main images compare_fixable_vulns "main" "$RELEASE_TAG" -# check docs image - using the pre-release tag (not the release tag) -compare_fixable_vulns "docs" "$DOCS_PRERELEASE_TAG" # check collector images compare_fixable_vulns "collector" "${COLLECTOR_TAG}-slim"