Update security action

.github/workflows/bump.yml

@@ -8,20 +8,19 @@ on:
 
 jobs:
   build:
-
     runs-on: ubuntu-latest
-
     steps:
-    - uses: actions/checkout@v2
-    - name: Set up Python 3.8
-      uses: actions/setup-python@v1
-      with:
-        python-version: 3.8
-    - name: Install dependencies and run job
-      run: |
-        cd .github/automation
-        python -m pip install --upgrade pip
-        pip install -r requirements.txt
-        python main.py
-      env:
-        GITHUB_TOKEN: ${{secrets.DNX_GITHUB_TOKEN}}
+      - uses: actions/checkout@v4
+      - name: Set up Python 3.8
+        uses: actions/setup-python@v1
+        with:
+          python-version: 3.8
+      - name: Install dependencies and run job
+        run: |
+          cd .github/automation
+          python -m pip install --upgrade pip
+          pip install -r requirements.txt
+          python main.py
+        env:
+          GITHUB_TOKEN: ${{secrets.DNX_GITHUB_TOKEN}}
+

.github/workflows/security.yml

@@ -1,33 +1,29 @@
 name: Security
 
-on: [push]
+on:
+  push:
 
 jobs:
-
-  build:
-
+  scan:
     runs-on: ubuntu-latest
-
     steps:
       - name: Checkout the code
-        uses: actions/checkout@v2
-
+        uses: actions/checkout@v4
       - name: Build the Docker image
         run: docker build . --file Dockerfile --tag dnxsolutions/kube-tools:latest
-
       - name: Scan image
-        uses: anchore/scan-action@v3
+        uses: anchore/scan-action@v4
         id: scan
         with:
           image: dnxsolutions/kube-tools:latest
           fail-build: true
           severity-cutoff: critical
-          acs-report-enable: true
-
       - name: Inspect action SARIF report
         run: cat ${{ steps.scan.outputs.sarif }}
-
+        if: always()
       - name: Upload Anchore Scan Report
-        uses: github/codeql-action/upload-sarif@v1
+        uses: github/codeql-action/upload-sarif@v3
+        if: always()
         with:
-          sarif_file: ${{ steps.scan.outputs.sarif }}
+          sarif_file: ${{ steps.scan.outputs.sarif }}
+

Dockerfile

@@ -1,4 +1,4 @@
-FROM alpine:3.13
+FROM alpine:3.20.1
 
 ENV KUBECTL_VERSION=1.30.2
 ENV HELM_VERSION=3.15.3
@@ -15,64 +15,63 @@ COPY scripts /opt/scripts
 ENV PATH "$PATH:/opt/scripts"
 
 RUN apk --no-cache update && \
-    apk --no-cache add \
-        bash \
-        ca-certificates \
-        git \
-        openssl \
-        unzip \
-        gzip \
-        zip \
-        curl \
-        make \
-        tar \
-        python3 \
-        py3-pip \
-        py3-setuptools \
-        groff \
-        less \
-        jq \
-        gettext-dev \
-        g++ \
-        libc6-compat \
-        libstdc++ && \
-    python3 -m pip --no-cache-dir install --upgrade pip && \
-    python3 -m pip --no-cache-dir install --upgrade awscli && \
-    update-ca-certificates && \
-    rm -rf /var/tmp/ && \
-    rm -rf /tmp/* && \
-    rm -rf /var/cache/apk/*
+  apk --no-cache add \
+  bash \
+  ca-certificates \
+  git \
+  openssl \
+  unzip \
+  gzip \
+  zip \
+  curl \
+  make \
+  tar \
+  python3 \
+  py3-pip \
+  py3-setuptools \
+  groff \
+  less \
+  jq \
+  gettext-dev \
+  g++ \
+  libc6-compat \
+  libstdc++ \
+  aws-cli && \
+  update-ca-certificates && \
+  rm -rf /var/tmp/ && \
+  rm -rf /tmp/* && \
+  rm -rf /var/cache/apk/*
 
