feat(cve): cache kfs vendors manifests built

sighupio · Nov 14, 2024 · e42aac2 · e42aac2
1 parent 7922e32
commit e42aac2
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 3 deletions.
diff --git a/.github/workflows/cve-scan-and-patching.yml b/.github/workflows/cve-scan-and-patching.yml
@@ -104,13 +104,21 @@ jobs:
       - name: cache tools
         uses: actions/cache@v4
         with:
+          fail-on-cache-miss: true
           path: |
             /tmp/.cache/trivy
             /usr/local/bin/trivy
             /usr/local/bin/furyctl
             /usr/local/bin/buildctl
             /usr/local/bin/copa
           key: cve-scan-patching-tools-${{ needs.fetch_kfd_versions.outputs.today_date }}
+      - name: cache KFD vendors built manifest for KFD ${{ matrix.kfd_version }}
+        uses: actions/cache@v4
+        with:
+         path: |
+          CVEs/${{ matrix.kfd_version }}/built.yaml
+          CVEs/${{ matrix.kfd_version }}/images.txt
+         key: kfd-${{ matrix.kfd_version }}-vendors-built-manifests
       - name: Execute CVEs scan for KFD ${{ matrix.kfd_version }}
         id: scan_pre_patch
         run: |
@@ -182,6 +190,7 @@ jobs:
       - name: cache tools
         uses: actions/cache@v4
         with:
+          fail-on-cache-miss: true
           path: |
             /tmp/.cache/trivy
             /usr/local/bin/trivy
@@ -238,6 +247,7 @@ jobs:
       - name: cache tools
         uses: actions/cache@v4
         with:
+          fail-on-cache-miss: true
           path: |
             /tmp/.cache/trivy
             /usr/local/bin/trivy

diff --git a/CVEs/Makefile b/CVEs/Makefile
@@ -17,9 +17,9 @@ all: trivy-download-db scan-pre-patch concat-multiple-kfd-images-list patch scan
 scan-pre-patch:
 	@for version in $(KFD_VERSIONS); do \
 		( \
-			$(MAKE) download-deps KFD_VERSION=$$version; \
-			$(MAKE) kustomize-build-all KFD_VERSION=$$version; \
-			$(MAKE) generate-image-list-from-manifests KFD_VERSION=$$version; \
+			[ ! -e $$version/built.yaml ] && $(MAKE) download-deps KFD_VERSION=$$version; \
+			[ ! -e $$version/built.yaml ] && $(MAKE) kustomize-build-all KFD_VERSION=$$version; \
+			[ ! -e $$version/images.txt ] && $(MAKE) generate-image-list-from-manifests KFD_VERSION=$$version; \
 			$(MAKE) scan-vulns KFD_VERSION=$$version LIST_FILE=$$version/images.txt OUTPUT_FILE=$$version/FURY-CVEs.md;  \
 		) & \
 	done; \