trivy.yml

# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.

name: trivy

# on:
#   push:
#     branches: [ "main" ]
#   pull_request:
#     # The branches below must be a subset of the branches above
#     branches: [ "main" ]
#   schedule:
#     - cron: '24 16 * * 0'

# permissions:
#   contents: read

on:
  # Manual trigger only from any branch/environment
  workflow_dispatch:
    inputs:
      branch:
        description: 'Branch to run Trivy on'
        required: false
        default: 'main'
      environment:
        description: 'Environment to run in'
        required: false
        default: 'development'
        type: choice
        options:
        - development
        - staging
        - production
      image_tag:
        description: 'Docker image tag version'
        required: false
        default: '4.3.0.0'
        type: string
      build_flavor:
        description: 'Build flavor for tagging'
        required: false
        default: 'nonprod'
        type: choice
        options:
        - nonprod
        - prod

  # Allow this workflow to be called by other workflows
  workflow_call:
    inputs:
      branch:
        description: 'Branch to run Trivy on'
        required: false
        default: 'main'
        type: string
      environment:
        description: 'Environment to run in'
        required: false
        default: 'development'
        type: string
      image_tag:
        description: 'Docker image tag version'
        required: false
        default: '4.3.0.0'
        type: string
      build_flavor:
        description: 'Build flavor for tagging'
        required: false
        default: 'nonprod'
        type: string

jobs:
  build:
    permissions:
      contents: read # for actions/checkout to fetch code
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
    name: Build and Scan Docker Images
    runs-on: [self-hosted, linux, X64]
    outputs:
      vulnerability_found: ${{ steps.scan_summary.outputs.vulnerability_found }}
      images_scanned: ${{ steps.scan_summary.outputs.images_scanned }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.inputs.branch || github.ref }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      # - name: Log in with Azure (OIDC)
      #   uses: azure/login@v2
      #   with:
      #     client-id: ${{ secrets.AZURE_CLIENT_ID }}
      #     tenant-id: ${{ secrets.AZURE_TENANT_ID }}
      #     subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

      - name: Log in to Azure Container Registry
        uses: azure/docker-login@v1
        with:
          login-server: ispirt.azurecr.io
          username: ${{ secrets.AZURE_REGISTRY_USERNAME }}
          password: ${{ secrets.AZURE_REGISTRY_PASSWORD }}

      # - name: Set up Bazel cache with Azure Blob Storage
      #   run: |
      #     echo "Setting up Bazel remote cache with Azure Blob Storage..."
      #     # Append remote cache configuration to existing .bazelrc
      #     cat >> .bazelrc << EOF
          
      #     # Remote cache configuration for Azure Blob Storage
      #     build:remote --remote_cache=https://${{ secrets.AZURE_STORAGE_ACCOUNT }}.blob.core.windows.net/${{ secrets.AZURE_BAZEL_CACHE_CONTAINER }}
      #     build:remote --remote_upload_local_results=true
      #     build:remote --remote_accept_cached=true
      #     build:remote --remote_timeout=60
      #     build:remote --experimental_remote_cache_compression
      #     EOF
          
      #     echo "Bazel remote cache configuration added to .bazelrc"

      - name: Build the code
        run: |
          echo "Building code with the specified parameters and Azure Blob cache..."
          echo "Current directory: $(pwd)"
          echo "Workspace: ${GITHUB_WORKSPACE}"
          
          # Ensure we're in the correct workspace directory
          cd "${GITHUB_WORKSPACE}"
          
          # Make the script executable
          chmod +x ./production/packaging/build_and_test_all_in_docker
          
          # Show the bazel config for debugging
          echo "Current .bazelrc content:"
          cat .bazelrc | tail -10
          
          # Set explicit environment variables to control container behavior and prevent breakout
          export WORKSPACE="${GITHUB_WORKSPACE}"
          export WORKSPACE_MOUNT="${GITHUB_WORKSPACE}"
          export DOCKER_BUILDKIT=1
          
          # Ensure no conflicting containers exist
          docker stop $(docker ps -aq --filter "name=cbuild-*") 2>/dev/null || true
          docker rm $(docker ps -aq --filter "name=cbuild-*") 2>/dev/null || true
          
          # Run the build with explicit workspace context
          ./production/packaging/build_and_test_all_in_docker \
            --service-path bidding_service \
            --service-path buyer_frontend_service \
            --no-precommit \
            --no-tests \
            --build-flavor non_prod \
            --platform azure \
            --instance local

      - name: List generated artifacts
        run: |
          echo "Generated tar files for Docker loading:"
          find . -name "*.tar" -type f | head -10
          echo "Generated artifacts in dist/:"
          ls -la dist/ 2>/dev/null || echo "No dist/ directory found"
          echo "Generated artifacts in dist/azure/:"
          ls -la dist/azure/ 2>/dev/null || echo "No dist/azure/ directory found"

      - name: Check for Docker tar files in dist/azure
        id: check_files
        run: |
          echo "Checking for Docker tar files in dist/azure directory..."
          if [ ! -d "dist/azure" ]; then
            echo "❌ dist/azure directory not found"
            echo "tar_files_found=false" >> $GITHUB_OUTPUT
            exit 1
          fi
          
