You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@superset.apache.org by vi...@apache.org on 2026/06/06 00:37:20 UTC
(superset-kubernetes-operator) branch main updated: chore: add vulnerability scanning, Scorecard, and Helm values schema (#121)
This is an automated email from the ASF dual-hosted git repository.
villebro pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/superset-kubernetes-operator.git
The following commit(s) were added to refs/heads/main by this push:
new 076857e chore: add vulnerability scanning, Scorecard, and Helm values schema (#121)
076857e is described below
commit 076857e90d2dbea81751926b6563ac4e224394f9
Author: Ville Brofeldt <33...@users.noreply.github.com>
AuthorDate: Fri Jun 5 17:37:16 2026 -0700
chore: add vulnerability scanning, Scorecard, and Helm values schema (#121)
* chore: add vulnerability scanning, Scorecard, and Helm values schema
* fix vuln scans
---
.github/workflows/ci.yaml | 22 ++++++
.github/workflows/release.yml | 4 +-
.github/workflows/scorecard.yml | 50 ++++++++++++++
.rat-excludes | 1 +
Makefile | 8 +++
README.md | 1 +
charts/superset-operator/Chart.yaml | 9 +++
charts/superset-operator/values.schema.json | 100 ++++++++++++++++++++++++++++
docs/reference/security.md | 8 +++
go.mod | 10 +--
go.sum | 16 ++---
renovate.json | 11 +--
12 files changed, 221 insertions(+), 19 deletions(-)
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 938c19b..b13a319 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -46,6 +46,8 @@ jobs:
go-version-file: go.mod
- name: Lint
run: make lint
+ - name: Vulnerability scan (govulncheck)
+ run: make govulncheck
verify-codegen:
name: Verify codegen
@@ -78,10 +80,30 @@ jobs:
docker:
name: Docker build
runs-on: ubuntu-latest
+ permissions:
+ contents: read
+ security-events: write # upload Trivy SARIF to code scanning
steps:
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
- name: Build Docker image
run: make docker-build IMG=superset-operator:ci
+ - name: Scan image for vulnerabilities (Trivy)
+ uses: lhotari/sandboxed-trivy-action@f01374b6cc3bf7264ab238293e94f6db7ada6dd0 # v1
+ with:
+ scan-type: image
+ scan-ref: superset-operator:ci
+ scanners: vuln
+ ignore-unfixed: "true"
+ severity: HIGH,CRITICAL
+ format: sarif
+ output: trivy-results.sarif
+ - name: Upload Trivy results to code scanning
+ # GITHUB_TOKEN is read-only on fork PRs, so only upload on push to main.
+ if: ${{ github.event_name == 'push' }}
+ uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+ with:
+ sarif_file: trivy-results.sarif
+ category: trivy-image
validate-actions:
name: Validate GitHub Actions
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1d5bf63..0ab993a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -54,8 +54,8 @@ jobs:
with:
images: ${{ env.IMAGE_NAME }}
tags: |
- # On push to main: sha-<short-sha>
- type=sha,prefix=sha-,format=short,enable={{is_default_branch}}
+ # On every build (main + tags): full commit SHA, immutably pinnable
+ type=sha,prefix=sha-,format=long
# On push to main: floating dev tag (latest main build)
type=raw,value=dev,enable={{is_default_branch}}
# On tag push: strip 'v' prefix (v0.1.0 -> 0.1.0, v0.1.0-rc1 -> 0.1.0-rc1)
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
new file mode 100644
index 0000000..007ccb4
--- /dev/null
+++ b/.github/workflows/scorecard.yml
@@ -0,0 +1,50 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: Scorecard
+
+on:
+ branch_protection_rule:
+ schedule:
+ - cron: "27 5 * * 2" # Tuesday 05:27 UTC
+ push:
+ branches: [main]
+
+permissions: read-all
+
+jobs:
+ analysis:
+ name: Scorecard analysis
+ runs-on: ubuntu-latest
+ permissions:
+ security-events: write # upload results to code scanning
+ id-token: write # publish results to the OpenSSF API for the badge
+ steps:
+ - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+ with:
+ persist-credentials: false
+
+ - name: Run analysis
+ uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+ with:
+ results_file: results.sarif
+ results_format: sarif
+ publish_results: true
+
+ - name: Upload to code scanning
+ uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+ with:
+ sarif_file: results.sarif
+ category: scorecard
diff --git a/.rat-excludes b/.rat-excludes
index e2e78e2..2ecd819 100644
--- a/.rat-excludes
+++ b/.rat-excludes
@@ -36,6 +36,7 @@
# Helm chart metadata
.*Chart\.yaml
.*values\.yaml
+.*values\.schema\.json
# Documentation
.*api-reference\.md
diff --git a/Makefile b/Makefile
index e132ffb..7ebfa40 100644
--- a/Makefile
+++ b/Makefile
@@ -318,6 +318,7 @@ CONTROLLER_GEN ?= $(LOCALBIN)/controller-gen
ENVTEST ?= $(LOCALBIN)/setup-envtest
GOLANGCI_LINT = $(LOCALBIN)/golangci-lint
CRD_REF_DOCS = $(LOCALBIN)/crd-ref-docs
+GOVULNCHECK = $(LOCALBIN)/govulncheck
## Tool Versions
KUSTOMIZE_VERSION ?= v5.6.0
@@ -328,6 +329,7 @@ ENVTEST_VERSION ?= $(shell go list -m -f "{{ .Version }}" sigs.k8s.io/controller
ENVTEST_K8S_VERSION ?= $(shell go list -m -f "{{ .Version }}" k8s.io/api | awk -F'[v.]' '{printf "1.%d", $$3}')
GOLANGCI_LINT_VERSION ?= v2.1.0
CRD_REF_DOCS_VERSION ?= v0.3.0
+GOVULNCHECK_VERSION ?= v1.3.0
.PHONY: kustomize
kustomize: $(KUSTOMIZE) ## Download kustomize locally if necessary.
