Skip to content

Add research-vuln-scan workflow #35

Add research-vuln-scan workflow

Add research-vuln-scan workflow #35

name: trivy & grype & sarif & docker scout vulnerability scan
on:
push:
branches: [ "main" ]
pull_request:
# The branches below must be a subset of the branches above
branches: [ "main" ]
permissions:
contents: read
jobs:
trivy:
permissions:
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
name: Trivy
runs-on: self-hosted-generic
steps:
- name: Checkout code
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@7b7aa264d83dc58691451798b4d117d53d21edfe
with:
image-ref: '${{ vars.GREENBONE_REGISTRY }}/opensight/opensight-postgres:16'
format: 'template'
template: '@/contrib/sarif.tpl'
output: 'trivy-results.sarif'
severity: 'MEDIUM,HIGH,CRITICAL'
github-pat: ${{ secrets.GITHUB_TOKEN }} # or ${{ secrets.github_pat_name }} if you're using a PAT
env:
TRIVY_USERNAME: ${{ secrets.GREENBONE_REGISTRY_READ_USER }}
TRIVY_PASSWORD: ${{ secrets.GREENBONE_REGISTRY_READ_TOKEN }}
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@ea9e4e37992a54ee68a9622e985e60c8e8f12d9f # v3.27.4
with:
sarif_file: 'trivy-results.sarif'
category: ${{ github.jobs[github.job].name }}
grype:
permissions:
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
name: Grype
runs-on: self-hosted-generic
steps:
- name: Checkout code
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Login to Greenbone Product container registry
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 #v3.3.0
with:
registry: ${{ vars.GREENBONE_REGISTRY }}
username: ${{ secrets.GREENBONE_REGISTRY_READ_USER }}
password: ${{ secrets.GREENBONE_REGISTRY_READ_TOKEN }}
- name: Run the Anchore Grype scan action
uses: anchore/scan-action@d5aa5b6cb9414b0c7771438046ff5bcfa2854ed7
id: grype
with:
image: '${{ vars.GREENBONE_REGISTRY }}/opensight/opensight-postgres:16'
fail-build: false
severity-cutoff: medium
- name: Upload grype vulnerability report
uses: github/codeql-action/upload-sarif@ea9e4e37992a54ee68a9622e985e60c8e8f12d9f # v3.27.4
with:
sarif_file: ${{ steps.grype.outputs.sarif }}
category: ${{ github.jobs[github.job].name }}
docker-scout:
permissions:
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
pull-requests: write
name: "Docker Scout"
runs-on: self-hosted-generic
steps:
- name: Checkout code
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Login to Greenbone Product container registry
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 #v3.3.0
with:
registry: ${{ vars.GREENBONE_REGISTRY }}
username: ${{ secrets.GREENBONE_REGISTRY_READ_USER }}
password: ${{ secrets.GREENBONE_REGISTRY_READ_TOKEN }}
- name: Analyze for critical and high CVEs
id: docker-scout-cves
if: ${{ github.event_name != 'pull_request_target' }}
uses: docker/scout-action@v1
with:
command: cves
image: '${{ vars.GREENBONE_REGISTRY }}/opensight/opensight-postgres:16'
sarif-file: sarif.output.json
summary: true
dockerhub-user: ${{ secrets.DOCKERHUB_USERNAME }}
dockerhub-password: ${{ secrets.DOCKERHUB_TOKEN }}
only-severities: critical, high, medium
- name: Upload docker scout SARIF result
id: upload-sarif
if: ${{ github.event_name != 'pull_request_target' }}
uses: github/codeql-action/upload-sarif@ea9e4e37992a54ee68a9622e985e60c8e8f12d9f # v3.27.4
with:
sarif_file: sarif.output.json
category: ${{ github.jobs[github.job].name }}