          # Find all tar files in dist/azure
          TAR_FILES=$(find dist/azure -name "*.tar" -type f)
          if [ -z "$TAR_FILES" ]; then
            echo "❌ No tar files found in dist/azure"
            echo "tar_files_found=false" >> $GITHUB_OUTPUT
            exit 1
          fi
          
          echo "✅ Found tar files:"
          echo "$TAR_FILES"
          echo "tar_files_found=true" >> $GITHUB_OUTPUT
          
          # Save tar files list for next steps
          echo "$TAR_FILES" > tar_files_list.txt

      - name: Load and scan Docker images
        id: scan_images
        run: |
          VULNERABILITY_FOUND=false
          IMAGES_SCANNED=0
          SCAN_RESULTS=""
          
          echo "🔍 Starting Docker image scanning process..."
          
          while IFS= read -r tar_file; do
            if [ -z "$tar_file" ]; then continue; fi
            
            echo "📦 Processing: $tar_file"
            
            # Load the Docker image from tar file
            echo "Loading Docker image from tar file..."
            LOADED_OUTPUT=$(docker load -i "$tar_file")
            echo "$LOADED_OUTPUT"
            
            # Extract image name from docker load output
            IMAGE_NAME=$(echo "$LOADED_OUTPUT" | grep "Loaded image:" | cut -d' ' -f3)
            if [ -z "$IMAGE_NAME" ]; then
              echo "❌ Failed to extract image name from: $tar_file"
              continue
            fi
            
            echo "✅ Loaded image: $IMAGE_NAME"
            IMAGES_SCANNED=$((IMAGES_SCANNED + 1))
            
            # Create unique output file for this image
            SERVICE_NAME=$(basename "$tar_file" .tar | sed 's/_image$//')
            SARIF_OUTPUT="trivy-results-${SERVICE_NAME}.sarif"
            JSON_OUTPUT="trivy-results-${SERVICE_NAME}.json"
            
            echo "🔍 Running Trivy scan on: $IMAGE_NAME"
            
            # Run Trivy scan in SARIF format
            docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
              -v $(pwd):/workspace \
              aquasec/trivy:latest image \
              --format sarif \
              --output "/workspace/$SARIF_OUTPUT" \
              --severity CRITICAL,HIGH,MEDIUM \
              "$IMAGE_NAME"
            
            # Run Trivy scan in JSON format for analysis
            docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
              -v $(pwd):/workspace \
              aquasec/trivy:latest image \
              --format json \
              --output "/workspace/$JSON_OUTPUT" \
              --severity CRITICAL,HIGH,MEDIUM \
              "$IMAGE_NAME"
            
            # Check if vulnerabilities were found
            if [ -f "$JSON_OUTPUT" ]; then
              VULN_COUNT=$(jq '[.Results[]?.Vulnerabilities[]? | select(.Severity == "CRITICAL" or .Severity == "HIGH")] | length' "$JSON_OUTPUT" 2>/dev/null || echo "0")
              echo "📊 Found $VULN_COUNT critical/high vulnerabilities in $SERVICE_NAME"
              
              if [ "$VULN_COUNT" -gt 0 ]; then
                VULNERABILITY_FOUND=true
                SCAN_RESULTS="${SCAN_RESULTS}❌ $SERVICE_NAME: $VULN_COUNT critical/high vulnerabilities found\n"
              else
                SCAN_RESULTS="${SCAN_RESULTS}✅ $SERVICE_NAME: No critical/high vulnerabilities found\n"
              fi
            else
              echo "⚠️ Could not analyze scan results for $SERVICE_NAME"
              SCAN_RESULTS="${SCAN_RESULTS}⚠️ $SERVICE_NAME: Scan analysis failed\n"
            fi
            
            # Tag image for potential push
            if [ "$VULNERABILITY_FOUND" = "false" ]; then
              REGISTRY_TAG="ispirt.azurecr.io/depa-inferencing/azure/${SERVICE_NAME}:${{ github.event.inputs.build_flavor || 'nonprod' }}-${{ github.event.inputs.image_tag || '4.3.0.0' }}"
              echo "🏷️ Tagging image: $REGISTRY_TAG"
              docker tag "$IMAGE_NAME" "$REGISTRY_TAG"
              echo "tagged_image_${SERVICE_NAME}=${REGISTRY_TAG}" >> $GITHUB_OUTPUT
            fi
            
          done < tar_files_list.txt
          
          echo "vulnerability_found=$VULNERABILITY_FOUND" >> $GITHUB_OUTPUT
          echo "images_scanned=$IMAGES_SCANNED" >> $GITHUB_OUTPUT
          echo "scan_results<<EOF" >> $GITHUB_OUTPUT
          echo -e "$SCAN_RESULTS" >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT
          
          echo "📋 Scan Summary:"
          echo "Images scanned: $IMAGES_SCANNED"
          echo "Vulnerabilities found: $VULNERABILITY_FOUND"
          echo -e "$SCAN_RESULTS"