@@ -362,6 +364,12 @@ crd-ref-docs: $(CRD_REF_DOCS) ## Download crd-ref-docs locally if necessary.
$(CRD_REF_DOCS): $(LOCALBIN)
$(call go-install-tool,$(CRD_REF_DOCS),github.com/elastic/crd-ref-docs,$(CRD_REF_DOCS_VERSION))
+.PHONY: govulncheck
+govulncheck: $(GOVULNCHECK) ## Run govulncheck vulnerability scanner over all packages.
+ $(GOVULNCHECK) ./...
+$(GOVULNCHECK): $(LOCALBIN)
+ $(call go-install-tool,$(GOVULNCHECK),golang.org/x/vuln/cmd/govulncheck,$(GOVULNCHECK_VERSION))
+
# go-install-tool will 'go install' any package with custom target and name of binary, if it doesn't exist
# $1 - target path with name of binary
# $2 - package url which can be installed
diff --git a/README.md b/README.md
index 1d2f9aa..462889a 100644
--- a/README.md
+++ b/README.md
@@ -24,6 +24,7 @@ under the License.
[](https://github.com/apache/superset-kubernetes-operator/actions/workflows/ci.yaml)
[](https://codecov.io/gh/apache/superset-kubernetes-operator)
[](https://goreportcard.com/report/github.com/apache/superset-kubernetes-operator)
+[](https://scorecard.dev/viewer/?uri=github.com/apache/superset-kubernetes-operator)
[](https://opensource.org/licenses/Apache-2.0)
[](https://apache.github.io/superset-kubernetes-operator/)
diff --git a/charts/superset-operator/Chart.yaml b/charts/superset-operator/Chart.yaml
index 1e2a323..461b291 100644
--- a/charts/superset-operator/Chart.yaml
+++ b/charts/superset-operator/Chart.yaml
@@ -5,6 +5,7 @@ type: application
version: 0.0.0-dev
appVersion: "dev"
home: https://github.com/apache/superset-kubernetes-operator
+icon: https://superset.apache.org/img/superset-logo-horiz.svg
sources:
- https://github.com/apache/superset-kubernetes-operator
maintainers:
@@ -16,3 +17,11 @@ keywords:
- kubernetes
- analytics
- bi
+annotations:
+ artifacthub.io/license: Apache-2.0
+ artifacthub.io/operator: "true"
+ artifacthub.io/links: |
+ - name: Documentation
+ url: https://apache.github.io/superset-kubernetes-operator/
+ - name: Source
+ url: https://github.com/apache/superset-kubernetes-operator
diff --git a/charts/superset-operator/values.schema.json b/charts/superset-operator/values.schema.json
new file mode 100644
index 0000000..b17ea2e
--- /dev/null
+++ b/charts/superset-operator/values.schema.json
@@ -0,0 +1,100 @@
+{
+ "$schema": "https://json-schema.org/draft-07/schema#",
+ "title": "superset-operator Helm chart values",
+ "type": "object",
+ "additionalProperties": false,
+ "properties": {
+ "global": {
+ "type": "object",
+ "description": "Helm-injected global values (present when installed as a dependency)."
