security.yml

name: Vulnerability Scanning with Trivy
on:
  workflow_dispatch:
  schedule:
    - cron: '0 0 * * *'  # Test Trivy daily at midnight

permissions:
  contents: read
  security-events: write # for uploading SARIF results to the security tab

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
  cancel-in-progress: true

defaults:
  run:
    shell: bash

jobs:
  trivy-repo:
    name: Trivy vulnerability scanner - Repository
    runs-on: ubuntu-22.04
    if: ${{ ( github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' ) && github.ref_name == 'main' && github.repository == 'canonical/lxd' }}
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: main

      # We are using the deb package instead of the trivy action because we need to point to the cache directory
      # with cache-dir, and there is currently a bug in that functionality on the Trivy GitHub action.
      # See https://github.com/aquasecurity/trivy-action/issues/12.
      - name: Install Trivy
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          mkdir -p /home/runner/vuln-cache
          sudo apt-get install wget apt-transport-https gnupg
          wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | sudo tee /usr/share/keyrings/trivy.gpg > /dev/null
          echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb generic main" | sudo tee -a /etc/apt/sources.list.d/trivy.list
          sudo apt-get update
          sudo apt-get install trivy

      - name: Run Trivy vulnerability scanner
        run: |
          trivy fs --quiet --scanners vuln,secret,misconfig --format sarif --cache-dir /home/runner/vuln-cache \
          --severity LOW,MEDIUM,HIGH,CRITICAL --output trivy-lxd-repo-scan-results.sarif .

      - name: Cache Trivy vulnerability database
        uses: actions/cache/save@v4
        with:
          path: /home/runner/vuln-cache
          key: trivy-cache-${{ github.run_id }}

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: "trivy-lxd-repo-scan-results.sarif"
          sha: ${{ github.sha }}
          ref: refs/heads/main

  trivy-snap:
    name: Trivy vulnerability scanner - Snap
    runs-on: ubuntu-22.04
    needs: trivy-repo
    if: ${{ ( github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' ) && github.ref_name == 'main' && github.repository == 'canonical/lxd' }}
    strategy:
      matrix:
        version:
          - "latest"
          - "5.21"
          - "5.0"
          - "4.0"
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          ref: ${{ (matrix.version == 'latest' && 'main') || format('stable-{0}', matrix.version) }}

      - name: Install Trivy
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          sudo apt-get install wget apt-transport-https gnupg
          wget -qO - https://aquasecurity.github.io/trivy-repo/deb/public.key | gpg --dearmor | sudo tee /usr/share/keyrings/trivy.gpg > /dev/null
          echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://aquasecurity.github.io/trivy-repo/deb generic main" | sudo tee -a /etc/apt/sources.list.d/trivy.list
          sudo apt-get update
          sudo apt-get install trivy

      - name: Restore cached Trivy vulnerability database
        uses: actions/cache/restore@v4
        with:
          path: /home/runner/vuln-cache
          key: trivy-cache-${{ github.run_id }}

      - name: Download snap for scan
        run: |
          snap download lxd --channel=${{ matrix.version }}/stable
          unsquashfs ./lxd*.snap

      - name: Run Trivy vulnerability scanner
        run: |
          trivy rootfs --quiet --scanners vuln,secret,misconfig --format sarif --cache-dir /home/runner/vuln-cache \
          --severity LOW,MEDIUM,HIGH,CRITICAL --output ${{ matrix.version }}-stable.sarif squashfs-root

      - name: Flag snap scanning alerts
        run: |
          jq '.runs[].tool.driver.rules[] |= (.shortDescription.text |= "Snap scan - " + .)' ${{ matrix.version }}-stable.sarif > tmp.json
          mv tmp.json ${{ matrix.version }}-stable.sarif

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: "${{ matrix.version }}-stable.sarif"
          sha: ${{ github.sha }}
          ref: refs/heads/${{ (matrix.version == 'latest' && 'main') || format('stable-{0}', matrix.version) }}