refactor: Migrate from legacy storage implementations to disk.Store and tiered.Store #765
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Vulnerability Check | |
| on: | |
| pull_request: | |
| branches: [ master ] | |
| types: [ opened, reopened, synchronize ] | |
| push: | |
| branches: [ master ] | |
| jobs: | |
| trivy_scan: | |
| name: Trivy Vulnerability Scan | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'pull_request' | |
| steps: | |
| - name: Checkout Repository | |
| uses: actions/checkout@v4 | |
| - name: Run Trivy to check CRITICAL dependencies | |
| uses: aquasecurity/trivy-action@v0.35.0 | |
| with: | |
| scan-type: 'fs' | |
| scan-all-sub-directories: true | |
| exit-code: '1' | |
| severity: 'CRITICAL' # only fail on CRITICAL vulnerabilities | |
| ignore-unfixed: true | |
| vuln-type: 'library' # only check libraries | |
| scanners: 'vuln,license,secret,misconfig' | |
| skip-version-check: true | |
| clamav_scan: | |
| name: ClamAV Malware Scan | |
| runs-on: ubuntu-latest | |
| if: github.event_name == 'pull_request' | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| - name: Install ClamAV | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y clamav | |
| - name: Update ClamAV signatures | |
| run: | | |
| sudo systemctl stop clamav-freshclam | |
| # Retry up to 3 times, as ClamAV's CDN may be rate-limited. | |
| for i in {0..2}; do | |
| sudo freshclam && exit 0 | |
| [ "$i" -lt 2 ] && sleep 10 | |
| done | |
| exit 1 | |
| - name: Run ClamAV to check for malware | |
| # Enforce a 10MB file/archive limit, and fail when exceeded. | |
| run: clamscan --recursive --infected --exclude-dir="(^|/)\.git$" --max-filesize=10M --max-scansize=10M --alert-exceeds-max . | |
| trivy_report: | |
| name: Trivy Vulnerability Report | |
| runs-on: ubuntu-latest | |
| # Since this is a report job, it should only run after merge to report all vulnerabilities | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/master' | |
| permissions: | |
| contents: read # required to checkout the repository | |
| security-events: write # required to upload the SARIF report to Github's security tab | |
| steps: | |
| - name: Checkout Repository | |
| uses: actions/checkout@v4 | |
| - name: Run Trivy scan for all severities | |
| uses: aquasecurity/trivy-action@v0.35.0 | |
| with: | |
| scan-type: 'fs' | |
| scan-all-sub-directories: true | |
| format: 'sarif' # Sarif to report to github security tab | |
| output: 'trivy-results.sarif' | |
| exit-code: '0' # Never fail | |
| ignore-unfixed: true | |
| vuln-type: 'os,library' # Report any os related vulnerabilities also in the report | |
| scanners: 'vuln,license,secret,misconfig' | |
| skip-version-check: true | |
| # This step will make the vulns detected in the above step to be visible in the security tab in github. | |
| - name: Upload comprehensive Trivy scan results | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: 'trivy-results.sarif' |