trivy scanning fails with Unable to find image locally

[orfeas-k]

Bug Description

Scanning ROCKs with the trivy action fails with. The scanning is implemented in build_scan_and_test_rock.yaml.

Unable to find image 'a3cc5c:b4d78e6ef1dc40bdbdba5798f8e37a81' locally
docker: Error response from daemon: pull access denied for a3cc5c, repository does not exist or may require 'docker login': denied: requested access to the resource is denied.

To Reproduce

Trigger the workflow for a ROCK from this commit

Environment

Github runners

Relevant Log Output

Unable to find image 'a3cc5c:b4d78e6ef1dc40bdbdba5798f8e37a81' locally
docker: Error response from daemon: pull access denied for a3cc5c, repository does not exist or may require 'docker login': denied: requested access to the resource is denied.

Additional Context

No response

[orfeas-k]

Debugging

• The image we built is (here) seldon-core-operator_v1.15.0-22.04-1_amd64:v1.15.0-22.04-1 while later trivy logs Unable to find image 'a3cc5c:b4d78e6ef1dc40bdbdba5798f8e37a81' locally.

• Doing docker image ls inside the runner actually outputs the built image

• Tried scanning the ROCK in tarball mode but the same error was logged.

• Tried installing manually following instuctions for ubuntu inside the workflow and this worked.

• Scanning with trivy action used to work (successful runs here), thus we ran with 0.12.0 which is what we probably had during Oct 20 but same error. Successful runs should have run using this workflow that called this one.

Solution

• The error above is complaining about not finding the trivy image, and not the built rock (trivy runs inside a container).
• On the beginning of the whole workflow, that trivy image is built (here). The trivy action is a custom container action and it always needs its container to be built on every run.
• The easimon/maximize-build-space@v7 action, that runs after the step above, cleans up cached docker images (since we have remove-docker-image=true). One of those images is also the trivy image that the action needs.

Thus, solving this requires to remove the line remove-docker-images: "true" since the default value is false.