 # Kubectl
 RUN curl -LO https://storage.googleapis.com/kubernetes-release/release/v${KUBECTL_VERSION}/bin/linux/amd64/kubectl && \
-    chmod +x ./kubectl && \
-    mv ./kubectl /usr/local/bin/kubectl
+  chmod +x ./kubectl && \
+  mv ./kubectl /usr/local/bin/kubectl
 
 # Helm
 RUN curl -LO https://get.helm.sh/helm-v${HELM_VERSION}-linux-amd64.tar.gz  && \
-    tar -zxvf helm-v${HELM_VERSION}-linux-amd64.tar.gz && \
-    chmod +x linux-amd64/helm && \
-    mv linux-amd64/helm /usr/local/bin/helm && \
-    rm -rf linux-amd64 && rm -rf helm-v${HELM_VERSION}-linux-amd64.tar.gz
+  tar -zxvf helm-v${HELM_VERSION}-linux-amd64.tar.gz && \
+  chmod +x linux-amd64/helm && \
+  mv linux-amd64/helm /usr/local/bin/helm && \
+  rm -rf linux-amd64 && rm -rf helm-v${HELM_VERSION}-linux-amd64.tar.gz
 
 # Velero
 RUN curl -LO https://github.com/vmware-tanzu/velero/releases/download/v${VELERO_VERSION}/velero-v${VELERO_VERSION}-linux-amd64.tar.gz && \
-    tar -xvzf velero-v${VELERO_VERSION}-linux-amd64.tar.gz && \
-    chmod +x ./velero-v${VELERO_VERSION}-linux-amd64/velero && \
-    mv ./velero-v${VELERO_VERSION}-linux-amd64/velero /usr/local/bin/velero && \
-    rm -rf ./velero-v${VELERO_VERSION}-linux-amd64 && rm -rf velero-v${VELERO_VERSION}-linux-amd64.tar.gz
+  tar -xvzf velero-v${VELERO_VERSION}-linux-amd64.tar.gz && \
+  chmod +x ./velero-v${VELERO_VERSION}-linux-amd64/velero && \
+  mv ./velero-v${VELERO_VERSION}-linux-amd64/velero /usr/local/bin/velero && \
+  rm -rf ./velero-v${VELERO_VERSION}-linux-amd64 && rm -rf velero-v${VELERO_VERSION}-linux-amd64.tar.gz
 
 # Argo CD
 RUN curl --silent --location -o /usr/local/bin/argocd https://github.com/argoproj/argo-cd/releases/download/v${ARGOCD_VERSION}/argocd-linux-amd64 && \
-    chmod +x /usr/local/bin/argocd
+  chmod +x /usr/local/bin/argocd
 
 # kyml
 RUN curl -sfL -o /usr/local/bin/kyml https://github.com/frigus02/kyml/releases/download/v20190906/kyml_20190906_linux_amd64 && \
-    chmod +x /usr/local/bin/kyml
+  chmod +x /usr/local/bin/kyml
 
 # octant
 RUN curl -LO https://github.com/vmware-tanzu/octant/releases/download/v${OCTANT_VERSION}/octant_${OCTANT_VERSION}_Linux-64bit.tar.gz && \
-    tar -xvzf octant_${OCTANT_VERSION}_Linux-64bit.tar.gz && \
-    chmod +x ./octant_${OCTANT_VERSION}_Linux-64bit/octant && \
-    mv ./octant_${OCTANT_VERSION}_Linux-64bit/octant /usr/local/bin/octant && \
-    rm -rf ./octant_${OCTANT_VERSION}_Linux-64bit/octant && rm -rf octant_${OCTANT_VERSION}_Linux-64bit.tar.gz
+  tar -xvzf octant_${OCTANT_VERSION}_Linux-64bit.tar.gz && \
+  chmod +x ./octant_${OCTANT_VERSION}_Linux-64bit/octant && \
+  mv ./octant_${OCTANT_VERSION}_Linux-64bit/octant /usr/local/bin/octant && \
+  rm -rf ./octant_${OCTANT_VERSION}_Linux-64bit/octant && rm -rf octant_${OCTANT_VERSION}_Linux-64bit.tar.gz