Merge pull request #7 from nikpivkin/outdated-rego-upd

chore: restore outdated-api-update workflow

.github/workflows/outdated-api-update.yaml

@@ -0,0 +1,37 @@
+name: update outdated-api policy
+on:
+  workflow_dispatch: {}
+  schedule:
+    - cron: "0 0 * * 0" # Sunday midnight
+permissions:
+  contents: write
+
+jobs:
+  outdated:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+        with:
+          token: ${{ secrets.AUTO_COMMIT_TOKEN }}
+      - name: Fetch outdated API data from trivy-db-data repo
+        id: outdatedapi
+        uses: fjogeleit/http-request-action@v1
+        with:
+          url: "https://raw.githubusercontent.com/aquasecurity/trivy-db-data/main/k8s/api/k8s-outdated-api.json"
+          method: "GET"
+      - name: embed outdatedapi-data with in dynamic rego policy
+        env:
+          OUTDATE_API_DATA: ${{ toJson(steps.outdatedapi.outputs.response) }}
+        run: |
+          make outdated-api-updated
+      - name: Setup OPA
+        uses: ./.github/actions/setup-opa
+      - name: OPA Format
+        run: |
+          opa fmt -w . | grep -v vendor || true
+      - name: commit and push updated outdated-api policy when changes found
+        uses: stefanzweifel/git-auto-commit-action@v4
+        with:
+          commit_message: Update outdated-api policy data
+          push_options: --force

Makefile

@@ -1,3 +1,5 @@
+DYNAMIC_REGO_FOLDER=./rules/kubernetes/policies/dynamic
+
 .PHONY: schema
 schema:
 	go run ./cmd/schema generate
@@ -32,3 +34,6 @@ docs-test:
 .PHONY: id
 id:
 	@go run ./cmd/id
+
+outdated-api-updated:
+	sed -i.bak "s|recommendedVersions :=.*|recommendedVersions := $(OUTDATE_API_DATA)|" $(DYNAMIC_REGO_FOLDER)/outdated_api.rego && rm $(DYNAMIC_REGO_FOLDER)/outdated_api.rego.bak