feat(deps): automated Remediation Strategy for Trivy-Detected NPM vulnerabilities#257
feat(deps): automated Remediation Strategy for Trivy-Detected NPM vulnerabilities#257piyushsinghgaur1 wants to merge 1 commit intomasterfrom
Conversation
piyushsinghgaur1
force-pushed
the
feat/automation
branch
27 times, most recently
from
4e7d280 to
ed2d6f7
Compare
…nerabilities Automated Remediation Strategy for Trivy-Detected NPM Vulnerabilities
piyushsinghgaur1
force-pushed
the
feat/automation
branch
from
ed2d6f7 to
ae69645
Compare
SonarQube reviewer guideSummary: Add automated security vulnerability remediation via Trivy scanning and npm audit fixes, with a new GitHub Actions workflow to detect and patch HIGH/CRITICAL vulnerabilities. Review Focus:
Start review at:
|
| uses: peter-evans/create-pull-request@v6 | ||
| with: | ||
| branch: security/trivy-remediation | ||
| base: feat/automation |
There was a problem hiding this comment.
should not the base be master
|
|
||
| const installed = findInstalledVersion(name); | ||
|
|
||
| if (installed && semver.gte(installed, fixed)) { |
There was a problem hiding this comment.
for now we are assuming that always a greater version will not have vulnerabilities
might not always be true but its okay for mow
|
|
||
| echo "Step 4: Fix remaining vulnerabilities" | ||
|
|
||
| node scripts/dependency-fix.js |
There was a problem hiding this comment.
what if after one execution, stills there are trivy vulenrabilties left.
3 participants
This pull request introduces an automated workflow for remediating HIGH and CRITICAL vulnerabilities detected by Trivy, along with supporting scripts and configuration changes. The main focus is on integrating Trivy scans with dependency upgrades and lockfile updates, and enabling scheduled or manual remediation via GitHub Actions.
Automated security remediation workflow:
.github/workflows/trivy-remediation.ymlto run a scheduled or manual Trivy scan, remediate vulnerabilities, and create a pull request with fixes.Dependency remediation scripts:
scripts/trivy-remediation.sh, which orchestrates Trivy scanning, npm audit fixes, dependency upgrades, and lockfile updates.scripts/trivy-scan.shfor running Trivy scans and outputting results in JSON format.scripts/audit-remediation.shfor runningnpm audit fixand updating the lockfile.scripts/dependency-fix.jsto programmatically upgrade vulnerable dependencies based on Trivy reports, using safe version upgrades and npm overrides.Configuration updates:
.eslintrc.jsto disable certain TypeScript linting rules for plain Node.js scripts underscripts/.semveras a dev dependency inpackage.jsonfor version comparison and manipulation.