Skip to content

update: added Trivy CVE scan to service images #1290

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
sho6000 wants to merge 4 commits into
base: master
Choose a base branch
from
+82 −1
Draft

update: added Trivy CVE scan to service images #1290

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
1fba299
trivy CVE scan | knowlg&search-service added
sho6000 Jul 23, 2026
e3e8730
cve scan workflow updated to scan for HIGH and CRITICAL severity vuln…
sho6000 Jul 23, 2026
72f6470
set the severity > CRITICAL only
sho6000 Jul 23, 2026
756d841
renamed the cve scan
sho6000 Jul 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 49 additions & 0 deletions .github/workflows/cve-scan.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,49 @@
# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.
#
# Reusable workflow: scans a single image reference with Trivy and uploads the
# results to the GitHub Security tab. Called by each service's build-and-push
# workflow right after it pushes to ghcr.io, passing the exact image tag that
# was just pushed.

name: Run CVE Scan on Service Images

on:
workflow_call:
inputs:
image:
required: true
type: string

jobs:
scan:
name: trivy Scan
runs-on: ubuntu-latest
permissions:
packages: read
contents: read # Required to checkout and read repo files
security-events: write # Required to upload SARIF files to Security tab
actions: read # Required for upload-sarif to process results on private repos

steps:
- name: Checkout code
uses: actions/checkout@v4

- name: Log in to GHCR
run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
Comment on lines +34 to +35

@coderabbitai coderabbitai Bot Jul 23, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Authenticate against the registry that owns inputs.image.

Both service workflows push to configurable REGISTRY_URL values, but this job only logs into ghcr.io. Scans will fail for Azure, GCP, OCI, or other private registries unless registry-specific credentials are passed to this reusable workflow and used here.

🧰 Tools
🪛 zizmor (1.26.1)

[error] 35-35: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/cve-scan.yml around lines 34 - 35, Update the CVE scan
workflow’s registry login step to authenticate against the registry owning
inputs.image rather than hardcoding ghcr.io. Add the required registry-specific
credential inputs to the reusable workflow and use those inputs with the
configured REGISTRY_URL, preserving the existing docker login flow for all
supported private registries.


- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@7b7aa264d83dc58691451798b4d117d53d21edfe
with:
image-ref: ${{ inputs.image }}
format: 'sarif'
output: 'trivy-results.sarif'
severity: CRITICAL

- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v4
with:
sarif_file: 'trivy-results.sarif'

16 changes: 16 additions & 0 deletions .github/workflows/knowlg-service.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,8 @@ jobs:
needs: check-config
if: needs.check-config.outputs.should_build == 'true'
runs-on: ubuntu-latest
outputs:
image: ${{ steps.push.outputs.image }}

# CSP (cloud service provider) selects the Maven profile and Docker build-arg.
# Set the repository/environment variable CSP to azure | aws | gcp | oci. Defaults to azure.
Expand Down Expand Up @@ -92,7 +94,21 @@ jobs:

# Step 7: Push Docker Image
- name: Push Docker Image
id: push
run: |
docker push $REGISTRY_URL/${IMAGE_NAME}:${IMAGE_TAG}
echo "Pushed Docker image: $REGISTRY_URL/${IMAGE_NAME}:${IMAGE_TAG}"
echo "image=$REGISTRY_URL/${IMAGE_NAME}:${IMAGE_TAG}" >> $GITHUB_OUTPUT

@coderabbitai coderabbitai Bot Jul 23, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== workflow files =="
git ls-files .github/workflows || true

echo
echo "== relevant workflow excerpts =="
for f in .github/workflows/knowlg-service.yml .github/workflows/search-service.yml; do
  if [ -f "$f" ]; then
    echo "--- $f ($(wc -l < "$f") lines) ---"
    nl -ba "$f" | sed -n '1,180p'
  fi
done

echo
echo "== occurrences of REGISTRY_URL and image output =="
rg -n "REGISTRY_URL|GITHUB_OUTPUT|outputs:|download-artifact|upload-artifact|github\\.action_ref|REPOSITORY|IMAGE_NAME|IMAGE_TAG|SCAN|scan" .github/workflows || true

Repository: Sunbird-Knowlg/knowledge-platform

Length of output: 697

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== relevant workflow excerpts using awk ==\n'
for f in .github/workflows/knowlg-service.yml .github/workflows/search-service.yml; do
  if [ -f "$f" ]; then
    echo "--- $f ($(wc -l < "$f") lines) ---"
    awk '{printf "%6d\t%s\n", NR, $0}' "$f" | sed -n '1,180p'
  fi
done

printf '\n== occurrences of REGISTRY_URL and image output ==\n'
grep -RInE "REGISTRY_URL|GITHUB_OUTPUT|outputs:|download-artifact|upload-artifact|github\.action_ref|REPOSITORY|IMAGE_NAME|IMAGE_TAG|SCAN|scan" .github/workflows || true

printf '\n== all references to knowlg/search scan image or reusable workflow ==\n'
grep -RInE "knowlg-service|search-service|image=|scan|security|trivy|sast|sca" .github/workflows || true

Repository: Sunbird-Knowlg/knowledge-platform

Length of output: 19955

Keep secret-derived registry data out of job outputs.

The image output contains ${{ secrets.REGISTRY_URL }}; GitHub can redact outputs that include secret values, making subsequent needs.<job>.outputs.image values empty and skipping the cve-scan jobs. Output only non-secret components like the image name, image tag, and repository, and pass registry configuration as secrets to cve-check.yml.

📍 Affects 2 files
  • .github/workflows/knowlg-service.yml#L101-L101 (this comment)
  • .github/workflows/search-service.yml#L96-L96
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/knowlg-service.yml at line 101, Remove secret-derived
REGISTRY_URL from the image outputs in the image-build steps of
.github/workflows/knowlg-service.yml (line 101) and
.github/workflows/search-service.yml (line 96); output only non-secret image
components such as name, tag, and repository, then pass the registry
configuration separately as secrets to cve-check.yml while preserving the
cve-scan job inputs.

Source: MCP tools


cve-scan:
needs: build-and-push
if: needs.build-and-push.outputs.image != ''
permissions:
contents: read
packages: read
security-events: write
actions: read
uses: ./.github/workflows/cve-scan.yml
with:
image: ${{ needs.build-and-push.outputs.image }}

18 changes: 17 additions & 1 deletion .github/workflows/search-service.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,8 @@ jobs:
needs: check-config
if: needs.check-config.outputs.should_build == 'true'
runs-on: ubuntu-latest
outputs:
image: ${{ steps.push.outputs.image }}

steps:
# Step 1: Checkout the code
Expand Down Expand Up @@ -87,6 +89,20 @@ jobs:

# Step 7: Push Docker Image
- name: Push Docker Image
id: push
run: |
docker push $REGISTRY_URL/${IMAGE_NAME}:${IMAGE_TAG}
echo "Pushed Docker image: $REGISTRY_URL/${IMAGE_NAME}:${IMAGE_TAG}"
echo "Pushed Docker image: $REGISTRY_URL/${IMAGE_NAME}:${IMAGE_TAG}"
echo "image=$REGISTRY_URL/${IMAGE_NAME}:${IMAGE_TAG}" >> $GITHUB_OUTPUT

cve-scan:
needs: build-and-push
if: needs.build-and-push.outputs.image != ''
permissions:
contents: read
packages: read
security-events: write
actions: read
uses: ./.github/workflows/cve-scan.yml
with:
image: ${{ needs.build-and-push.outputs.image }}