Update module github.com/spf13/pflag to v1.0.10

Reviewed-on: #1

Dockerfile

@@ -5,9 +5,11 @@ RUN go build -o kforge .
 
 FROM alpine:3.19
 COPY --from=builder /app/kforge /usr/local/bin/kforge
-RUN apk add --no-cache curl && \
+RUN apk add --no-cache curl docker-cli && \
     curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" && \
-    install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl
+    install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl && \
+    curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin
+
 COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 

action.yml

@@ -40,6 +40,15 @@ inputs:
     description: "Kubernetes service account token"
     required: true
 
+  scan_image:
+    description: "Scan image for vulnerabilities before pushing"
+    required: false
+    default: "true"
+  scan_severity:
+    description: "Fail on these severity levels (UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL)"
+    required: false
+    default: "HIGH,CRITICAL"
+
 # outputs:
 #   output_file:
 #     description: "Path to the generated Kubernetes YAML file"

entrypoint.sh

@@ -67,6 +67,15 @@ if [ -n "$INPUT_IMAGE_NAME" ]; then
   if [ -n "$INPUT_IMAGE_TAG" ]; then
     echo "Building image $FULL_IMAGE:$INPUT_IMAGE_TAG..."
     docker build -t "$FULL_IMAGE:$INPUT_IMAGE_TAG" -f "$INPUT_DOCKERFILE" .
+
+    echo "Scanning image for vulnerabilities..."
+    trivy image \
+      --exit-code 1 \
+      --severity "$INPUT_SCAN_SEVERITY" \
+      --no-progress \
+      "$FULL_IMAGE:$INPUT_IMAGE_TAG"
+
+    echo "Scan passed, pushing image..."
     docker push "$FULL_IMAGE:$INPUT_IMAGE_TAG"
   else
     SHA=$(echo "$GITHUB_SHA" | cut -c1-7)
@@ -75,6 +84,15 @@ if [ -n "$INPUT_IMAGE_NAME" ]; then
       -t "$FULL_IMAGE:latest" \
       -t "$FULL_IMAGE:$SHA" \
       -f "$INPUT_DOCKERFILE" .
+
+    echo "Scanning image for vulnerabilities..."
+    trivy image \
+      --exit-code 1 \
+      --severity "$INPUT_SCAN_SEVERITY" \
+      --no-progress \
+      "$FULL_IMAGE:latest"
+
+    echo "Scan passed, pushing image..."
     docker push "$FULL_IMAGE:latest"
     docker push "$FULL_IMAGE:$SHA"
 
@@ -93,9 +111,15 @@ echo "Generating Kubernetes YAML from .kforge.yml"
 # ----------------------------------------------------------------
 # Build kubeconfig from token-based credentials
 echo "Configuring kubectl..."
+
+# Try writing the cert and check if it worked
+echo "$INPUT_KUBE_CERTIFICATE" | base64 -d > /tmp/kube-ca.crt 2>&1
+echo "Cert file size: $(wc -c < /tmp/kube-ca.crt)"
+echo "Cert file contents: $(cat /tmp/kube-ca.crt | head -1)"
+
 kubectl config set-cluster default \
 --server="$INPUT_KUBE_HOST" \
---certificate-authority=<(echo "$INPUT_KUBE_CERTIFICATE" | base64 -d)
+--certificate-authority=/tmp/kube-ca.crt
 
 kubectl config set-credentials default \
 --token="$INPUT_KUBE_TOKEN"
@@ -106,14 +130,17 @@ kubectl config set-context default \
 
 kubectl config use-context default
 
+
 # Create/update regcred secret idempotently
-echo "Creating regcred secret..."
+# echo "Creating regcred secret..."
-kubectl create secret docker-registry regcred \
+# kubectl create secret docker-registry regcred \
---docker-server="$INPUT_REGISTRY" \
+# --docker-server="$INPUT_REGISTRY" \
---docker-username="$INPUT_REGISTRY_USERNAME" \
+# --docker-username="$INPUT_REGISTRY_USERNAME" \
---docker-password="$INPUT_REGISTRY_PASSWORD" \
+# --docker-password="$INPUT_REGISTRY_PASSWORD" \
---dry-run=client -o yaml | kubectl apply -f -
+# --dry-run=client -o yaml | kubectl apply -f - --insecure-skip-tls-verify --validate=false
 
 echo "Deploying to Kubernetes..."
-kubectl apply -f ./kforge-out/
+kubectl apply --insecure-skip-tls-verify  --validate=false  -f ./.kforge-out/
 echo "Deploy complete."
+echo "Cleanup"
+rm -f /tmp/kube-ca.crt

go.mod

@@ -4,7 +4,7 @@ go 1.22
 
 require (
 	github.com/spf13/cobra v1.8.0
-	github.com/spf13/pflag v1.0.5
+	github.com/spf13/pflag v1.0.10
 	gopkg.in/yaml.v3 v3.0.1
 )
 

go.sum

@@ -6,6 +6,8 @@ github.com/spf13/cobra v1.8.0 h1:7aJaZx1B85qltLMc546zn58BxxfZdR/W22ej9CFoEf0=
 github.com/spf13/cobra v1.8.0/go.mod h1:WXLWApfZ71AjXPya3WOlMsY9yMs7YeiHhFVlvLyhcho=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

renovate.json

@@ -0,0 +1,3 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json"
+}