kyberorg / wait_for_harbor Goto Github PK

Motivation

Currently we have following GitHub Flow.

1. Image pushed to Harbor
2. we are launch this action
3. This action reports, that image with given SHA is present
4. Next step tries to pull it, but fails with error 404.

Pull was blocked by Security policy, which prevents images with vuln levels High or more to be pulled. De-facto level is yet unknown, because status is Running

Idea

Request

curl -X 'GET' \
  'https://my.harbor/api/v2.0/projects/projekt/repositories/repoName/artifacts/sha256%verylongsha256here/additions/vulnerabilities' \
  -H 'accept: application/json' \
  -H 'X-Accept-Vulnerabilities: application/vnd.security.vulnerability.report; version=1.1' \
  -H 'authorization: Basic  ...'

Resp (only interesting part)

"severity": "Critical",

So ideally this check should wait until scan result report and pass/fail based on severity.
Of course everything should be adjustable and can we disabled.

They should be with time unti (1m instead of 60).

• Fix issue
• Fix doku