trivy scanning improvements #167
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and Test Docker Image | |
| on: | |
| push: | |
| branches-ignore: | |
| - latest | |
| jobs: | |
| build: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Run Development Pipeline | |
| run: make dev-pipeline | |
| working-directory: . | |
| - name: Cache Trivy DB | |
| uses: actions/cache@v3 | |
| with: | |
| path: ~/.cache/trivy | |
| key: ${{ runner.os }}-trivy-db-${{ github.sha }} | |
| restore-keys: | | |
| ${{ runner.os }}-trivy-db- | |
| - name: Install Trivy | |
| run: | | |
| curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sudo sh -s -- -b /usr/local/bin | |
| - name: Trivy Scanning | |
| run: | | |
| # Disable exit on error for the retry logic | |
| set +e | |
| # Retry logic for Trivy | |
| max_retries=5 | |
| attempt=1 | |
| success=false | |
| while [ $attempt -le $max_retries ]; do | |
| echo "Running Trivy scan, attempt $attempt..." | |
| # Run the Trivy scan and capture the exit status | |
| trivy image --severity CRITICAL --exit-code 1 --quiet udx-worker/udx-worker:latest | tee trivy.log | grep -v 'INFO' | |
| scan_exit_code=$? | |
| # Check for CRITICAL vulnerabilities | |
| if grep -E "Total: [1-9]" trivy.log; then | |
| echo "CRITICAL vulnerabilities detected!" | |
| exit 1 | |
| fi | |
| # Check if Trivy exited with an error | |
| if [ $scan_exit_code -eq 0 ]; then | |
| echo "No CRITICAL vulnerabilities found." | |
| success=true | |
| break | |
| else | |
| echo "Trivy scan failed, retrying in 2 minutes..." | |
| sleep 120 | |
| attempt=$((attempt+1)) | |
| fi | |
| done | |
| # If all retries fail, exit with an error | |
| if [ "$success" = false ]; then | |
| echo "Failed to complete Trivy scan after $max_retries attempts." | |
| exit 1 | |
| fi |