1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
|
---
name: Trivy
permissions: read-all
on:
workflow_call:
inputs:
output_prefix:
description: 'Prefix to add to output artifacts'
required: false
default: ''
type: string
jobs:
scan:
runs-on: [self-hosted, linux, docker]
steps:
- name: Cleanup workspace
run: sudo rm -rf ..?* .[!.]* *
- name: Checkout PR branch
uses: actions/checkout@v4
with:
path: source
- name: Pull docker image
run: docker pull aquasec/trivy:0.48.3
- name: Create output location
run: |
mkdir artifact
echo "Trivy Report" > artifact/trivy.txt
- name: Scan
run: |
docker run \
-v /var/run/docker.sock:/var/run/docker.sock \
-v $HOME/Library/Caches:/root/.cache/ \
-v $(pwd):/work \
-w /work \
--attach stderr --attach stdout \
aquasec/trivy:0.51.1 \
fs \
--exit-code 1 \
--list-all-pkgs \
. >> artifact/trivy.txt
- name: Scan for SDL Evidence
if: (success() || failure())
run: |
docker run \
-v /var/run/docker.sock:/var/run/docker.sock \
-v $HOME/Library/Caches:/root/.cache/ \
-v $(pwd):/work \
-w /work \
--attach stderr --attach stdout \
aquasec/trivy:0.51.1 \
fs \
--exit-code 1 \
--list-all-pkgs \
--format template \
--template "@/work/source/.github/workflows/trivy/csv.tpl" \
--output artifact/trivy-report.csv \
.
- name: Lint Dockerfiles for SDL Evidence
if: (success() || failure())
run: |
docker run \
-v /var/run/docker.sock:/var/run/docker.sock \
-v $HOME/Library/Caches:/root/.cache/ \
-v $(pwd):/work \
-w /work \
--attach stderr --attach stdout \
aquasec/trivy:0.51.1 \
--ignorefile source/.trivyignore.yaml \
--format table --output artifact/ct248-report.txt \
config source
docker run \
-v /var/run/docker.sock:/var/run/docker.sock \
-v $HOME/Library/Caches:/root/.cache/ \
-v $(pwd):/work \
-w /work \
--attach stderr --attach stdout \
aquasec/trivy:0.51.1 \
--ignorefile source/.trivyignore.yaml \
--format json --output artifact/ct248-report.json \
--exit-code 1 \
config source
- name: Scan for SPDX for SBOM
if: (success() || failure())
run: |
docker run \
-v /var/run/docker.sock:/var/run/docker.sock \
-v $HOME/Library/Caches:/root/.cache/ \
-v $(pwd):/work \
-w /work \
--attach stderr --attach stdout \
aquasec/trivy:0.51.1 \
fs \
--exit-code 1 \
--list-all-pkgs \
--format spdx-json \
--output artifact/trivy-spdx.json \
source
- name: Summarize
if: (failure())
run: |
echo '```' >> $GITHUB_STEP_SUMMARY
cat artifact/ct248-report.txt >> $GITHUB_STEP_SUMMARY
cat artifact/trivy.txt >> $GITHUB_STEP_SUMMARY
echo '```' >> $GITHUB_STEP_SUMMARY
- name: Report
if: (success() || failure())
run: |
cat artifact/trivy.txt
- name: Record Artifacts
uses: actions/upload-artifact@v4
if: (success() || failure())
with:
name: ${{ inputs.output_prefix }}trivy
path: artifact/*
- name: Cleanup workspace
run: sudo rm -rf ..?* .[!.]* *
|