      - name: Upload Trivy SARIF results
        uses: actions/upload-artifact@v4
        with:
          name: trivy-sarif-results
          path: trivy-results-*.sarif

      # Alternative method using GitHub Actions for SARIF upload
      - name: Upload individual SARIF files using GitHub Action
        if: always()
        run: |
          # Create individual upload jobs for each SARIF file
          for sarif_file in trivy-results-*.sarif; do
            if [ -f "$sarif_file" ]; then
              echo "Found SARIF file: $sarif_file"
            fi
          done
        
      # Upload each SARIF file individually
      - name: Upload bidding service SARIF
        if: always() && hashFiles('trivy-results-bidding_service.sarif') != ''
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results-bidding_service.sarif'
          category: 'trivy-bidding-service'
        continue-on-error: true

      - name: Upload buyer frontend service SARIF  
        if: always() && hashFiles('trivy-results-buyer_frontend_service.sarif') != ''
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results-buyer_frontend_service.sarif'
          category: 'trivy-buyer-frontend-service'
        continue-on-error: true

      - name: Push images to registry if no vulnerabilities
        id: push_images
        if: steps.scan_images.outputs.vulnerability_found == 'false'
        run: |
          echo "✅ No critical/high vulnerabilities found. Pushing images to registry..."
          PUSHED_IMAGES=""
          
          while IFS= read -r tar_file; do
            if [ -z "$tar_file" ]; then continue; fi
            
            SERVICE_NAME=$(basename "$tar_file" .tar | sed 's/_image$//')
            REGISTRY_TAG="ispirt.azurecr.io/depa-inferencing/azure/test/${SERVICE_NAME}:${{ github.event.inputs.build_flavor || 'nonprod' }}-${{ github.event.inputs.image_tag || '4.3.0.0' }}"
            
            echo "🚀 Pushing: $REGISTRY_TAG"
            if docker push "$REGISTRY_TAG"; then
              echo "✅ Successfully pushed: $REGISTRY_TAG"
              PUSHED_IMAGES="${PUSHED_IMAGES}✅ $REGISTRY_TAG\n"
            else
              echo "❌ Failed to push: $REGISTRY_TAG"
              PUSHED_IMAGES="${PUSHED_IMAGES}❌ $REGISTRY_TAG (push failed)\n"
            fi
            
          done < tar_files_list.txt
          
          echo "pushed_images<<EOF" >> $GITHUB_OUTPUT
          echo -e "$PUSHED_IMAGES" >> $GITHUB_OUTPUT
          echo "EOF" >> $GITHUB_OUTPUT

      - name: Generate security report
        id: scan_summary
        if: always()
        run: |
          echo "# Docker Security Scan Report" > security_report.md
          echo "**Date:** $(date)" >> security_report.md
          echo "**Branch:** ${{ github.event.inputs.branch || github.ref_name }}" >> security_report.md
          echo "**Build Flavor:** ${{ github.event.inputs.build_flavor || 'nonprod' }}" >> security_report.md
          echo "**Image Tag:** ${{ github.event.inputs.image_tag || '4.3.0.0' }}" >> security_report.md
          echo "" >> security_report.md
          echo "## Scan Results" >> security_report.md
          echo "Images scanned: ${{ steps.scan_images.outputs.images_scanned }}" >> security_report.md
          echo "Vulnerabilities found: ${{ steps.scan_images.outputs.vulnerability_found }}" >> security_report.md
          echo "" >> security_report.md
          echo "### Detailed Results" >> security_report.md
          echo -e "${{ steps.scan_images.outputs.scan_results }}" >> security_report.md
          
          if [ "${{ steps.scan_images.outputs.vulnerability_found }}" = "false" ]; then
            echo "" >> security_report.md
            echo "## Registry Push Results" >> security_report.md
            echo -e "${{ steps.push_images.outputs.pushed_images }}" >> security_report.md
          else
            echo "" >> security_report.md
            echo "## ⚠️ Action Required" >> security_report.md
            echo "Critical or high vulnerabilities were found. Images were **NOT** pushed to registry." >> security_report.md
            echo "Please review the SARIF files and address the vulnerabilities before deployment." >> security_report.md
          fi
          
          cat security_report.md
          
          # Set outputs for other jobs
          echo "vulnerability_found=${{ steps.scan_images.outputs.vulnerability_found }}" >> $GITHUB_OUTPUT
          echo "images_scanned=${{ steps.scan_images.outputs.images_scanned }}" >> $GITHUB_OUTPUT

      - name: Upload security report
        uses: actions/upload-artifact@v4
        with:
          name: docker-security-report
          path: security_report.md

      - name: Cleanup build artifacts
        if: always()
        run: |
          echo "Cleaning up build artifacts..."
          # Clean up any docker artifacts that might have permission issues
          docker container prune -f || true
          
          # Fix permissions on workspace files, subsequent runs fail,
          # because of some files with root permissions
          sudo chown -R $(whoami):$(whoami) ${GITHUB_WORKSPACE} || true
          
          echo "Cleanup completed for ${{ matrix.language }}"
          
          # Clean up any temporary mounts
          sudo umount /tmp/* 2>/dev/null || true