Skip to content

Commit

Permalink
chore(ci): remove trivy cache cleaning
Browse files Browse the repository at this point in the history
The updated trivy-action does not support cleaning the cache.
  • Loading branch information
kaibernhard committed Aug 20, 2024
1 parent 0ee91a8 commit 28296a7
Showing 1 changed file with 2 additions and 27 deletions.
29 changes: 2 additions & 27 deletions .github/workflows/scan.yml
Original file line number Diff line number Diff line change
Expand Up @@ -12,33 +12,8 @@ env:
CONTAINER_IMAGE_VERSION: ${{ github.sha }}

jobs:
reset-trivy-cache:
runs-on: ubuntu-latest
steps:
- name: Remove all caches and database of the trivy scanner
uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8
env:
TRIVY_RESET: true
TRIVY_DEBUG: true
with:
scan-type: "image"
- name: Download trivy vulnerabilities DB
uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8
env:
TRIVY_DEBUG: true
TRIVY_DOWNLOAD_DB_ONLY: true
with:
scan-type: "image"
- name: Download trivy Java index DB
uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8
env:
TRIVY_DEBUG: true
TRIVY_DOWNLOAD_JAVA_DB_ONLY: true
with:
scan-type: "image"
vulnerability-scan:
runs-on: ubuntu-latest
needs: reset-trivy-cache
permissions:
contents: read
id-token: write # for cosign w/ keyless signing
Expand All @@ -53,7 +28,7 @@ jobs:
env:
TRIVY_USERNAME: ${{ github.actor }}
TRIVY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
TRIVY_DEBUG: true
TRIVY_OFFLINE_SCAN: true
with:
image-ref: ${{ env.CONTAINER_REGISTRY }}/${{ env.CONTAINER_IMAGE_NAME }}:${{ env.CONTAINER_IMAGE_VERSION }}
format: "sarif"
Expand All @@ -79,7 +54,7 @@ jobs:
env:
TRIVY_USERNAME: ${{ github.actor }}
TRIVY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
TRIVY_DEBUG: true
TRIVY_OFFLINE_SCAN: true
with:
image-ref: ${{ env.CONTAINER_REGISTRY }}/${{ env.CONTAINER_IMAGE_NAME }}:${{ env.CONTAINER_IMAGE_VERSION }}
format: "cosign-vuln"
Expand Down

0 comments on commit 28296a7

Please sign in to comment.