ocurity / dracon

Security scanning & static analysis tool - forked and rewritten from @thought-machine/dracon
https://smithy.security
Apache License 2.0
73 stars 12 forks source link

Env variables for scan tags/id/start_time are not added to producers #180

Closed ptzianos closed 4 months ago

ptzianos commented 4 months ago

Tekton is the gift that keeps on giving. In our local test environment we are using Tekton v0.44.0. Turns out that this version of Tekton is looser when it comes to parameter validation because it fails to see that we are setting the parameters for the dracon-scan-id, dracon-scan-tags and dracon-scan-start-time but these parameters are not present in any of the producer Tasks packages in our Helm packages. However, Tekton v0.40.0, which is the version we use in some of our private test environments can identify this issue. This doesn't prevent our Tasks from running (which should be investigated separately too).

We should add the expected parameters to the Producer Tasks and we should regenerate our Helm packages, consolidate the code that processes each Task so that it can be re-used in Tekton Orchestrator which could deploy Tasks too and add tests that explicitly check this.