+ },
+ "nameOverride": { "type": "string" },
+ "fullnameOverride": { "type": "string" },
+ "image": {
+ "type": "object",
+ "additionalProperties": false,
+ "properties": {
+ "repository": { "type": "string" },
+ "tag": { "type": "string" },
+ "pullPolicy": {
+ "type": "string",
+ "enum": ["Always", "IfNotPresent", "Never"]
+ }
+ }
+ },
+ "replicas": { "type": "integer", "minimum": 0 },
+ "resources": { "type": "object" },
+ "serviceAccount": {
+ "type": "object",
+ "additionalProperties": false,
+ "properties": {
+ "create": { "type": "boolean" },
+ "name": { "type": "string" },
+ "annotations": { "type": "object" }
+ }
+ },
+ "leaderElection": {
+ "type": "object",
+ "additionalProperties": false,
+ "properties": {
+ "enabled": { "type": "boolean" }
+ }
+ },
+ "metrics": {
+ "type": "object",
+ "additionalProperties": false,
+ "properties": {
+ "enabled": { "type": "boolean" },
+ "service": {
+ "type": "object",
+ "additionalProperties": false,
+ "properties": {
+ "port": { "type": "integer" }
+ }
+ },
+ "certSecretName": { "type": "string" },
+ "serviceMonitor": {
+ "type": "object",
+ "additionalProperties": false,
+ "properties": {
+ "enabled": { "type": "boolean" },
+ "interval": { "type": "string" },
+ "scrapeTimeout": { "type": "string" },
+ "labels": { "type": "object" },
+ "tlsConfig": { "type": "object" },
+ "bearerTokenFile": { "type": "string" }
+ }
+ }
+ }
+ },
+ "healthProbes": {
+ "type": "object",
+ "additionalProperties": false,
+ "properties": {
+ "livenessProbe": { "type": "object" },
+ "readinessProbe": { "type": "object" }
+ }
+ },
+ "podSecurityContext": { "type": "object" },
+ "securityContext": { "type": "object" },
+ "nodeSelector": { "type": "object" },
+ "tolerations": { "type": "array" },
+ "affinity": { "type": "object" },
+ "podAnnotations": { "type": "object" },
+ "podLabels": { "type": "object" },
+ "watch": {
+ "type": "object",
+ "additionalProperties": false,
+ "properties": {
+ "scope": {
+ "type": "string",
+ "enum": ["cluster", "namespaces"]
+ },
+ "namespaces": {
+ "type": "array",
+ "items": { "type": "string" }
+ }
+ }
+ }
+ }
+}
diff --git a/docs/reference/security.md b/docs/reference/security.md
index fd7979b..904bcb5 100644
--- a/docs/reference/security.md
+++ b/docs/reference/security.md
@@ -419,6 +419,14 @@ The release pipeline produces signed multi-architecture artifacts:
attestations by BuildKit at build time. Inspect them with
`docker buildx imagetools inspect ghcr.io/apache/superset-kubernetes-operator:<tag> --format '{{ json .SBOM }}'`
(or `.Provenance`), or with `cosign download attestation`.
+- **Vulnerability scanning:** CI runs [`govulncheck`](https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck)
+ against the Go source (reachable CVEs in dependencies and the standard library)
+ and [Trivy](https://github.com/aquasecurity/trivy) against the built image
+ (OS and shipped-binary CVEs), with results uploaded to GitHub code scanning.
+ [CodeQL](https://codeql.github.com/) provides static analysis of the Go code.
+- **Supply-chain posture:** An [OpenSSF Scorecard](https://securityscorecards.dev/)
+ workflow runs on a schedule and publishes the project's score (linked from the
+ README badge).
## What Is Generally Out of Scope
diff --git a/go.mod b/go.mod
index 7ff26bc..739132f 100644
--- a/go.mod
+++ b/go.mod
@@ -2,6 +2,8 @@ module github.com/apache/superset-kubernetes-operator
go 1.26.0
+toolchain go1.26.4
+
require (
github.com/Masterminds/semver/v3 v3.5.0
github.com/onsi/ginkgo/v2 v2.29.0
@@ -74,12 +76,12 @@ require (
go.yaml.in/yaml/v3 v3.0.4 // indirect
golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93 // indirect
golang.org/x/mod v0.35.0 // indirect
- golang.org/x/net v0.53.0 // indirect
+ golang.org/x/net v0.55.0 // indirect
golang.org/x/oauth2 v0.34.0 // indirect
golang.org/x/sync v0.20.0 // indirect
- golang.org/x/sys v0.43.0 // indirect
- golang.org/x/term v0.42.0 // indirect
- golang.org/x/text v0.36.0 // indirect
+ golang.org/x/sys v0.45.0 // indirect
+ golang.org/x/term v0.43.0 // indirect
+ golang.org/x/text v0.37.0 // indirect
golang.org/x/time v0.14.0 // indirect
golang.org/x/tools v0.44.0 // indirect
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
diff --git a/go.sum b/go.sum
index 9199a0d..6ab208d 100644
--- a/go.sum
+++ b/go.sum
@@ -183,18 +183,18 @@ golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93 h1:fQsdNF2N+/YewlRZiricy4P1i
golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93/go.mod h1:EPRbTFwzwjXj9NpYyyrvenVh9Y+GFeEvMNh7Xuz7xgU=
golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=
golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
-golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
-golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
+golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
+golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw=
golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
-golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY=
-golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY=
-golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
-golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
+golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
+golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
+golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
+golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
+golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=
diff --git a/renovate.json b/renovate.json
index 11fede9..72b8ef0 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,18 +1,19 @@
{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
- "extends": ["config:recommended"],
+ "extends": ["config:best-practices"],
"minimumReleaseAge": "7 days",
"labels": ["dependencies"],
+ "osvVulnerabilityAlerts": true,
+ "vulnerabilityAlerts": {
+ "labels": ["security"],
+ "minimumReleaseAge": null
+ },
"packageRules": [
{
"matchManagers": ["gomod"],
"postUpdateOptions": ["gomodTidy"],
"groupName": "Go dependencies"
},
- {
- "matchManagers": ["github-actions"],
- "pinDigests": true
- },
{
"matchPackageNames": ["kubernetes-sigs/kind"],
"addLabels": ["review:supported-k8s"],