Trivy security scan #20
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Trivy security scan | |
| on: | |
| schedule: | |
| - cron: '0 4 * * 1' # Every Monday at 04:00 UTC | |
| workflow_dispatch: | |
| env: | |
| IMAGE_NAME: 'web/smartweb/mutual' | |
| REGISTRY_URL: ${{ secrets.HARBOR_URL }} | |
| permissions: | |
| contents: read | |
| security-events: write | |
| jobs: | |
| trivy-fs: | |
| name: Filesystem scan | |
| runs-on: gha-runners-smartweb | |
| outputs: | |
| critical: ${{ steps.trivy.outputs.critical }} | |
| high: ${{ steps.trivy.outputs.high }} | |
| json_file: ${{ steps.trivy.outputs.json_file }} | |
| artifact_name: ${{ steps.trivy.outputs.artifact_name }} | |
| steps: | |
| - id: trivy | |
| uses: IMIO/gha/trivy-scan-notify@v7 | |
| with: | |
| SCAN_TYPE: fs | |
| SCAN_REF: . | |
| EXIT_CODE: '0' | |
| TRIVYIGNORES: '' | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| MATTERMOST_WEBHOOK_URL: ${{ secrets.SMARTWEB_MATTERMOST_WEBHOOK_URL }} | |
| UPLOAD_SARIF: 'true' | |
| IGNORE_UNFIXED: 'false' | |
| build-push: | |
| runs-on: gha-runners-smartweb | |
| steps: | |
| - name: Build tags | |
| run: | | |
| { | |
| echo 'IMAGE_TAGS<<EOF' | |
| echo '${{ env.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:trivy' | |
| echo '${{ env.REGISTRY_URL }}/${{ env.IMAGE_NAME }}:trivy-${{ github.run_number }}' | |
| echo EOF | |
| } >> $GITHUB_ENV | |
| - name: Build push and notify | |
| uses: IMIO/gha/build-push-notify@v7 | |
| with: | |
| IMAGE_NAME: ${{ env.IMAGE_NAME }} | |
| IMAGE_TAGS: ${{ env.IMAGE_TAGS }} | |
| REGISTRY_URL: ${{ env.REGISTRY_URL}} | |
| REGISTRY_USERNAME: ${{ secrets.SMARTWEB_HARBOR_USERNAME }} | |
| REGISTRY_PASSWORD: ${{ secrets.SMARTWEB_HARBOR_PASSWORD }} | |
| MATTERMOST_WEBHOOK_URL: ${{ secrets.SMARTWEB_MATTERMOST_WEBHOOK_URL }} | |
| trivy-image: | |
| name: Image scan | |
| runs-on: gha-runners-smartweb | |
| needs: build-push | |
| outputs: | |
| critical: ${{ steps.trivy.outputs.critical }} | |
| high: ${{ steps.trivy.outputs.high }} | |
| json_file: ${{ steps.trivy.outputs.json_file }} | |
| artifact_name: ${{ steps.trivy.outputs.artifact_name }} | |
| steps: | |
| - id: trivy | |
| uses: IMIO/gha/trivy-scan-notify@v7 | |
| with: | |
| SCAN_TYPE: image | |
| IMAGE_REF: ${{ secrets.HARBOR_URL }}/web/smartweb/mutual:trivy-${{ github.run_number }} | |
| EXIT_CODE: '0' | |
| TRIVYIGNORES: '' | |
| TRIVY_USERNAME: ${{ secrets.SMARTWEB_HARBOR_USERNAME }} | |
| TRIVY_PASSWORD: ${{ secrets.SMARTWEB_HARBOR_PASSWORD }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| MATTERMOST_WEBHOOK_URL: ${{ secrets.SMARTWEB_MATTERMOST_WEBHOOK_URL }} | |
| UPLOAD_SARIF: 'true' | |
| IGNORE_UNFIXED: 'false' | |
| trivy-claude-fs: | |
| name: Claude advisory analysis (fs) | |
| needs: trivy-fs | |
| if: needs.trivy-fs.outputs.critical > 0 || needs.trivy-fs.outputs.high > 0 | |
| environment: security-review | |
| runs-on: gha-runners-smartweb | |
| permissions: | |
| contents: read | |
| steps: | |
| - id: app-token | |
| uses: actions/create-github-app-token@v2 | |
| with: | |
| app-id: ${{ secrets.ADVISORY_APP_ID }} | |
| private-key: ${{ secrets.ADVISORY_APP_SECRET }} | |
| - uses: actions/download-artifact@v4 | |
| with: | |
| name: ${{ needs.trivy-fs.outputs.artifact_name }} | |
| - uses: IMIO/gha/trivy-claude-analysis@v7 | |
| with: | |
| JSON_FILE: ${{ needs.trivy-fs.outputs.json_file }} | |
| SCAN_TYPE: fs | |
| TARGET: . | |
| ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} | |
| GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} | |
| trivy-claude-image: | |
| name: Claude advisory analysis (image) | |
| needs: trivy-image | |
| if: needs.trivy-image.outputs.critical > 0 || needs.trivy-image.outputs.high > 0 | |
| environment: security-review | |
| runs-on: gha-runners-smartweb | |
| permissions: | |
| contents: read | |
| steps: | |
| - id: app-token | |
| uses: actions/create-github-app-token@v2 | |
| with: | |
| app-id: ${{ secrets.ADVISORY_APP_ID }} | |
| private-key: ${{ secrets.ADVISORY_APP_SECRET }} | |
| - uses: actions/download-artifact@v4 | |
| with: | |
| name: ${{ needs.trivy-image.outputs.artifact_name }} | |
| - uses: IMIO/gha/trivy-claude-analysis@v7 | |
| with: | |
| JSON_FILE: ${{ needs.trivy-image.outputs.json_file }} | |
| SCAN_TYPE: image | |
| TARGET: ${{ secrets.HARBOR_URL }}/web/smartweb/mutual:trivy-${{ github.run_number }} | |
| ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }} | |
| GITHUB_TOKEN: ${{ steps.app-token.outputs.token }} |