Develop Anchore CLI Reports of Images with / without vulnerabilities

[godfreykutumela]

Goal:

Prepare reports for a demo at the PI meeting in Johannesburg

Tasks:

• figure out how to get the most current anchore reports in one place. The best method is likely:
  - [ ] Get CircleCI to automatically add these to releases (similar to the license-scanner summary on the mojaloop/helm repo
  • Write a tool to get all latest reports from a list of given repos in one place
  • upload these reports to the s3 bucket, similar to how we handle the sonarqube output
• Apply CI/CD Updates for the following repos:
  • bulk-api-adapter [PR]
  • central-event-processor [PR]
  • central-ledger [PR]
  • central-settlement [PR]
  • email-notifier [PR]
  • ml-api-adapter [PR]
  • quoting-service [PR]
  • mojaloop-simulator [PR]
• compile these reports for the upcoming convening
• summarize into one or two slides

Acceptance Criteria:

• Designs are up-to date
• Unit Tests pass
• Integration Tests pass
• Code Style & Coverage meets standards
• Changes made to config (default.json) are broadcast to team and follow-up tasks added to update helm charts and other deployment config.
• TBD

Pull Requests:

• Feature/1157 anchore report summary quoting-service#132
• Add anchore summary report upload mojaloop-simulator#26
• Add anchore summary report upload ml-api-adapter#340
• feature/1157-anchore-report-summary email-notifier#110
• feature/1157-anchore-report-summary central-settlement#230
• feature/1157-anchore-report-summary central-ledger#563
• feature/1157-anchore-report-summary central-event-processor#134
• feature/1157-anchore-report-summary bulk-api-adapter#19
• TBD

Follow-up:

• N/A

Dependencies:

• N/A

Accountability:

• Owner: TBC
• QA/Review: TBC

[lewisdaly]

Thanks @godfreykutumela.

This is already working on an automated basis. I'll look into how we might easily compile the reports in one place for future reference (and for this upcoming PI meeting).

[godfreykutumela]

Noted thanks @lewisdaly

[lewisdaly]

As per our recent discussion, we will upload the reports to s3, similar to the sonarqube reports

[lewisdaly]

Created new bucket to upload the reports to: s3://mojaloop-ci-reports

Here is my proposed directory structure:

/anchore-cli
    /central-ledger
        central-ledger-v8.8.0.json
        ...
    /ml-api-adapter
        ...
...
    /latest
         (contains all latest reports across all repos)

[godfreykutumela]

Noted, thanks @lewisdaly for actioning that

[lewisdaly]

I've shared an example excel file generated from the anchore-cli reports in slack (I'm not including here for security purposes). Waiting for some feedback from the team before continuing.

[godfreykutumela]

Noted Thanks @lewisdaly