Vulnerability Scanning with Trivy #13
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Vulnerability Scanning with Trivy | |
| on: | |
| workflow_dispatch: | |
| schedule: | |
| - cron: '0 0 * * *' # Test Trivy daily at midnight | |
| permissions: | |
| contents: read | |
| security-events: write # for uploading SARIF results to the security tab | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }} | |
| cancel-in-progress: true | |
| defaults: | |
| run: | |
| shell: bash | |
| jobs: | |
| trivy-repo: | |
| name: Trivy vulnerability scanner - Repository | |
| runs-on: ubuntu-22.04 | |
| if: ${{ ( github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' ) && github.ref_name == 'main' && github.repository == 'canonical/lxd' }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: main | |
| # We are using the deb package instead of the trivy action because we need to point to the cache directory | |
| # with cache-dir, and there is currently a bug in that functionality on the Trivy GitHub action. | |
| # See https://github.com/aquasecurity/trivy-action/issues/12. | |
| - name: Install Trivy | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| mkdir -p /home/runner/vuln-cache | |
| sudo apt-get install wget apt-transport-https gnupg | |
| wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | sudo tee /usr/share/keyrings/trivy.gpg > /dev/null | |
| echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb generic main" | sudo tee -a /etc/apt/sources.list.d/trivy.list | |
| sudo apt-get update | |
| sudo apt-get install trivy | |
| - name: Run Trivy vulnerability scanner | |
| run: | | |
| trivy fs --quiet --scanners vuln,secret,misconfig --format sarif --cache-dir /home/runner/vuln-cache \ | |
| --severity LOW,MEDIUM,HIGH,CRITICAL --output trivy-lxd-repo-scan-results.sarif . | |
| - name: Cache Trivy vulnerability database | |
| uses: actions/cache/save@v4 | |
| with: | |
| path: /home/runner/vuln-cache | |
| key: trivy-cache-${{ github.run_id }} | |
| - name: Upload Trivy scan results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: "trivy-lxd-repo-scan-results.sarif" | |
| sha: ${{ github.sha }} | |
| ref: refs/heads/main | |
| trivy-snap: | |
| name: Trivy vulnerability scanner - Snap | |
| runs-on: ubuntu-22.04 | |
| needs: trivy-repo | |
| if: ${{ ( github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' ) && github.ref_name == 'main' && github.repository == 'canonical/lxd' }} | |
| strategy: | |
| matrix: | |
| version: | |
| - "latest" | |
| - "5.21" | |
| - "5.0" | |
| - "4.0" | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ (matrix.version == 'latest' && 'main') || format('stable-{0}', matrix.version) }} | |
| - name: Install Trivy | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| sudo apt-get install wget apt-transport-https gnupg | |
| wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | sudo tee /usr/share/keyrings/trivy.gpg > /dev/null | |
| echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb generic main" | sudo tee -a /etc/apt/sources.list.d/trivy.list | |
| sudo apt-get update | |
| sudo apt-get install trivy | |
| - name: Restore cached Trivy vulnerability database | |
| uses: actions/cache/restore@v4 | |
| with: | |
| path: /home/runner/vuln-cache | |
| key: trivy-cache-${{ github.run_id }} | |
| - name: Download snap for scan | |
| run: | | |
| snap download lxd --channel=${{ matrix.version }}/stable | |
| unsquashfs ./lxd*.snap | |
| - name: Run Trivy vulnerability scanner | |
| run: | | |
| trivy rootfs --quiet --scanners vuln,secret,misconfig --format sarif --cache-dir /home/runner/vuln-cache \ | |
| --severity LOW,MEDIUM,HIGH,CRITICAL --output ${{ matrix.version }}-stable.sarif squashfs-root | |
| - name: Flag snap scanning alerts | |
| run: | | |
| jq '.runs[].tool.driver.rules[] |= (.shortDescription.text |= "Snap scan - " + .)' ${{ matrix.version }}-stable.sarif > tmp.json | |
| mv tmp.json ${{ matrix.version }}-stable.sarif | |
| - name: Upload Trivy scan results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: "${{ matrix.version }}-stable.sarif" | |
| sha: ${{ github.sha }} | |
| ref: refs/heads/${{ (matrix.version == 'latest' && 'main') || format('stable-{0}', matrix.version) }} |