Skip to content

Commit fa28655

Browse files
jnschaefferjnschaeffer
authoredApr 12, 2023
Use Trivy more effectively (#68)
* Use Trivy more effectively The current image scanning workflow leads to Trivy scans being run twice because the test action is run on both PRs and pushes to main. To rectify this, a new security action has been added in this commit that only runs on PRs to scan both the permissions-api Git repository and Docker image. Additionally, repo scanning has been added to the image-build action and a typo in the image tag to be scanned has been fixed. Signed-off-by: John Schaeffer <jschaeffer@equinix.com> * Set exit code for Trivy jobs since they seem to run now Signed-off-by: John Schaeffer <jschaeffer@equinix.com> * Fix Trivy findings in dev container Dockerfile Signed-off-by: John Schaeffer <jschaeffer@equinix.com> * Disable config scanner until it gets more better Signed-off-by: John Schaeffer <jschaeffer@equinix.com> * Adjust whitespace in dev container Dockerfile Signed-off-by: John Schaeffer <jschaeffer@equinix.com> --------- Signed-off-by: John Schaeffer <jschaeffer@equinix.com>
1 parent a4b55d3 commit fa28655

File tree

4 files changed

+87
-17
lines changed

4 files changed

+87
-17
lines changed
 

‎.devcontainer/Dockerfile

+4-4
Original file line numberDiff line numberDiff line change
@@ -7,19 +7,19 @@ ARG NODE_VERSION="none"
77
RUN if [ "${NODE_VERSION}" != "none" ]; then su vscode -c "umask 0002 && . /usr/local/share/nvm/nvm.sh && nvm install ${NODE_VERSION} 2>&1"; fi
88

99
RUN export DEBIAN_FRONTEND=noninteractive \
10-
&& curl https://baltocdn.com/helm/signing.asc | gpg --dearmor | sudo tee /usr/share/keyrings/helm.gpg \
10+
&& curl https://baltocdn.com/helm/signing.asc | gpg --dearmor | tee /usr/share/keyrings/helm.gpg \
1111
&& curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | gpg --dearmor > /usr/share/keyrings/yarn-archive-keyring.gpg \
1212
&& apt-get install apt-transport-https --yes \
13-
&& echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/helm.gpg] https://baltocdn.com/helm/stable/debian/ all main" | sudo tee /etc/apt/sources.list.d/helm-stable-debian.list \
13+
&& echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/helm.gpg] https://baltocdn.com/helm/stable/debian/ all main" | tee /etc/apt/sources.list.d/helm-stable-debian.list \
1414
&& apt-get update \
15-
&& apt-get -y install --no-install-recommends \
15+
&& apt-get install --yes --no-install-recommends \
1616
bash-completion \
1717
helm \
1818
uuid-runtime
1919

2020
# Install cockroachdb so we have the client
2121
RUN curl https://binaries.cockroachdb.com/cockroach-v22.1.8.linux-amd64.tgz | tar -xz \
22-
&& sudo cp -i cockroach-v22.1.8.linux-amd64/cockroach /usr/local/bin/ \
22+
&& cp -i cockroach-v22.1.8.linux-amd64/cockroach /usr/local/bin/ \
2323
&& rm -rf cockroach-v*
2424

2525
USER vscode

‎.github/workflows/image-build.yaml

+16-4
Original file line numberDiff line numberDiff line change
@@ -15,14 +15,25 @@ jobs:
1515
- name: Checkout
1616
uses: actions/checkout@v3
1717

18+
- name: Scan repo
19+
uses: aquasecurity/trivy-action@master
20+
with:
21+
scan-type: 'fs'
22+
scan-ref: '.'
23+
scanners: 'vuln,secret'
24+
ignore-unfixed: true
25+
severity: 'HIGH,CRITICAL'
26+
format: 'table'
27+
exit-code: '1'
28+
1829
- name: Registry login
1930
uses: docker/login-action@v2
2031
with:
2132
registry: ghcr.io
2233
username: ${{ github.actor }}
2334
password: ${{ secrets.GITHUB_TOKEN }}
2435

25-
- name: Docker metadata
36+
- name: Get Docker metadata
2637
id: metadata
2738
uses: docker/metadata-action@v4
2839
with:
@@ -40,14 +51,15 @@ jobs:
4051
load: true
4152
tags: ${{ steps.metadata.outputs.tags }}
4253

43-
- name: Run Trivy vulnerability scanner
54+
- name: Scan image
4455
uses: aquasecurity/trivy-action@master
4556
with:
46-
image-ref: ghcr.io/infratographer/permissions-api/permissions-api:latest
47-
scanners: 'vuln,config,secret'
57+
image-ref: ghcr.io/infratographer/permissions-api:latest
58+
scanners: 'vuln,secret'
4859
ignore-unfixed: true
4960
severity: 'HIGH,CRITICAL'
5061
format: 'table'
62+
exit-code: '1'
5163

5264
- name: Push
5365
uses: docker/build-push-action@v4

‎.github/workflows/security.yaml

+67
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
name: Trivy Scan
2+
3+
on:
4+
pull_request:
5+
workflow_dispatch:
6+
7+
jobs:
8+
image-scan:
9+
name: image-scan
10+
runs-on: ubuntu-latest
11+
12+
steps:
13+
- name: Checkout
14+
uses: actions/checkout@v3
15+
16+
- name: Registry login
17+
uses: docker/login-action@v2
18+
with:
19+
registry: ghcr.io
20+
username: ${{ github.actor }}
21+
password: ${{ secrets.GITHUB_TOKEN }}
22+
23+
- name: Docker metadata
24+
id: metadata
25+
uses: docker/metadata-action@v4
26+
with:
27+
images: |
28+
ghcr.io/${{ github.repository }}
29+
tags: |
30+
type=sha
31+
32+
- name: Build
33+
uses: docker/build-push-action@v4
34+
with:
35+
context: .
36+
push: false
37+
load: true
38+
tags: ${{ steps.metadata.outputs.tags }}
39+
40+
- name: Scan image
41+
uses: aquasecurity/trivy-action@master
42+
with:
43+
image-ref: ${{ steps.metadata.outputs.tags }}
44+
scanners: 'vuln,secret'
45+
ignore-unfixed: true
46+
severity: 'HIGH,CRITICAL'
47+
format: 'table'
48+
exit-code: '1'
49+
50+
repo-scan:
51+
name: repo-scan
52+
runs-on: ubuntu-latest
53+
54+
steps:
55+
- name: Checkout
56+
uses: actions/checkout@v3
57+
58+
- name: Scan repo
59+
uses: aquasecurity/trivy-action@master
60+
with:
61+
scan-type: 'fs'
62+
scan-ref: '.'
63+
scanners: 'vuln,secret'
64+
ignore-unfixed: true
65+
severity: 'HIGH,CRITICAL'
66+
format: 'table'
67+
exit-code: '1'

‎.github/workflows/test.yaml

-9
Original file line numberDiff line numberDiff line change
@@ -72,12 +72,3 @@ jobs:
7272
push: false
7373
load: true
7474
tags: ${{ steps.metadata.outputs.tags }}
75-
76-
- name: Run Trivy vulnerability scanner
77-
uses: aquasecurity/trivy-action@master
78-
with:
79-
image-ref: ${{ steps.metadata.outputs.tags }}
80-
scanners: 'vuln,config,secret'
81-
ignore-unfixed: true
82-
severity: 'HIGH,CRITICAL'
83-
format: 'table'

0 commit comments

Comments
 (0)