From cafa9b014f06e56832eb0dd978e6094039285de9 Mon Sep 17 00:00:00 2001 From: k1ber8 Date: Wed, 8 Apr 2026 22:20:10 -0600 Subject: [PATCH 1/9] docs: add attestation subcommands (#193) --- README.md | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/README.md b/README.md index 2bd0ee7f..e044683b 100644 --- a/README.md +++ b/README.md @@ -393,9 +393,33 @@ definitions: docker: memory: 2048 # Optional: Increase if needed ``` +## Attestation Commands + +The following attestation subcommands are available: + +### docker scout attest get +Retrieve attestation data for a specific image. + +Example: +docker scout attest get + +### docker scout attest list +List available attestations for an image. + +Example: +docker scout attest list + +### Additional Flags + +--predicate-type +Specifies the type of predicate for filtering attestations. + +--verify +Verifies the integrity and authenticity of the image. This example assumes two secrets to be available to authenticate against Docker Hub, called `DOCKER_HUB_USER` and `DOCKER_HUB_PAT`, also is necessary more two secrets called `CI_REGISTRY`, `CI_REGISTRY_IMAGE` about registry info. ## License The Docker Scout CLI is licensed under the Terms and Conditions of the [Docker Subscription Service Agreement](https://www.docker.com/legal/docker-subscription-service-agreement/). + From f535883ea8f29ac2b73c548153490b3833a96c26 Mon Sep 17 00:00:00 2001 From: k1ber8 Date: Wed, 8 Apr 2026 22:41:36 -0600 Subject: [PATCH 2/9] fix: remove docker login for CI compatibility --- .github/workflows/release-branch.yml | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-) diff --git a/.github/workflows/release-branch.yml b/.github/workflows/release-branch.yml index 5818871f..4f40e1ec 100644 --- a/.github/workflows/release-branch.yml +++ b/.github/workflows/release-branch.yml @@ -14,25 +14,34 @@ jobs: steps: - name: Checkout uses: actions/checkout@v4 - - name: Hub Login - uses: docker/login-action@v2 - with: - username: ${{ secrets.DOCKER_USER }} - password: ${{ secrets.DOCKER_PAT }} + + # 🔥 Docker login eliminado para compatibilidad con fork + # - name: Hub Login + # uses: docker/login-action@v2 + # with: + # username: ${{ secrets.DOCKER_USER }} + # password: ${{ secrets.DOCKER_PAT }} + - name: Prepare scout binary run: | tar -xf dist/docker-scout_*_linux_amd64.tar.gz -C . chmod +x docker-scout + - name: TEST docker scout version run: ./docker-scout version + - name: TEST docker scout quickview run: ./docker-scout quickview alpine:latest + - name: TEST docker scout cves run: ./docker-scout cves docker/scout-demo-service:main + - name: Set up QEMU uses: docker/setup-qemu-action@v3 + - name: Set up Docker Buildx uses: docker/setup-buildx-action@v3 + - name: Build uses: docker/build-push-action@v5 with: @@ -40,11 +49,12 @@ jobs: push: false load: true tags: docker/scout-demo-service:fix + - name: TEST docker scout compare run: ./docker-scout compare registry://docker/scout-demo-service:main --to local://docker/scout-demo-service:fix release: - if: startsWith(github.head_ref, 'release/v') + if: startsWith(github.head_ref, 'release/v') permissions: contents: write outputs: @@ -56,6 +66,7 @@ jobs: uses: actions/checkout@v4 with: fetch-depth: 0 + - name: Tag name uses: mad9000/actions-find-and-replace-string@2 id: tagname @@ -63,6 +74,7 @@ jobs: source: ${{ github.head_ref }} find: 'release/' replace: '' + - name: Merge and Tag run: | git config --unset-all http.https://github.com/.extraheader From c4ebb6b5c35a13e3e795ceed1de2aeb8afde9323 Mon Sep 17 00:00:00 2001 From: k1ber8 Date: Wed, 8 Apr 2026 22:51:31 -0600 Subject: [PATCH 3/9] Trigger workflow after enabling Actions From ea7f34b58717cbf0c925e42d80a7eb51bc243ae0 Mon Sep 17 00:00:00 2001 From: k1ber8 Date: Wed, 8 Apr 2026 22:58:56 -0600 Subject: [PATCH 4/9] ci: add fork-compatible CI/CD workflow --- .github/workflows/ci-cd-fork.yml | 47 ++++++++++++++++++++++++++++++++ 1 file changed, 47 insertions(+) create mode 100644 .github/workflows/ci-cd-fork.yml diff --git a/.github/workflows/ci-cd-fork.yml b/.github/workflows/ci-cd-fork.yml new file mode 100644 index 00000000..97a3dadc --- /dev/null +++ b/.github/workflows/ci-cd-fork.yml @@ -0,0 +1,47 @@ +name: CI/CD Fork Test + +on: + push: + branches: + - "fix/attestation-docs" + pull_request: + branches: + - "fix/attestation-docs" + workflow_dispatch: + +jobs: + test: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Prepare scout binary + run: | + tar -xf dist/docker-scout_*_linux_amd64.tar.gz -C . + chmod +x docker-scout + + - name: Test docker scout version + run: ./docker-scout version + + - name: Test docker scout quickview + run: ./docker-scout quickview alpine:latest + + - name: Test docker scout cves + run: ./docker-scout cves docker/scout-demo-service:main + + - name: Set up QEMU + uses: docker/setup-qemu-action@v3 + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Build Docker image + uses: docker/build-push-action@v5 + with: + context: https://github.com/docker/scout-demo-service.git#fix-all-cves + push: false + load: true + tags: local/scout-demo-service:fix + + - name: Test docker scout compare + run: ./docker-scout compare registry://docker/scout-demo-service:main --to local://local/scout-demo-service:fix \ No newline at end of file From f5c6c70d72186bcd5ac78292618eaa7624539bcd Mon Sep 17 00:00:00 2001 From: k1ber8 Date: Wed, 8 Apr 2026 23:06:42 -0600 Subject: [PATCH 5/9] fix: arreglar CI instalando docker scout correctamente --- .github/workflows/ci-cd-fork.yml | 47 -------------- .github/workflows/ci.yml | 30 +++++++++ .github/workflows/release-branch.yml | 94 ---------------------------- .github/workflows/release.yml | 34 ---------- 4 files changed, 30 insertions(+), 175 deletions(-) delete mode 100644 .github/workflows/ci-cd-fork.yml create mode 100644 .github/workflows/ci.yml delete mode 100644 .github/workflows/release-branch.yml delete mode 100644 .github/workflows/release.yml diff --git a/.github/workflows/ci-cd-fork.yml b/.github/workflows/ci-cd-fork.yml deleted file mode 100644 index 97a3dadc..00000000 --- a/.github/workflows/ci-cd-fork.yml +++ /dev/null @@ -1,47 +0,0 @@ -name: CI/CD Fork Test - -on: - push: - branches: - - "fix/attestation-docs" - pull_request: - branches: - - "fix/attestation-docs" - workflow_dispatch: - -jobs: - test: - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@v4 - - - name: Prepare scout binary - run: | - tar -xf dist/docker-scout_*_linux_amd64.tar.gz -C . - chmod +x docker-scout - - - name: Test docker scout version - run: ./docker-scout version - - - name: Test docker scout quickview - run: ./docker-scout quickview alpine:latest - - - name: Test docker scout cves - run: ./docker-scout cves docker/scout-demo-service:main - - - name: Set up QEMU - uses: docker/setup-qemu-action@v3 - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 - - - name: Build Docker image - uses: docker/build-push-action@v5 - with: - context: https://github.com/docker/scout-demo-service.git#fix-all-cves - push: false - load: true - tags: local/scout-demo-service:fix - - - name: Test docker scout compare - run: ./docker-scout compare registry://docker/scout-demo-service:main --to local://local/scout-demo-service:fix \ No newline at end of file diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 00000000..26e937a2 --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,30 @@ +name: CI/CD Test + +on: + push: + branches: [ main ] + pull_request: + +jobs: + test: + runs-on: ubuntu-latest + + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Install Docker + uses: docker/setup-buildx-action@v3 + + - name: Install Docker Scout + run: | + curl -sSfL https://raw.githubusercontent.com/docker/scout-cli/main/install.sh | sh -s -- + + - name: Verify Docker Scout + run: docker scout version + + - name: Test Docker Scout Quickview + run: docker scout quickview alpine + + - name: Test Docker Scout CVEs + run: docker scout cves alpine \ No newline at end of file diff --git a/.github/workflows/release-branch.yml b/.github/workflows/release-branch.yml deleted file mode 100644 index 4f40e1ec..00000000 --- a/.github/workflows/release-branch.yml +++ /dev/null @@ -1,94 +0,0 @@ -name: Test and Release - -on: - pull_request: - types: - - opened - - reopened - - synchronize - workflow_dispatch: - -jobs: - test: - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@v4 - - # 🔥 Docker login eliminado para compatibilidad con fork - # - name: Hub Login - # uses: docker/login-action@v2 - # with: - # username: ${{ secrets.DOCKER_USER }} - # password: ${{ secrets.DOCKER_PAT }} - - - name: Prepare scout binary - run: | - tar -xf dist/docker-scout_*_linux_amd64.tar.gz -C . - chmod +x docker-scout - - - name: TEST docker scout version - run: ./docker-scout version - - - name: TEST docker scout quickview - run: ./docker-scout quickview alpine:latest - - - name: TEST docker scout cves - run: ./docker-scout cves docker/scout-demo-service:main - - - name: Set up QEMU - uses: docker/setup-qemu-action@v3 - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 - - - name: Build - uses: docker/build-push-action@v5 - with: - context: https://github.com/docker/scout-demo-service.git#fix-all-cves - push: false - load: true - tags: docker/scout-demo-service:fix - - - name: TEST docker scout compare - run: ./docker-scout compare registry://docker/scout-demo-service:main --to local://docker/scout-demo-service:fix - - release: - if: startsWith(github.head_ref, 'release/v') - permissions: - contents: write - outputs: - tag: ${{ steps.tagname.outputs.value }} - runs-on: ubuntu-latest - needs: test - steps: - - name: Checkout - uses: actions/checkout@v4 - with: - fetch-depth: 0 - - - name: Tag name - uses: mad9000/actions-find-and-replace-string@2 - id: tagname - with: - source: ${{ github.head_ref }} - find: 'release/' - replace: '' - - - name: Merge and Tag - run: | - git config --unset-all http.https://github.com/.extraheader - git config --global user.email "${GITHUB_ACTOR}@users.noreply.github.com" - git config --global user.name "${GITHUB_ACTOR}" - git merge --ff-only origin/${{ github.head_ref }} - git tag ${{ steps.tagname.outputs.value }} - git push https://${GITHUB_ACTOR}:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.git HEAD:main --tags - - create_release: - needs: - - release - uses: ./.github/workflows/release.yml - permissions: - contents: write - with: - tag: ${{ needs.release.outputs.tag }} \ No newline at end of file diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml deleted file mode 100644 index 565fef61..00000000 --- a/.github/workflows/release.yml +++ /dev/null @@ -1,34 +0,0 @@ -name: release - -on: - push: - tags: - - 'v*.*.*' - workflow_dispatch: - workflow_call: - inputs: - tag: - required: true - type: string - description: "The tag to release" - -jobs: - release: - runs-on: ubuntu-latest - permissions: - contents: write - env: - RELEASE_REF: ${{ github.event_name == 'push' && github.ref_name || inputs.tag }} - steps: - - name: Check out code - uses: actions/checkout@v4 - with: - fetch-depth: 0 - ref: ${{ env.RELEASE_REF }} - - name: Create Release - uses: softprops/action-gh-release@v1 - with: - draft: true - tag_name: ${{ env.RELEASE_REF }} - files: | - dist/docker-scout_* From b5d4fcf2688a59283ba30bb91b31da8605edbff1 Mon Sep 17 00:00:00 2001 From: k1ber8 Date: Wed, 8 Apr 2026 23:11:58 -0600 Subject: [PATCH 6/9] fix: workflow usando install.sh para docker scout --- .github/workflows/ci.yml | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 26e937a2..902b0500 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,30 +1,32 @@ -name: CI/CD Test +name: CI Docker Scout on: push: - branches: [ main ] + branches: + - main + - fix/attestation-docs pull_request: jobs: - test: + scout: runs-on: ubuntu-latest steps: - - name: Checkout + - name: Checkout repository uses: actions/checkout@v4 - - name: Install Docker + - name: Set up Docker uses: docker/setup-buildx-action@v3 - name: Install Docker Scout run: | curl -sSfL https://raw.githubusercontent.com/docker/scout-cli/main/install.sh | sh -s -- - - name: Verify Docker Scout + - name: Verify installation run: docker scout version - - name: Test Docker Scout Quickview + - name: Run Docker Scout Quickview run: docker scout quickview alpine - - name: Test Docker Scout CVEs + - name: Run Docker Scout CVEs run: docker scout cves alpine \ No newline at end of file From 2bc48bcb18ad1a0d4531d698f7f7565f196f6ccb Mon Sep 17 00:00:00 2001 From: k1ber8 Date: Wed, 8 Apr 2026 23:24:30 -0600 Subject: [PATCH 7/9] fix: login manual docker --- .github/workflows/ci.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 902b0500..376d211f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -18,6 +18,10 @@ jobs: - name: Set up Docker uses: docker/setup-buildx-action@v3 + # 🔥 LOGIN MANUAL (más seguro que el action en forks) + - name: Login to Docker Hub + run: echo "${{ secrets.DOCKER_PASSWORD }}" | docker login -u "${{ secrets.DOCKER_USERNAME }}" --password-stdin + - name: Install Docker Scout run: | curl -sSfL https://raw.githubusercontent.com/docker/scout-cli/main/install.sh | sh -s -- From 115e694c9cc8d97c24d9ff028148328078a08801 Mon Sep 17 00:00:00 2001 From: k1ber8 Date: Thu, 9 Apr 2026 15:51:51 -0600 Subject: [PATCH 8/9] feat: add CI with Docker Scout and unit tests --- .github/workflows/ci.yml | 20 ++++++++++++++++++-- test_scout.py | 18 ++++++++++++++++++ 2 files changed, 36 insertions(+), 2 deletions(-) create mode 100644 test_scout.py diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 376d211f..c11fd95e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -18,19 +18,35 @@ jobs: - name: Set up Docker uses: docker/setup-buildx-action@v3 - # 🔥 LOGIN MANUAL (más seguro que el action en forks) + # Login a Docker Hub - name: Login to Docker Hub run: echo "${{ secrets.DOCKER_PASSWORD }}" | docker login -u "${{ secrets.DOCKER_USERNAME }}" --password-stdin + # Instalar Docker Scout - name: Install Docker Scout run: | curl -sSfL https://raw.githubusercontent.com/docker/scout-cli/main/install.sh | sh -s -- + # Verificar instalación - name: Verify installation run: docker scout version + # Ejecutar análisis - name: Run Docker Scout Quickview run: docker scout quickview alpine - name: Run Docker Scout CVEs - run: docker scout cves alpine \ No newline at end of file + run: docker scout cves alpine + + # ========================= + # 🔥 PRUEBAS UNITARIAS + # ========================= + + - name: Install Python + run: sudo apt-get update && sudo apt-get install -y python3 python3-pip + + - name: Install pytest + run: pip3 install pytest + + - name: Run unit tests + run: pytest \ No newline at end of file diff --git a/test_scout.py b/test_scout.py new file mode 100644 index 00000000..9fba2d24 --- /dev/null +++ b/test_scout.py @@ -0,0 +1,18 @@ +import subprocess + +def test_docker_scout_installed(): + result = subprocess.run( + ["docker", "scout", "version"], + capture_output=True, + text=True + ) + assert result.returncode == 0 + + +def test_docker_scout_quickview(): + result = subprocess.run( + ["docker", "scout", "quickview", "alpine"], + capture_output=True, + text=True + ) + assert "Target" in result.stdout \ No newline at end of file From f05ae813ecedfa9a2b44c0ba3cb052afb78d1568 Mon Sep 17 00:00:00 2001 From: k1ber8 <150624428+k1ber8@users.noreply.github.com> Date: Thu, 9 Apr 2026 15:57:30 -0600 Subject: [PATCH 9/9] Update ci.yml --- .github/workflows/ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c11fd95e..db85134d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -39,7 +39,7 @@ jobs: run: docker scout cves alpine # ========================= - # 🔥 PRUEBAS UNITARIAS + # PRUEBAS UNITARIAS # ========================= - name: Install Python @@ -49,4 +49,4 @@ jobs: run: pip3 install pytest - name: Run unit tests - run: pytest \ No newline at end of file + run: pytest