Skip to content

Commit a16654d

Browse files
tricky42tricky42
committed
feat: updated cve-scan workflow, address ratelimiting for Trivy
1 parent f92008c commit a16654d

File tree

2 files changed

+159
-22
lines changed

2 files changed

+159
-22
lines changed

‎.github/workflows/cve-scan-old.yaml

+94
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
name: Docker Image Scanners
2+
on:
3+
push:
4+
branches:
5+
- "master"
6+
tags:
7+
- "v*.*.*"
8+
pull_request:
9+
branches:
10+
- "master"
11+
merge_group:
12+
13+
jobs:
14+
scanners:
15+
runs-on: ubuntu-latest
16+
steps:
17+
- name: Checkout
18+
uses: actions/checkout@v3
19+
- name: Setup Env
20+
id: vars
21+
shell: bash
22+
run: |
23+
echo "SHA_SHORT=$(git rev-parse --short HEAD)" >> "${GITHUB_ENV}"
24+
- name: Set up QEMU
25+
uses: docker/setup-qemu-action@v2
26+
- name: Set up Docker Buildx
27+
uses: docker/setup-buildx-action@v2
28+
- name: Build images
29+
shell: bash
30+
run: |
31+
IMAGE_TAG="${{ env.SHA_SHORT }}" make docker
32+
- name: Anchore Scanner
33+
uses: anchore/scan-action@v3
34+
id: grype-scan
35+
with:
36+
image: oryd/keto:${{ env.SHA_SHORT }}
37+
fail-build: true
38+
severity-cutoff: high
39+
add-cpes-if-none: true
40+
- name: Inspect action SARIF report
41+
shell: bash
42+
if: ${{ always() }}
43+
run: |
44+
echo "::group::Anchore Scan Details"
45+
jq '.runs[0].results' ${{ steps.grype-scan.outputs.sarif }}
46+
echo "::endgroup::"
47+
- name: Anchore upload scan SARIF report
48+
if: always()
49+
uses: github/codeql-action/upload-sarif@v2
50+
with:
51+
sarif_file: ${{ steps.grype-scan.outputs.sarif }}
52+
# - name: Kubescape scanner
53+
# uses: kubescape/github-action@main
54+
# id: kubescape
55+
# with:
56+
# image: oryd/keto:${{ env.SHA_SHORT }}
57+
# verbose: true
58+
# format: pretty-printer
59+
# # can't whitelist CVE yet: https://github.com/kubescape/kubescape/pull/1568
60+
# severityThreshold: critical
61+
- name: Trivy Scanner
62+
uses: aquasecurity/trivy-action@master
63+
if: ${{ always() }}
64+
with:
65+
image-ref: oryd/keto:${{ env.SHA_SHORT }}
66+
format: "table"
67+
exit-code: "42"
68+
ignore-unfixed: true
69+
vuln-type: "os,library"
70+
severity: "CRITICAL,HIGH"
71+
scanners: "vuln,secret,config"
72+
- name: Dockle Linter
73+
uses: erzz/[email protected]
74+
if: ${{ always() }}
75+
with:
76+
image: oryd/keto:${{ env.SHA_SHORT }}
77+
exit-code: 42
78+
failure-threshold: high
79+
- name: Hadolint
80+
uses: hadolint/[email protected]
81+
id: hadolint
82+
if: ${{ always() }}
83+
with:
84+
dockerfile: .docker/Dockerfile-build
85+
verbose: true
86+
format: "json"
87+
failure-threshold: "error"
88+
- name: View Hadolint results
89+
if: ${{ always() }}
90+
shell: bash
91+
run: |
92+
echo "::group::Hadolint Scan Details"
93+
echo "${HADOLINT_RESULTS}" | jq '.'
94+
echo "::endgroup::"

‎.github/workflows/cve-scan.yaml

+65-22
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
name: Docker Image Scanners
22
on:
3+
workflow_dispatch:
34
push:
45
branches:
56
- "master"
@@ -8,32 +9,70 @@ on:
89
pull_request:
910
branches:
1011
- "master"
11-
merge_group:
12+
13+
permissions:
14+
contents: read
15+
security-events: write
1216

