Vulnerability Scanning with Trivy #51
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Vulnerability Scanning with Trivy | |
| on: | |
| workflow_dispatch: | |
| schedule: | |
| - cron: '0 0 * * *' # Test Trivy daily at midnight | |
| permissions: | |
| contents: read | |
| security-events: write # for uploading SARIF results to the security tab | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }} | |
| cancel-in-progress: true | |
| defaults: | |
| run: | |
| shell: bash | |
| jobs: | |
| trivy-repo: | |
| name: Trivy - Repository | |
| runs-on: ubuntu-24.04 | |
| if: ${{ ( github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' ) && github.ref_name == 'main' && github.repository == 'canonical/lxd' }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| ref: main | |
| persist-credentials: false | |
| - name: Install Trivy | |
| uses: ./.github/actions/install-trivy | |
| - name: Download Trivy DB | |
| id: db_download | |
| run: trivy fs --download-db-only --cache-dir /home/runner/vuln-cache | |
| continue-on-error: true | |
| - name: Use previously downloaded database | |
| if: ${{ steps.db_download.outcome == 'failure' }} | |
| uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 | |
| with: | |
| path: /home/runner/vuln-cache | |
| key: download-failed # Use a non existing key to fallback to restore-keys | |
| restore-keys: | | |
| trivy-cache- | |
| - name: Run Trivy vulnerability scanner | |
| run: | | |
| trivy fs --skip-db-update \ | |
| --scanners vuln,secret,misconfig \ | |
| --format sarif \ | |
| --cache-dir /home/runner/vuln-cache \ | |
| --severity LOW,MEDIUM,HIGH,CRITICAL \ | |
| --output trivy-lxd-repo-scan-results.sarif . | |
| - name: Cache Trivy vulnerability database | |
| uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 | |
| with: | |
| path: /home/runner/vuln-cache | |
| key: trivy-cache-${{ github.run_id }} | |
| - name: Tag KEV alerts | |
| run: | | |
| cd /home/runner | |
| curl -s --compressed -o kev.json https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json | |
| kev_ids="$(jq -r '.vulnerabilities[].cveID' kev.json)" | |
| jq --arg ids "$kev_ids" '($ids | split("\n")) as $id_list | .runs[].tool.driver.rules[] |= ( | |
| if (.id as $id | $id_list | index($id)) then | |
| .shortDescription.text |= . + " (KEV)" | |
| else | |
| . | |
| end | |
| )' "$GITHUB_WORKSPACE/trivy-lxd-repo-scan-results.sarif" > trivy-modified.sarif | |
| mv trivy-modified.sarif "$GITHUB_WORKSPACE/trivy-lxd-repo-scan-results.sarif" | |
| - name: Upload Trivy scan results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9 | |
| with: | |
| sarif_file: "trivy-lxd-repo-scan-results.sarif" | |
| sha: ${{ github.sha }} | |
| ref: refs/heads/main | |
| trivy-snap: | |
| name: Trivy - Snap | |
| runs-on: ubuntu-24.04 | |
| needs: trivy-repo | |
| if: ${{ ( github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' ) && github.ref_name == 'main' && github.repository == 'canonical/lxd' }} | |
| strategy: | |
| matrix: | |
| version: | |
| - "latest" | |
| - "5.21" | |
| - "5.0" | |
| - "4.0" | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - name: Install Trivy | |
| uses: ./.github/actions/install-trivy | |
| - name: Restore cached Trivy vulnerability database | |
| uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3 | |
| with: | |
| path: /home/runner/vuln-cache | |
| key: download-failed # Use a non existing key to fallback to restore-keys | |
| restore-keys: | | |
| trivy-cache- | |
| - name: Download snap for scan | |
| run: | | |
| snap download lxd --channel=${{ matrix.version }}/stable --cohort="+" | |
| unsquashfs ./lxd*.snap | |
| - name: Run Trivy vulnerability scanner | |
| run: | | |
| trivy rootfs --skip-db-update \ | |
| --scanners vuln,secret,misconfig \ | |
| --format sarif \ | |
| --cache-dir /home/runner/vuln-cache \ | |
| --severity LOW,MEDIUM,HIGH,CRITICAL \ | |
| --output /home/runner/${{ matrix.version }}-stable.sarif squashfs-root | |
| - name: Flag snap scanning alerts and tag KEV alerts | |
| run: | | |
| cd /home/runner | |
| # Download KEV catalog | |
| curl -s --compressed -o kev.json https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json | |
| kev_ids="$(jq -r '.vulnerabilities[].cveID' kev.json)" | |
| # Modify the SARIF file to both add "Snap scan - " prefix and tag KEV alerts | |
| jq --arg ids "$kev_ids" ' | |
| ($ids | split("\n")) as $id_list | | |
| .runs[].tool.driver.rules[] |= ( | |
| # First add the Snap scan prefix to all entries | |
| .shortDescription.text = "Snap scan - " + .shortDescription.text | | |
| # Then add KEV tag if applicable | |
| if (.id as $id | $id_list | index($id)) then | |
| .shortDescription.text |= . + " (KEV)" | |
| else | |
| . | |
| end | |
| )' ${{ matrix.version }}-stable.sarif > ${{ matrix.version }}-modified.sarif | |
| mv ${{ matrix.version }}-modified.sarif ${{ matrix.version }}-stable.sarif | |
| # Now we checkout to the branch related to the scanned snap to populate github.sha appropriately. | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| ref: ${{ (matrix.version == 'latest' && 'main') || format('stable-{0}', matrix.version) }} | |
| persist-credentials: false | |
| - name: Upload Trivy scan results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9 | |
| with: | |
| sarif_file: /home/runner/${{ matrix.version }}-stable.sarif | |
| sha: ${{ github.sha }} | |
| ref: refs/heads/${{ (matrix.version == 'latest' && 'main') || format('stable-{0}', matrix.version) }} |