CleverAgents Bot
9805a865cb
CI / load-versions (pull_request) Successful in 17s
CI / push-validation (pull_request) Successful in 24s
CI / lint (pull_request) Successful in 33s
CI / build (pull_request) Successful in 30s
CI / quality (pull_request) Successful in 1m4s
CI / typecheck (pull_request) Successful in 1m13s
CI / security (pull_request) Successful in 1m9s
CI / helm (pull_request) Successful in 37s
CI / unit_tests (pull_request) Successful in 5m31s
CI / docker (pull_request) Successful in 2m24s
CI / integration_tests (pull_request) Successful in 8m50s
CI / coverage (pull_request) Successful in 11m58s
CI / status-check (pull_request) Successful in 3s
49 lines
2.4 KiB
Plaintext
49 lines
2.4 KiB
Plaintext
*** Settings ***
|
|
Documentation Integration tests for CI Dockerfile.server security scanning
|
|
... Validates that the CI workflow includes the Trivy security scan step
|
|
... configured to fail on HIGH/CRITICAL vulnerabilities (issue #1927).
|
|
Resource ${CURDIR}/common.resource
|
|
Suite Setup Setup Test Environment
|
|
Suite Teardown Cleanup Test Environment
|
|
|
|
*** Test Cases ***
|
|
CI Workflow Contains Trivy Security Scan Step
|
|
[Documentation] Verify the docker CI job includes the Trivy security scan step
|
|
[Tags] security ci dockerfile
|
|
${content}= Get File ${WORKSPACE}/.forgejo/workflows/ci.yml
|
|
Should Contain ${content} Security scan Dockerfile.server image with Trivy
|
|
|
|
CI Workflow Targets Dockerfile Server Image
|
|
[Documentation] Verify the CI scan targets the Dockerfile.server image specifically
|
|
[Tags] security ci dockerfile
|
|
${content}= Get File ${WORKSPACE}/.forgejo/workflows/ci.yml
|
|
Should Contain ${content} Dockerfile.server
|
|
Should Contain ${content} cleveragents-server:test
|
|
|
|
CI Trivy Configured To Fail On High Severity
|
|
[Documentation] Verify Trivy exits non-zero on HIGH or CRITICAL findings
|
|
[Tags] security ci dockerfile
|
|
${content}= Get File ${WORKSPACE}/.forgejo/workflows/ci.yml
|
|
Should Contain ${content} --severity HIGH,CRITICAL
|
|
Should Contain ${content} --exit-code 1
|
|
Should Contain ${content} --ignore-unfixed
|
|
|
|
CI Trivy Uses Pinned Docker Image
|
|
[Documentation] Verify Trivy runs from a pinned upstream Docker image
|
|
[Tags] security ci dockerfile
|
|
${content}= Get File ${WORKSPACE}/.forgejo/workflows/ci.yml
|
|
Should Contain ${content} TRIVY_IMAGE="aquasec/trivy:0.58.0"
|
|
Should Contain ${content} docker pull "$\{TRIVY_IMAGE}"
|
|
|
|
CI Trivy Scans Image Through Docker Socket
|
|
[Documentation] Verify Trivy can inspect the Dockerfile.server image built in dind
|
|
[Tags] security ci dockerfile
|
|
${content}= Get File ${WORKSPACE}/.forgejo/workflows/ci.yml
|
|
Should Contain ${content} -v /var/run/docker.sock:/var/run/docker.sock
|
|
Should Contain ${content} cleveragents-server:test
|
|
|
|
Dockerfile Server Exists In Repository
|
|
[Documentation] Verify Dockerfile.server exists at the expected repository location
|
|
[Tags] security dockerfile
|
|
File Should Exist ${WORKSPACE}/Dockerfile.server
|