Add job trivy #62

Workflow file for this run

	name: devsecops-pipeline

	on:
	pull_request:
	push:
	branches: ["main"]
	workflow_dispatch:

	permissions:
	contents: read
	security-events: write
	packages: write # útil si luego publicas en GHCR
	discussions: write
	pull-requests: write

	concurrency:
	group: devsecops-${{ github.ref }}
	cancel-in-progress: true

	env:
	# 🔁 Cambia esto para probar cada escenario (apps/10-secrets-leak, 20-sast-bugs, etc.)
	APP_DIR: apps/10-secrets-leak
	# Parámetros de despliegue local
	IMAGE_NAME: demo-app
	IMAGE_TAG: local
	KIND_CLUSTER: kind
	SERVICE_RELEASE_NAME: demo

	jobs:
	# ──────────────────────────────────────────────────────────────────────────────
	# Secrets + SAST
	# ──────────────────────────────────────────────────────────────────────────────
	secrets:
	name: Secrets scanning (Gitleaks)
	runs-on: ubuntu-latest
	steps:
	- name: Clean gitleaks
	run: rm -f /tmp/gitleaks.tmp
	- uses: actions/checkout@v4
	with:
	fetch-depth: 0 # para análisis que miran historial
	- name: Gitleaks
	uses: gitleaks/gitleaks-action@v2
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	# Si usas un gitleaks.toml propio, añade inputs/vars según la acción

	sast:
	name: SAST (Semgrep)
	runs-on: ubuntu-latest
	needs: [secrets]
	steps:
	- uses: actions/checkout@v4
	- name: self-hosted (no bloqueante)
	run: \|
	docker run --rm -v "$PWD:/src" returntocorp/semgrep:latest \
	semgrep scan --config p/ci --config .semgrep
	- name: Export SARIF (para pestaña Security)
	run: \|
	docker run --rm -v "$PWD:/src" returntocorp/semgrep:latest \
	semgrep scan --config p/ci --config .semgrep --sarif -o semgrep.sarif \|\| true
	- uses: github/codeql-action/upload-sarif@v3
	with: { sarif_file: semgrep.sarif }

	# ──────────────────────────────────────────────────────────────────────────────
	# IaC + Build + SBOM
	# ──────────────────────────────────────────────────────────────────────────────
	# iac:
	# name: IaC scan (Checkov)
	# runs-on: ubuntu-latest
	# needs: [sast]
	# steps:
	# - uses: actions/checkout@v4
	# - name: Checkov (K8s/Terraform)
	# uses: bridgecrewio/checkov-action@master
	# with:
	# directory: .
	# quiet: true
	# soft_fail: false # pon true si no quieres bloquear (no recomendado)


	build:
	name: Build + SBOM
	runs-on: ubuntu-latest
	needs: [sast]
	steps:
	- uses: actions/checkout@v4
	- name: Build imagen de la app objetivo
	run: \|
	cd "${APP_DIR}"
	docker build -t ${IMAGE_NAME}:${IMAGE_TAG} .
	- name: SBOM (Syft)
	uses: anchore/sbom-action@v0
	with:
	image: localhost/demo-app:local
	artifact-name: sbom.spdx.json # queda como artefacto del job
	# ──────────────────────────────────────────────────────────────────────────────
	# Trivy + Firma/Verify (cosign)
	# ──────────────────────────────────────────────────────────────────────────────
	container_scan:
	name: Container & deps scan (Trivy)
	runs-on: self-hosted
	needs: [build]
	steps:
	- name: Trivy image (CRITICAL,HIGH)
	uses: aquasecurity/trivy-action@0.28.0
	with:
	scan-type: image
	image-ref: localhost/demo-app:local
	format: sarif
	output: trivy-image.sarif
	ignore-unfixed: true
	severity: CRITICAL,HIGH
	- uses: github/codeql-action/upload-sarif@v3
	with: { sarif_file: trivy-image.sarif }

	# - name: Trivy fs (SCA sobre el repo)
	# uses: aquasecurity/trivy-action@0.28.0
	# with:
	# scan-type: fs
	# scan-ref: .
	# format: sarif
	# output: trivy-fs.sarif
	# ignore-unfixed: true
	# severity: CRITICAL,HIGH
	# - uses: github/codeql-action/upload-sarif@v3
	# with: { sarif_file: trivy-fs.sarif }

Navigation Menu

Add job trivy #62

Workflow file

Add job trivy #62

Uh oh!

Workflow file for this run