ROX-30730: Scan Konflux images with GHA

[tommartensen]

Description

Companion to stackrox/actions#72.

• Workflow now scans Konflux and GHA-built images.
• Workflow now triggered by new tags (can be manually dispatched for other tags).
• Workflow uses composite action to stay DRY.

TODO

• update the action reference after that PR is merged.

User-facing documentation

• CHANGELOG.md update is not needed
• documentation PR is not needed

Testing and quality

• the change is production ready: the change is GA, or otherwise the functionality is gated by a feature flag
• CI results are inspected

Automated testing

Change to GHA, manual testing required, see below.

How I validated my change

Manual testing with https://github.com/stackrox/stackrox/actions/runs/20034440769.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[rhacs-bot]

Images are ready for the commit at 753bb58.

To use with deploy scripts, first export MAIN_IMAGE_TAG=4.10.x-553-g753bb5893a.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 49.37%. Comparing base (96c8aa5) to head (753bb58).
⚠️ Report is 63 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #17985      +/-   ##
==========================================
+ Coverage   49.34%   49.37%   +0.03%     
==========================================
  Files        2711     2722      +11     
  Lines      200204   200943     +739     
==========================================
+ Hits        98792    99219     +427     
- Misses      93762    94056     +294     
- Partials     7650     7668      +18     

Flag	Coverage Δ
go-unit-tests	49.37% <ø> (+0.03%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[sourcery-ai]

Hey there - I've reviewed your changes and found some issues that need to be addressed.

• The new push trigger doesn’t provide inputs.version, so the workflow (including run-name and the composite action input) will likely see an empty or undefined version on tag pushes; consider deriving version from github.ref_name (for push) and using inputs.version only for workflow_dispatch.
• Both upstream and Konflux jobs upload artifacts with the same scan-result-${{ matrix.image }} naming pattern, which can cause artifact name collisions/merging and make it unclear which scan corresponds to which build; consider including the source (e.g. -upstream / -konflux or the tag) in the artifact name.
• The composite action is referenced by a feature branch (@tm/ROX-image-vuln-check); once the action is finalized, pin it to a stable tag or commit SHA to avoid unexpected behavior changes in this workflow.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- The new `push` trigger doesn’t provide `inputs.version`, so the workflow (including `run-name` and the composite action input) will likely see an empty or undefined version on tag pushes; consider deriving `version` from `github.ref_name` (for `push`) and using `inputs.version` only for `workflow_dispatch`.
- Both upstream and Konflux jobs upload artifacts with the same `scan-result-${{ matrix.image }}` naming pattern, which can cause artifact name collisions/merging and make it unclear which scan corresponds to which build; consider including the source (e.g. `-upstream` / `-konflux` or the tag) in the artifact name.
- The composite action is referenced by a feature branch (`@tm/ROX-image-vuln-check`); once the action is finalized, pin it to a stable tag or commit SHA to avoid unexpected behavior changes in this workflow.

## Individual Comments

### Comment 1
<location> `.github/workflows/check-image-vulnerabilities.yml:13` </location>
<code_context>
+  push:
+    tags: ['*']

 run-name: ${{ format('Check image vulnerabilities for {0}', inputs.version) }}

</code_context>

<issue_to_address>
**issue (bug_risk):** Using `inputs.version` for push tag runs will break because `workflow_dispatch.inputs` are not defined on `push` events.

With the new `push: tags: ['*']` trigger, this workflow now runs in contexts where `inputs.version` is undefined. Using `inputs.version` in `run-name` and job/action inputs will fail on tag pushes. Either restrict this workflow to `workflow_dispatch` only, derive the version from the tag (e.g. `github.ref_name`) for `push` runs, or conditionally use `inputs.version` only when `github.event_name == 'workflow_dispatch'`.
</issue_to_address>

### Comment 2
<location> `.github/workflows/check-image-vulnerabilities.yml:64-70` </location>
<code_context>

-      - name: Install roxctl
-        uses: stackrox/roxctl-installer-action@v1
+      - name: Upload scan result artifact
+        if: always()
+        uses: actions/upload-artifact@v4
         with:
-          central-endpoint: ${{ vars.ACS_DOGFOODING_CENTRAL_URL }}
-          central-token: ${{ env.ROX_API_TOKEN }}
+          name: scan-result-${{ matrix.image }}
+          path: scan-result.json
+          retention-days: 30

</code_context>

<issue_to_address>
**suggestion (bug_risk):** Uploading `scan-result.json` unconditionally may fail if the check action exits before creating the file.

Because this step runs even when `Check image vulnerabilities` fails, it can error if `scan-result.json` was never created, obscuring the original failure. Please either condition this step on the prior step having succeeded, or add a guard like `if: always() && hashFiles('scan-result.json') != ''` or `continue-on-error: true` so missing artifacts don’t cause a secondary failure.

```suggestion
      - name: Upload scan result artifact
        if: always() && hashFiles('scan-result.json') != ''
        uses: actions/upload-artifact@v4
        with:
          name: scan-result-${{ matrix.image }}
          path: scan-result.json
          retention-days: 30
```
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[sourcery-ai]

Hey there - I've reviewed your changes - here's some feedback:

• Before merging, update the stackrox/actions/release/check-image-vulnerabilities reference from the feature branch (@tm/ROX-image-vuln-check) to a stable tag or commit SHA to avoid depending on an ephemeral branch.
• The push trigger currently runs on all tags ('*'); if this workflow is intended only for release tags, consider tightening the pattern (e.g., v* or *.*.*) to avoid unnecessary scans for non-release tags.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- Before merging, update the `stackrox/actions/release/check-image-vulnerabilities` reference from the feature branch (`@tm/ROX-image-vuln-check`) to a stable tag or commit SHA to avoid depending on an ephemeral branch.
- The `push` trigger currently runs on all tags (`'*'`); if this workflow is intended only for release tags, consider tightening the pattern (e.g., `v*` or `*.*.*`) to avoid unnecessary scans for non-release tags.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[msugakov]

scan-result.json filename seems like escaped from the action implementation (stackrox/actions#72). Is it possible to get that via result-path?

[msugakov]

As compared to the old implementation, wait-limit is added to pick up images from tagged builds.
Do you think we should have auto-triggering for tagged builds given Konflux instability?

If this is manually triggered run, it would be nice to not wait for images but rather let the step fail right away if its image is absent. Is there a way to conditionally set zero waiting time in this case?

[msugakov]

Suggestion:

Suggested change

	- name: Check image vulnerabilities
	- name: Scan image for vulnerabilities

Would it make sense to s/check/scan/g in this file?