common-github-actions/.github/workflows/trivy.yml at 36f4063a86c86089278fe1ca1771337e524bfa51 · chef/common-github-actions · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
# trivy.yml
name: Trivy dependency vulnerability scan
# see https://github.com/aquasecurity/trivy-action

on:
  workflow_call:
    inputs:
      outputfilename:
        description: 'Name of the Trivy output file'
        required: false
        type: string
        default: 'trivy-output.json'
      version:
        description: 'Version of the project'
        required: false
        type: string
        default: '1.0.0'
      trivy-fail-on-high:
        description: 'Fail the build if HIGH vulnerabilities are found'
        required: false
        type: boolean
        default: false
      trivy-fail-on-critical:
        description: 'Fail the build if CRITICAL vulnerabilities are found'
        required: false
        type: boolean
        default: false

jobs:
  trivy:
    runs-on: ubuntu-latest
    name: 'Trivy dependency vulnerability scan'
    permissions:
      contents: read
    steps:
      - name: Check out Git repository
        uses: actions/checkout@v6

      - name: Generate Filename Prefix
        run: |
          FILE_PREFIX=$(echo "${{ github.repository }}-${{ github.ref_name }}-${{ inputs.version }}-" | sed 's|/|-|g')-$(date +%Y%m%d%H%M%S)
          echo "FILE_PREFIX=${FILE_PREFIX}" >> $GITHUB_ENV

      # The first call to the action will invoke setup-trivy and install trivy
      - name: Generate Trivy Vulnerability Report (JSON)
        uses: aquasecurity/trivy-action@0.35.0
        env:
          TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
          TRIVY_DISABLE_VEX_NOTICE: true
        with:
          scan-type: "fs"
          output: trivy-report.json
          format: json  # can be json, table, template, cyclonedx, sarif, table, spdx, spdx-json
          scan-ref: '.'
           # On a subsequent call to the action we know trivy is already installed so can skip this
          exit-code: 0

      - name: Upload Vulnerability Scan Results
        uses: actions/upload-artifact@v4
        with:
          name: ${{ env.FILE_PREFIX }}-Trivy.json
          # name: trivy-report-${{ github.event.repository.name }}-${{ github.ref_name }}-${{ inputs.version }}-$(date +'%Y%m%d')-json
          path: trivy-report.json
          retention-days: 30


      - name: Generate Trivy Vulnerability Report (TABLE)
        uses: aquasecurity/trivy-action@0.35.0
        env:
          TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
          TRIVY_DISABLE_VEX_NOTICE: true
        with:
          scan-type: "fs"
          output: trivy-report.txt
          format: table
          scan-ref: '.'
          skip-setup-trivy: true
          exit-code: 0

      - name: Upload Vulnerability Scan Results
        uses: actions/upload-artifact@v4
        with:
          name: ${{ env.FILE_PREFIX }}-Trivy.txt
          # name: trivy-report-${{ github.event.repository.name }}-${{ github.ref_name }}-${{ inputs.version }}-$(date +'%Y%m%d')-text
          path: trivy-report.txt
          retention-days: 30

      - name: Construct Trivy failure severities
        id: failure-severities
        run: |
          SEVERITIES=""

          if [[ "${{ inputs.trivy-fail-on-high }}" == "true" ]]; then
            SEVERITIES="HIGH"
          fi

          if [[ "${{ inputs.trivy-fail-on-critical }}" == "true" ]]; then
            SEVERITIES="${SEVERITIES},CRITICAL"
          fi

          echo "FAILURE_SEVERITIES=${SEVERITIES}" >> $GITHUB_ENV
          echo "Enforcement policy: ${SEVERITIES}"

      - name: Fail build on High/Critical Vulnerabilities
        if: ${{ inputs.trivy-fail-on-high || inputs.trivy-fail-on-critical }}
        uses: aquasecurity/trivy-action@0.35.0
        env:
          TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
          TRIVY_DISABLE_VEX_NOTICE: true
        with:
          scan-type: "fs"
          format: table
          scan-ref: '.'
          severity: ${{ env.FAILURE_SEVERITIES }}
          ignore-unfixed: true
          exit-code: 1
          # On a subsequent call to the action we know trivy is already installed so can skip this
          skip-setup-trivy: true