Scan #314
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Scan | |
| on: | |
| schedule: | |
| - cron: "0 7 * * *" | |
| # Allow to run this workflow manually | |
| workflow_dispatch: | |
| env: | |
| CONTAINER_REGISTRY: ghcr.io | |
| CONTAINER_IMAGE_NAME: ${{ github.repository }} | |
| CONTAINER_IMAGE_VERSION: latest | |
| jobs: | |
| # reset-trivy-cache: | |
| # runs-on: ubuntu-latest | |
| # steps: | |
| # # TODO with latest release 0.24.0 there is no environment variable for resetting cache anymore | |
| # # GH issue: https://github.com/aquasecurity/trivy-action/issues/372 | |
| # # | |
| # - name: Remove all caches and database of the trivy scanner | |
| # uses: aquasecurity/trivy-action@f781cce5aab226378ee181d764ab90ea0be3cdd8 # v0.25.0 | |
| # env: | |
| # TRIVY_RESET: true | |
| # TRIVY_DEBUG: true | |
| # with: | |
| # scan-type: "image" | |
| # - name: Download trivy vulnerabilities DB | |
| # uses: aquasecurity/trivy-action@f781cce5aab226378ee181d764ab90ea0be3cdd8 # v0.25.0 | |
| # env: | |
| # TRIVY_DEBUG: true | |
| # TRIVY_DOWNLOAD_DB_ONLY: true | |
| # with: | |
| # scan-type: "image" | |
| vulnerability-scan-backend: | |
| runs-on: ubuntu-latest | |
| # needs: reset-trivy-cache | |
| strategy: | |
| matrix: | |
| container-name: | |
| [ | |
| "${{ github.repository }}", | |
| "${{ github.repository }}-app", | |
| "${{ github.repository }}-content", | |
| ] | |
| permissions: | |
| contents: read | |
| id-token: write # for cosign w/ keyless signing | |
| packages: write # for updating cosign attestation | |
| security-events: write | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # v0.29.0 | |
| env: | |
| TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db | |
| with: | |
| image-ref: ${{ env.CONTAINER_REGISTRY }}/${{ matrix.container-name }}:${{ env.CONTAINER_IMAGE_VERSION }} | |
| format: "sarif" | |
| output: "trivy-results.sarif" | |
| - name: Check trivy results | |
| run: | | |
| if grep -qE 'HIGH|CRITICAL' trivy-results.sarif; then | |
| echo "Vulnerabilities found:" | |
| jq -r ' | |
| .runs[].results[] | | |
| "Rule ID: \(.ruleId)\n" + | |
| "Package: \(.message.text | split("\n")[0] | ltrimstr("Package: "))\n" + | |
| "Installed Version: \(.message.text | split("\n")[1] | ltrimstr("Installed Version: "))\n" + | |
| "Severity: \(.message.text | split("\n")[2] | ltrimstr("Severity: "))\n" + | |
| "\(.message.text | split("\n")[4] | ltrimstr("Link: "))\n" | |
| ' trivy-results.sarif | |
| # Exit with error status | |
| exit 1 | |
| else | |
| echo "No significant vulnerabilities found" | |
| exit 0 | |
| fi | |
| - name: Upload Trivy scan results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@v3 | |
| if: ${{ always() && github.ref == 'refs/heads/main' }} # Bypass non-zero exit code.. | |
| with: | |
| sarif_file: "trivy-results.sarif" | |
| - name: Generate cosign vulnerability scan record | |
| uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # v0.29.0 | |
| env: | |
| TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db | |
| with: | |
| image-ref: ${{ env.CONTAINER_REGISTRY }}/${{ matrix.container-name }}:${{ env.CONTAINER_IMAGE_VERSION }} | |
| format: "cosign-vuln" | |
| output: "vulnerabilities.json" | |
| - name: Install cosign | |
| uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0 | |
| - name: Log into container registry | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.CONTAINER_REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Pull latest docker image | |
| run: docker pull ghcr.io/digitalservicebund/a2j-rechtsantragstelle:latest | |
| - name: Get Docker image digest | |
| id: get_docker_digest | |
| run: | | |
| digest=$(docker inspect --format='{{ index .RepoDigests 0 }}' ghcr.io/digitalservicebund/a2j-rechtsantragstelle:latest) | |
| echo "::set-output name=digest::$digest" | |
| - name: Print Docker image digest | |
| run: echo "Image latest digest is ${{ steps.get_docker_digest.outputs.digest }}\n" | |
| - name: Set up environment | |
| run: echo "IMAGE_DIGEST=${{ steps.get_docker_digest.outputs.digest }}" >> $GITHUB_ENV | |
| - name: Attest vulnerability scan | |
| run: cosign attest --yes --replace --predicate vulnerabilities.json --type vuln $IMAGE_DIGEST |