THE GATE: THE GATE: This pipeline job must stop a deploy that carries critical vulnerabilities. Last month two criticals shipped to production while this job showed green. One of the three patches below actually closes the gate.
.github/workflows/deploy-gate.yml 1 │ jobs: 2 │ vuln-gate: 3 │ continue-on-error: true 4 │ steps: 5 │ - run: trivy image $IMAGE --format json -o scan.json || true 6 │ - uses: actions/upload-artifact@v4 7 │ with: { name: scan-report, path: scan.json } 8 │ - run: echo "scan complete"
PATCH 1 · tell the channel+ - run: |+ CRITS=$(jq '[.Results[].Vulnerabilities[]? | select(.Severity=="CRITICAL")] | length' scan.json)+ [ "$CRITS" -gt 0 ] && curl -s -X POST $SLACK_WEBHOOK -d "{\"text\": \"$CRITS criticals in $IMAGE\"}"
PATCH 2 · fail on exit code- - run: trivy image $IMAGE --format json -o scan.json || true+ - run: trivy image $IMAGE --format json -o scan.json
PATCH 3 · read the report, block the deploy- continue-on-error: true- - run: echo "scan complete"+ - run: |+ CRITS=$(jq '[.Results[].Vulnerabilities[]? | select(.Severity=="CRITICAL")] | length' scan.json)+ if [ "$CRITS" -gt 0 ]; then echo "::error::$CRITS critical vulns - deploy blocked"; exit 1; fi
grc@ctrl-f:~$