Vulnerability Scanning with Trivy #9
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Vulnerability Scanning with Trivy | |
| on: | |
| workflow_dispatch: | |
| schedule: | |
| - cron: '0 0 * * *' # Test Trivy daily at midnight | |
| permissions: | |
| contents: read | |
| security-events: write # for uploading SARIF results to the security tab | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }} | |
| cancel-in-progress: true | |
| defaults: | |
| run: | |
| shell: bash | |
| jobs: | |
| update-vulnerability-database: | |
| name: Trivy - Update cached database | |
| runs-on: ubuntu-22.04 | |
| steps: | |
| - name: Install Trivy | |
| uses: canonical/lxd/.github/actions/install-trivy@main | |
| - name: Download Trivy DB | |
| id: db_download | |
| run: trivy fs --download-db-only --cache-dir /home/runner/vuln-cache | |
| continue-on-error: true | |
| - name: Cache Trivy vulnerability database | |
| if: ${{ steps.db_download.outcome == 'success' }} | |
| uses: actions/cache/save@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0 | |
| with: | |
| path: /home/runner/vuln-cache | |
| key: trivy-cache-${{ github.run_id }} | |
| trivy-repo: | |
| name: Trivy - Repository | |
| runs-on: ubuntu-22.04 | |
| needs: update-vulnerability-database | |
| strategy: | |
| matrix: | |
| version: | |
| - v3 | |
| - v2 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| with: | |
| ref: ${{ matrix.version }} | |
| - name: Install Trivy | |
| uses: canonical/lxd/.github/actions/install-trivy@main | |
| - name: Use previously downloaded database | |
| uses: actions/cache/restore@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0 | |
| with: | |
| path: /home/runner/vuln-cache | |
| key: trivy-cache-${{ github.run_id }} | |
| restore-keys: | | |
| trivy-cache- | |
| - name: Run Trivy vulnerability scanner | |
| run: | | |
| trivy fs --skip-db-update \ | |
| --scanners vuln,secret,misconfig \ | |
| --format sarif \ | |
| --cache-dir /home/runner/vuln-cache \ | |
| --severity LOW,MEDIUM,HIGH,CRITICAL \ | |
| --output trivy-microcluster-repo-scan-results.sarif . | |
| - name: Upload Trivy scan results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@4f3212b61783c3c68e8309a0f18a699764811cda # v3.27.1 | |
| with: | |
| sarif_file: "trivy-microcluster-repo-scan-results.sarif" | |
| sha: ${{ github.sha }} | |
| ref: refs/heads/${{ matrix.version }} |