From 6866a4a4b644811e5cd3bd2107239f2208d3fec4 Mon Sep 17 00:00:00 2001
From: Pat Ledgerwood <32804494+vexingly@users.noreply.github.com>
Date: Fri, 8 Nov 2024 15:39:25 +0000
Subject: [PATCH] feat: update trivy in publish workflow (#131)
---
.github/workflows/publish.yml | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 413219d..9b43d98 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -32,9 +32,12 @@ jobs:
run: echo "::set-output name=matrix::{\"image\":[$(ls -d */ | sed 's~\(.*\)/$~\"\1\"~g' | paste -sd ',')]}"
build:
env:
- TRIVY_VERSION: "v0.43.1"
+ TRIVY_VERSION: "v0.57.0"
HADOLINT_VERSION: "2.12.0"
OPENMPP_VERSION: "1.17.5"
+ TRIVY_DB_REPOSITORY: "public.ecr.aws/aquasecurity/trivy-db,aquasec/trivy-db,ghcr.io/aquasecurity/trivy-db"
+ TRIVY_JAVA_DB_REPOSITORY: "public.ecr.aws/aquasecurity/trivy-java-db,aquasec/trivy-java-db,ghcr.io/aquasecurity/trivy-java-db"
+ TRIVY_DISABLE_VEX_NOTICE: true
needs: listimages
strategy:
fail-fast: false
@@ -66,7 +69,7 @@ jobs:
run: |
printf ${{ secrets.CVE_ALLOWLIST }} > .trivyignore
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin ${{ env.TRIVY_VERSION }}
- trivy image localhost:5000/${{ matrix.image }}:${{ github.sha }} --exit-code 1 --timeout=20m --security-checks vuln --severity CRITICAL
+ trivy image localhost:5000/${{ matrix.image }}:${{ github.sha }} --exit-code 1 --timeout=20m --scanners vuln --severity CRITICAL
# Run Hadolint
- name: Run Hadolint