image-vulnerability.yml

name: Scan Docker Image Vulnerabilities

on:
    # Trigger the workflow on push or pull request,
    # but only for the main and release branches
    push:
      branches:
        - master
        - 'releases/**'
    pull_request:
      branches:
        - master
        - 'releases/**'
    merge_group:

jobs:
  docker-build-and-scan:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build Docker image
        run: |
          docker build -t skypilot-test:${{ github.sha }} .

      - name: Run Trivy vulnerability scanner
        id: trivy_scan
        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.1
        with:
          image-ref: skypilot-test:${{ github.sha }}
          format: 'json'
          output: trivy-results.json
          exit-code: '0'
          ignore-unfixed: true
          vuln-type: 'os,library'
          scanners: 'vuln'
          severity: 'HIGH,CRITICAL'
          trivyignores: .trivyignore

      - name: Evaluate Trivy scan results
        run: |
          mapfile -t high_vulns < <(jq -r '
            .Results[]? as $result
            | $result.Vulnerabilities[]?
            | select(.Severity=="HIGH")
            | "- \(.VulnerabilityID) | \(.PkgName) \(.InstalledVersion) -> \(.FixedVersion // "N/A") | component: \($result.Target // "unknown")"
          ' trivy-results.json)
          if [ "${#high_vulns[@]}" -gt 0 ]; then
            echo "::warning::Trivy found ${#high_vulns[@]} high severity vulnerabilities:"
            printf '%s\n' "${high_vulns[@]}"
          fi

          mapfile -t critical_vulns < <(jq -r '
            .Results[]? as $result
            | $result.Vulnerabilities[]?
            | select(.Severity=="CRITICAL")
            | "- \(.VulnerabilityID) | \(.PkgName) \(.InstalledVersion) -> \(.FixedVersion // "N/A") | component: \($result.Target // "unknown")"
          ' trivy-results.json)
          if [ "${#critical_vulns[@]}" -gt 0 ]; then
            echo "Critical vulnerabilities detected (${#critical_vulns[@]}):"
            printf '%s\n' "${critical_vulns[@]}"
            exit 1
          fi