diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 2656f43..56a5de0 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -49,6 +49,7 @@ jobs: # Scan image for vulnerabilities - name: Aqua Security Trivy image scan run: | + printf ${{ secrets.CVE_ALLOWLIST }} > .trivyignore curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin ${{ env.TRIVY_VERSION }} trivy image localhost:5000/${{ matrix.image }}:${{ github.sha }} --exit-code 1 --timeout=20m --security-checks vuln --severity CRITICAL diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 2f9a2eb..10a56be 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -63,6 +63,7 @@ jobs: # Scan image for vulnerabilities - name: Aqua Security Trivy image scan run: | + printf ${{ secrets.CVE_ALLOWLIST }} > .trivyignore curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin ${{ env.TRIVY_VERSION }} trivy image localhost:5000/${{ matrix.image }}:${{ github.sha }} --exit-code 1 --timeout=20m --security-checks vuln --severity CRITICAL