1317
jobs:
1418
scanners:
1519
runs-on: ubuntu-latest
1620
steps:
1721
- name: Checkout
18-
uses: actions/checkout@v3
22+
uses: actions/checkout@v4
1923
- name: Setup Env
2024
id: vars
2125
shell: bash
2226
run: |
23-
echo "SHA_SHORT=$(git rev-parse --short HEAD)" >> "${GITHUB_ENV}"
27+
# Store values in local variables
28+
SHA_SHORT=$(git rev-parse --short HEAD)
29+
REPO_NAME=${{ github.event.repository.name }}
30+
31+
# Append -sqlite to SHA_SHORT if repo is hydra
32+
if [ "${REPO_NAME}" = "hydra" ]; then
33+
echo "Repo is hydra, appending -sqlite to SHA_SHORT"
34+
IMAGE_NAME="oryd/${REPO_NAME}:${SHA_SHORT}-sqlite"
35+
else
36+
echo "Repo is not hydra, using default IMAGE_NAME"
37+
IMAGE_NAME="oryd/${REPO_NAME}:${SHA_SHORT}"
38+
fi
39+
40+
# Output values for debugging
41+
echo "Values to be set:"
42+
echo "SHA_SHORT: ${SHA_SHORT}"
43+
echo "REPO_NAME: ${REPO_NAME}"
44+
echo "IMAGE_NAME: ${IMAGE_NAME}"
45+
46+
# Set GitHub Environment variables
47+
echo "SHA_SHORT=${SHA_SHORT}" >> "${GITHUB_ENV}"
48+
echo "IMAGE_NAME=${IMAGE_NAME}" >> "${GITHUB_ENV}"
2449
- name: Set up QEMU
25-
uses: docker/setup-qemu-action@v2
50+
uses: docker/setup-qemu-action@v3
2651
- name: Set up Docker Buildx
27-
uses: docker/setup-buildx-action@v2
52+
uses: docker/setup-buildx-action@v3
2853
- name: Build images
2954
shell: bash
3055
run: |
3156
IMAGE_TAG="${{ env.SHA_SHORT }}" make docker
57+
58+
- name: Login to GitHub Container Registry
59+
uses: docker/login-action@v3
60+
with:
61+
registry: ghcr.io
62+
username: ${{ github.actor }}
63+
password: ${{ secrets.GITHUB_TOKEN }}
64+
65+
- name: Configure Trivy
66+
run: |
67+
mkdir -p $HOME/.cache/trivy
68+
echo "TRIVY_USERNAME=${{ github.actor }}" >> $GITHUB_ENV
69+
echo "TRIVY_PASSWORD=${{ secrets.GITHUB_TOKEN }}" >> $GITHUB_ENV
70+
3271
- name: Anchore Scanner
33-
uses: anchore/scan-action@v3
72+
uses: anchore/scan-action@v5
3473
id: grype-scan
3574
with:
36-
image: oryd/keto:${{ env.SHA_SHORT }}
75+
image: ${{ env.IMAGE_NAME }}
3776
fail-build: true
3877
severity-cutoff: high
3978
add-cpes-if-none: true
@@ -46,34 +85,38 @@ jobs:
4685
echo "::endgroup::"
4786
- name: Anchore upload scan SARIF report
4887
if: always()
49-
uses: github/codeql-action/upload-sarif@v2
88+
uses: github/codeql-action/upload-sarif@v3
5089
with:
5190
sarif_file: ${{ steps.grype-scan.outputs.sarif }}
52-
# - name: Kubescape scanner
53-
# uses: kubescape/github-action@main
54-
# id: kubescape
55-
# with:
56-
# image: oryd/keto:${{ env.SHA_SHORT }}
57-
# verbose: true
58-
# format: pretty-printer
59-
# # can't whitelist CVE yet: https://github.com/kubescape/kubescape/pull/1568
60-
# severityThreshold: critical
91+
- name: Kubescape scanner
92+
uses: kubescape/github-action@main
93+
id: kubescape
94+
with:
95+
image: ${{ env.IMAGE_NAME }}
96+
verbose: true
97+
format: pretty-printer
98+
# can't whitelist CVE yet: https://github.com/kubescape/kubescape/pull/1568
99+
severityThreshold: critical
61100
- name: Trivy Scanner
62101
uses: aquasecurity/trivy-action@master
63102
if: ${{ always() }}
64103
with:
65-
image-ref: oryd/keto:${{ env.SHA_SHORT }}
104+
image-ref: ${{ env.IMAGE_NAME }}
66105
format: "table"
67106
exit-code: "42"
68107
ignore-unfixed: true
69108
vuln-type: "os,library"
70109
severity: "CRITICAL,HIGH"
71-
scanners: "vuln,secret,config"
110+
scanners: "vuln,secret,misconfig"
111+
env:
112+
TRIVY_SKIP_JAVA_DB_UPDATE: "true"
113+
TRIVY_DISABLE_VEX_NOTICE: "true"
114+
72115
- name: Dockle Linter
73-
uses: erzz/dockle-action@v1.3.2
116+
uses: erzz/dockle-action@v1
74117
if: ${{ always() }}
75118
with:
76-
image: oryd/keto:${{ env.SHA_SHORT }}
119+
image: ${{ env.IMAGE_NAME }}
77120
exit-code: 42
78121
failure-threshold: high
79122
- name: Hadolint
@@ -90,5 +133,5 @@ jobs:
90133
shell: bash
91134
run: |
92135
echo "::group::Hadolint Scan Details"
93-
echo "${HADOLINT_RESULTS}" | jq '.'
136+
echo "${HADOLINT_RESULTS}" | jq '.'
94137
echo "::endgroup::"

0 commit comments

Comments
 (0)