Scan #109
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Scan | |
| on: | |
| schedule: | |
| - cron: "0 6 * * *" # Every day at 8am | |
| # Allow to run this workflow manually | |
| workflow_dispatch: | |
| workflow_call: | |
| env: | |
| CONTAINER_REGISTRY: ghcr.io | |
| CONTAINER_IMAGE_NAME: ${{ github.repository }} | |
| CONTAINER_IMAGE_VERSION: latest | |
| jobs: | |
| vulnerability-scan: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: read | |
| security-events: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Validate github workflow files to have pinned versions | |
| uses: digitalservicebund/github-actions-linter@09783a3d4e13424bc0caf1f7145f68bc6138688b # v0.1.11 | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # v0.29.0 | |
| env: | |
| TRIVY_USERNAME: ${{ github.actor }} | |
| TRIVY_PASSWORD: ${{ secrets.GITHUB_TOKEN }} | |
| # Specify multiple registries: try default GitHub registry, if too many requests, use the aws mirror. | |
| TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db | |
| with: | |
| image-ref: ${{ env.CONTAINER_REGISTRY }}/${{ env.CONTAINER_IMAGE_NAME }}:${{ env.CONTAINER_IMAGE_VERSION }} | |
| format: "sarif" | |
| # By default SARIF format enforces output of all vulnerabilities regardless of configured severities. | |
| # To override this set limit-severities-for-sarif to true. | |
| limit-severities-for-sarif: true | |
| output: "trivy-results.sarif" | |
| severity: "CRITICAL,HIGH" | |
| - name: Check trivy results | |
| run: | | |
| if grep -qE 'HIGH|CRITICAL' trivy-results.sarif; then | |
| echo "Vulnerabilities found:" | |
| jq -r ' | |
| .runs[].results[] | | |
| "Rule ID: \(.ruleId)\n" + | |
| "Package: \(.message.text | split("\n")[0] | ltrimstr("Package: "))\n" + | |
| "Installed Version: \(.message.text | split("\n")[1] | ltrimstr("Installed Version: "))\n" + | |
| "Severity: \(.message.text | split("\n")[2] | ltrimstr("Severity: "))\n" + | |
| "\(.message.text | split("\n")[4] | ltrimstr("Link: "))\n" | |
| ' trivy-results.sarif | |
| # Exit with error status | |
| exit 1 | |
| else | |
| echo "No significant vulnerabilities found" | |
| exit 0 | |
| fi | |
| - name: Upload Trivy scan results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@b6a472f63d85b9c78a3ac5e89422239fc15e9b3c # v3.28.1 | |
| if: always() # Bypass non-zero exit code.. | |
| with: | |
| sarif_file: "trivy-results.sarif" | |
| - name: Send status to Slack | |
| uses: digitalservicebund/notify-on-failure-gha@814d0c4b2ad6a3443e89c991f8657b10126510bf # v1.5.0 | |
| if: ${{ failure() }} | |
| with: | |
| SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} |