Skip to content

feat(code-scanning): Update Trivy starter workflows #2872

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

simar7
Copy link

@simar7 simar7 commented May 14, 2025

Description

This PR updates the Trivy workflows to the latest recommended workflow examples. Also deprecates the tfsec workflow as we've integrated its functionality into Trivy.

Signed-off-by: Simar [email protected]

Pre-requisites

  • Prior to submitting a new workflow, please apply to join the GitHub Technology Partner Program: partner.github.com/apply.

Please note that at this time we are only accepting new starter workflows for Code Scanning. Updates to existing starter workflows are fine.


Tasks

For all workflows, the workflow:

  • Should be contained in a .yml file with the language or platform as its filename, in lower, kebab-cased format (for example, docker-image.yml). Special characters should be removed or replaced with words as appropriate (for example, "dotnet" instead of ".NET").
  • Should use sentence case for the names of workflows and steps (for example, "Run tests").
  • Should be named only by the name of the language or platform (for example, "Go", not "Go CI" or "Go Build").
  • Should include comments in the workflow for any parts that are not obvious or could use clarification.
  • Should specify least privileged permissions for GITHUB_TOKEN so that the workflow runs successfully.

For CI workflows, the workflow:

  • Should be preserved under the ci directory.
  • Should include a matching ci/properties/*.properties.json file (for example, ci/properties/docker-publish.properties.json).
  • Should run on push to branches: [ $default-branch ] and pull_request to branches: [ $default-branch ].
  • Packaging workflows should run on release with types: [ created ].
  • Publishing workflows should have a filename that is the name of the language or platform, in lower case, followed by "-publish" (for example, docker-publish.yml).

For Code Scanning workflows, the workflow:

  • Should be preserved under the code-scanning directory.
  • Should include a matching code-scanning/properties/*.properties.json file (for example, code-scanning/properties/codeql.properties.json), with properties set as follows:
    • name: Name of the Code Scanning integration.
    • creator: Name of the organization/user producing the Code Scanning integration.
    • description: Short description of the Code Scanning integration.
    • categories: Array of languages supported by the Code Scanning integration.
    • iconName: Name of the SVG logo representing the Code Scanning integration. This SVG logo must be present in the icons directory.
  • Should run on push to branches: [ $default-branch, $protected-branches ] and pull_request to branches: [ $default-branch ]. We also recommend a schedule trigger of cron: $cron-weekly (for example, codeql.yml).

Some general notes:

  • This workflow must only use actions that are produced by GitHub, in the actions organization, or
  • This workflow must only use actions that are produced by the language or ecosystem that the workflow supports. These actions must be published to the GitHub Marketplace. We require that these actions be referenced using the full 40 character hash of the action's commit instead of a tag. Additionally, workflows must include the following comment at the top of the workflow file:
    # This workflow uses actions that are not certified by GitHub.
    # They are provided by a third-party and are governed by
    # separate terms of service, privacy policy, and support
    # documentation.
    
  • Automation and CI workflows should not send data to any 3rd party service except for the purposes of installing dependencies.
  • Automation and CI workflows cannot be dependent on a paid service or product.

@Copilot Copilot AI review requested due to automatic review settings May 14, 2025 04:00
@simar7 simar7 requested review from a team as code owners May 14, 2025 04:00
@github-actions github-actions bot added the code-scanning Related to workflows that show on the Code Scanning setup page label May 14, 2025
Copy link

@Copilot Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR updates the Trivy starter workflows for Code Scanning by introducing a new repository vulnerability scan workflow, updating the IaC scan workflow to the latest recommended examples, and deprecating the tfsec workflow.

  • Adds code-scanning/trivy-vulnerability-scan.yml for repo vulnerability scanning.
  • Updates code-scanning/trivy-iac-scan.yml with a more descriptive name, explicit OS version, and revised Trivy action version.
  • Removes the deprecated tfsec.yml workflow.

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File Description
code-scanning/trivy-vulnerability-scan.yml New workflow for running Trivy vulnerability scans in repository (fs) mode.
code-scanning/trivy-iac-scan.yml Updated workflow for running Trivy IaC scans with revised parameters and OS version.
code-scanning/tfsec.yml Deprecated tfsec workflow has been removed.
Comments suppressed due to low confidence (2)

code-scanning/trivy-iac-scan.yml:6

  • [nitpick] Consider verifying that including 'IaC' in the workflow name aligns with our naming convention, which generally uses only the language or platform name.
name: Trivy IaC Scan

code-scanning/trivy-iac-scan.yml:33

  • Ensure that version 0.30.0 of the Trivy action has been fully verified with these workflow settings, as the action behavior and supported flags may have changed from previous versions.
uses: aquasecurity/[email protected]

@simar7 simar7 requested a review from jsoref May 15, 2025 03:21
@simar7
Copy link
Author

simar7 commented May 21, 2025

@DanRigby I'm not sure whose the right person to ask but is it possible if we could approve and merge this if it looks good to the team?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
code-scanning Related to workflows that show on the Code Scanning setup page
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants