From c520d91464933843fe6d06e6d7bae1bab2336074 Mon Sep 17 00:00:00 2001 From: Sumanth Lingappa Date: Wed, 20 Mar 2024 15:58:06 +0530 Subject: [PATCH 1/2] added trivy workflow Signed-off-by: Sumanth Lingappa --- .github/workflows/trivy.yml | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) create mode 100644 .github/workflows/trivy.yml diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml new file mode 100644 index 000000000..a8c92100d --- /dev/null +++ b/.github/workflows/trivy.yml @@ -0,0 +1,28 @@ +--- +name: build +on: + push: + branches: + - main + pull_request: +jobs: + build: + name: Trivy vulnerability scan + runs-on: ubuntu-20.04 + steps: + - name: Checkout code + uses: actions/checkout@v3 + + - name: Run Trivy vulnerability scanner in repo mode + uses: aquasecurity/trivy-action@master + with: + scan-type: "fs" + ignore-unfixed: true + format: "sarif" + output: "trivy-results.sarif" + severity: "CRITICAL" + + - name: Upload Trivy scan results to GitHub Security tab + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: "trivy-results.sarif" From 5e28598ce76d3495b763dc0d74a1d64465ef0696 Mon Sep 17 00:00:00 2001 From: Sumanth Lingappa <42572246+sumanth-lingappa@users.noreply.github.com> Date: Thu, 21 Mar 2024 14:17:14 +0530 Subject: [PATCH 2/2] experimenting with severity option --- .github/workflows/trivy.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml index a8c92100d..a1b321f1c 100644 --- a/.github/workflows/trivy.yml +++ b/.github/workflows/trivy.yml @@ -14,13 +14,13 @@ jobs: uses: actions/checkout@v3 - name: Run Trivy vulnerability scanner in repo mode - uses: aquasecurity/trivy-action@master + uses: aquasecurity/trivy-action@0.18.0 with: scan-type: "fs" ignore-unfixed: true format: "sarif" output: "trivy-results.sarif" - severity: "CRITICAL" + severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL" - name: Upload Trivy scan results to GitHub Security tab uses: github/codeql-action/upload-sarif@v2