diff --git a/.github/workflows/scan.yml b/.github/workflows/scan.yml index a684fa4..9a8c78a 100644 --- a/.github/workflows/scan.yml +++ b/.github/workflows/scan.yml @@ -12,33 +12,8 @@ env: CONTAINER_IMAGE_VERSION: ${{ github.sha }} jobs: - reset-trivy-cache: - runs-on: ubuntu-latest - steps: - - name: Remove all caches and database of the trivy scanner - uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8 - env: - TRIVY_RESET: true - TRIVY_DEBUG: true - with: - scan-type: "image" - - name: Download trivy vulnerabilities DB - uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8 - env: - TRIVY_DEBUG: true - TRIVY_DOWNLOAD_DB_ONLY: true - with: - scan-type: "image" - - name: Download trivy Java index DB - uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8 - env: - TRIVY_DEBUG: true - TRIVY_DOWNLOAD_JAVA_DB_ONLY: true - with: - scan-type: "image" vulnerability-scan: runs-on: ubuntu-latest - needs: reset-trivy-cache permissions: contents: read id-token: write # for cosign w/ keyless signing @@ -53,7 +28,7 @@ jobs: env: TRIVY_USERNAME: ${{ github.actor }} TRIVY_PASSWORD: ${{ secrets.GITHUB_TOKEN }} - TRIVY_DEBUG: true + TRIVY_OFFLINE_SCAN: true with: image-ref: ${{ env.CONTAINER_REGISTRY }}/${{ env.CONTAINER_IMAGE_NAME }}:${{ env.CONTAINER_IMAGE_VERSION }} format: "sarif" @@ -79,7 +54,7 @@ jobs: env: TRIVY_USERNAME: ${{ github.actor }} TRIVY_PASSWORD: ${{ secrets.GITHUB_TOKEN }} - TRIVY_DEBUG: true + TRIVY_OFFLINE_SCAN: true with: image-ref: ${{ env.CONTAINER_REGISTRY }}/${{ env.CONTAINER_IMAGE_NAME }}:${{ env.CONTAINER_IMAGE_VERSION }} format: "cosign-vuln"