:Robot: Cache triby DB before running the build (#2885)

kairos-io · Sep 25, 2024 · fc77926 · fc77926
1 parent 0ade99b
commit fc77926
Show file tree

Hide file tree

Showing 5 changed files with 47 additions and 0 deletions.
diff --git a/.github/workflows/release-arm.yaml b/.github/workflows/release-arm.yaml
@@ -247,6 +247,12 @@ jobs:
           registry: quay.io
           username: ${{ secrets.QUAY_USERNAME }}
           password: ${{ secrets.QUAY_PASSWORD }}
+      - name: Cache trivy DB
+        uses: nick-fields/retry@v3
+        with:
+          max_attempts: 3
+          retry_on: error
+          command: earthly +trivy
       - name: Build  🔧
         run: |
           earthly -P +all-arm \
@@ -359,6 +365,12 @@ jobs:
           registry: quay.io
           username: ${{ secrets.QUAY_USERNAME }}
           password: ${{ secrets.QUAY_PASSWORD }}
+      - name: Cache trivy DB
+        uses: nick-fields/retry@v3
+        with:
+          max_attempts: 3
+          retry_on: error
+          command: earthly +trivy
       - name: Build  🔧
         run: |
           earthly -P +all-arm \
@@ -473,6 +485,12 @@ jobs:
         uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db # v3
       - name: Login to Quay Registry
         run: echo ${{ secrets.QUAY_PASSWORD }} | docker login -u ${{ secrets.QUAY_USERNAME }} --password-stdin quay.io
+      - name: Cache trivy DB
+        uses: nick-fields/retry@v3
+        with:
+          max_attempts: 3
+          retry_on: error
+          command: earthly +trivy
       - name: Build iso  🔧
         run: |
           INIT=$([[ "${{ matrix.flavor }}" == "alpine" ]] && echo "openrc" || echo "systemd")

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -161,6 +161,12 @@ jobs:
         with:
           repository: quay.io/kairos/packages
           packages: utils/earthly
+      - name: Cache trivy DB
+        uses: nick-fields/retry@v3
+        with:
+          max_attempts: 3
+          retry_on: error
+          command: earthly +trivy
       - name: Build  🔧
         run: |
           earthly +all  \
@@ -407,6 +413,12 @@ jobs:
           packages: utils/earthly
       - name: Login to Quay Registry
         run: echo ${{ secrets.QUAY_PASSWORD }} | docker login -u ${{ secrets.QUAY_USERNAME }} --password-stdin quay.io
+      - name: Cache trivy DB
+        uses: nick-fields/retry@v3
+        with:
+          max_attempts: 3
+          retry_on: error
+          command: earthly +trivy
       - name: Build  🔧
         run: |
           earthly +all  \

diff --git a/.github/workflows/reusable-build-flavor.yaml b/.github/workflows/reusable-build-flavor.yaml
@@ -124,6 +124,13 @@ jobs:
         with:
           repository: quay.io/kairos/packages
           packages: system/kairos-agent
+      - name: Cache trivy DB
+        if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}
+        uses: nick-fields/retry@v3
+        with:
+          max_attempts: 3
+          retry_on: error
+          command: earthly +trivy
       - name: Build master 🔧
         if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}
         run: |

diff --git a/.github/workflows/reusable-build-provider.yaml b/.github/workflows/reusable-build-provider.yaml
@@ -113,6 +113,13 @@ jobs:
         with:
           repository: quay.io/kairos/packages
           packages: system/kairos-agent
+      - name: Cache trivy DB
+        if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}
+        uses: nick-fields/retry@v3
+        with:
+          max_attempts: 3
+          retry_on: error
+          command: earthly +trivy
       - name: Build master 🔧
         if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}
         run: |

diff --git a/Earthfile b/Earthfile
@@ -768,7 +768,9 @@ datasource-iso:
 trivy:
     ARG TRIVY_VERSION
     FROM aquasec/trivy:$TRIVY_VERSION
+    RUN /usr/local/bin/trivy fs --download-db-only
     SAVE ARTIFACT /contrib contrib
+    SAVE ARTIFACT /root/.cache cache
     SAVE ARTIFACT /usr/local/bin/trivy /trivy
 
 trivy-scan:
@@ -781,6 +783,7 @@ trivy-scan:
 
     COPY +trivy/trivy /trivy
     COPY +trivy/contrib /contrib
+    COPY +trivy/cache /root/.cache
 
     WORKDIR /build
     RUN /trivy filesystem --skip-dirs /tmp --timeout 30m --format sarif -o report.sarif --no-progress /