security.yml

name: Vulnerability Scanning with Trivy
on:
  workflow_dispatch:
  schedule:
    - cron: '0 0 * * *'  # Test Trivy daily at midnight

permissions:
  contents: read
  security-events: write # for uploading SARIF results to the security tab

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
  cancel-in-progress: true

defaults:
  run:
    shell: bash

jobs:
  trivy-repo:
    name: Trivy - Repository
    runs-on: ubuntu-22.04
    if: ${{ ( github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' ) && github.ref_name == 'main' && github.repository == 'canonical/lxd' }}
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          ref: main

      - name: Install Trivy
        uses: ./.github/actions/install-trivy

      - name: Download Trivy DB
        id: db_download
        run: trivy fs --download-db-only --cache-dir /home/runner/vuln-cache
        continue-on-error: true

      - name: Use previously downloaded database
        if: ${{ steps.db_download.outcome == 'failure' }}
        uses: actions/cache/restore@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
        with:
          path: /home/runner/vuln-cache
          key: download-failed # Use a non existing key to fallback to restore-keys
          restore-keys: |
            trivy-cache-

      - name: Run Trivy vulnerability scanner
        run: |
          trivy fs --skip-db-update \
          --scanners vuln,secret,misconfig \
          --format sarif \
          --cache-dir /home/runner/vuln-cache \
          --severity LOW,MEDIUM,HIGH,CRITICAL \
          --output trivy-lxd-repo-scan-results.sarif .

      - name: Cache Trivy vulnerability database
        uses: actions/cache/save@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
        with:
          path: /home/runner/vuln-cache
          key: trivy-cache-${{ github.run_id }}

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3.27.5
        with:
          sarif_file: "trivy-lxd-repo-scan-results.sarif"
          sha: ${{ github.sha }}
          ref: refs/heads/main

  trivy-snap:
    name: Trivy - Snap
    runs-on: ubuntu-22.04
    needs: trivy-repo
    if: ${{ ( github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' ) && github.ref_name == 'main' && github.repository == 'canonical/lxd' }}
    strategy:
      matrix:
        version:
          - "latest"
          - "5.21"
          - "5.0"
          - "4.0"
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Install Trivy
        uses: ./.github/actions/install-trivy

      - name: Restore cached Trivy vulnerability database
        uses: actions/cache/restore@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
        with:
          path: /home/runner/vuln-cache
          key: download-failed # Use a non existing key to fallback to restore-keys
          restore-keys: |
            trivy-cache-

      - name: Download snap for scan
        run: |
          snap download lxd --channel=${{ matrix.version }}/stable
          unsquashfs ./lxd*.snap

      - name: Run Trivy vulnerability scanner
        run: |
          trivy rootfs --skip-db-update \
          --scanners vuln,secret,misconfig \
          --format sarif \
          --cache-dir /home/runner/vuln-cache \
          --severity LOW,MEDIUM,HIGH,CRITICAL \
          --output /home/runner/${{ matrix.version }}-stable.sarif squashfs-root

      - name: Flag snap scanning alerts
        run: |
          cd /home/runner
          jq '.runs[].tool.driver.rules[] |= (.shortDescription.text |= "Snap scan - " + .)' ${{ matrix.version }}-stable.sarif > tmp.json
          mv tmp.json ${{ matrix.version }}-stable.sarif

      # Now we checkout to the branch related to the scanned snap to populate github.sha appropriately.
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          ref: ${{ (matrix.version == 'latest' && 'main') || format('stable-{0}', matrix.version) }}

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3.27.5
        with:
          sarif_file: /home/runner/${{ matrix.version }}-stable.sarif
          sha: ${{ github.sha }}
          ref: refs/heads/${{ (matrix.version == 'latest' && 'main') || format('stable-{0}', matrix.version) }}