fix: set envs only when passed #405

knqyf263 · 2024-10-09T08:05:04Z

Problem

Currently, all TRIVY_XXX environment variables are always passed to entrypoint.sh, which prevents configurations set in trivy.yaml from being correctly applied. This occurs because environment variables take precedence over configuration files.

Proposed Solution

This PR implements a workaround to set environment variables only when values are explicitly provided. However, there's currently no reliable method to determine if a value has been passed in GitHub Actions (see actions/runner#924).

Implementation Details

We now compare input values against their defaults and only set the corresponding environment variables if they differ.
TRIVY_CACHE_DIR is an exception and is always set, as it requires a value different from Trivy's default.
- Updated the README to clarify that TRIVY_CACHE_DIR cannot be controlled via trivy.yaml due to this implementation.

Testing

https://github.com/knqyf263/trivy-action-test/actions/runs/11250664411/job/31280013016

Signed-off-by: knqyf263 <knqyf263@gmail.com>

DmitriyLewen · 2024-10-09T08:19:35Z

action.yaml

+        set_env_var_if_provided "TRIVY_EXIT_CODE" "${{ inputs.exit-code }}" ""
+        set_env_var_if_provided "TRIVY_IGNORE_UNFIXED" "${{ inputs.ignore-unfixed }}" "false"
+        set_env_var_if_provided "TRIVY_PKG_TYPES" "${{ inputs.vuln-type }}" "os,library"
+        set_env_var_if_provided "TRIVY_SEVERITY" "${{ inputs.severity }}" "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"


Can we use inputs.severity.default? (https://docs.github.com/en/actions/sharing-automations/creating-actions/metadata-syntax-for-github-actions#inputsinput_iddefault)

I was looking for it, but I couldn't. I'll try it. Thanks.

Ah, this is just a document about syntax of action.yaml. I don't think it's available, but I'll give it a shot.

It doesn't work. An empty string is filled.
1a12292

Got it. Thanks that you checked that.

That's a bummer.... 🫤

Signed-off-by: knqyf263 <knqyf263@gmail.com>

This reverts commit 1a12292.

DmitriyLewen

LGTM

simar7 · 2024-10-10T01:10:02Z

action.yaml

+        # Set environment variables, handling those with default values
+        # cf. https://aquasecurity.github.io/trivy/latest/docs/configuration/#environment-variables
+        set_env_var_if_provided "TRIVY_INPUT" "${{ inputs.input }}" ""
+        set_env_var_if_provided "TRIVY_EXIT_CODE" "${{ inputs.exit-code }}" ""


If it isn't set, is the default equivalent to a zero for this case?

I'm aware that would be the default Trivy behavior (if exit code is not specified), I am just not sure how GitHub Actions interprets an empty string in this case.

If it isn't set, is the default equivalent to a zero for this case?

The action will not set TRIVY_EXIT_CODE and Trivy CLI just uses the default value.

I am just not sure how GitHub Actions interprets an empty string in this case.

If the input is empty or the same as a default value, it doesn't set an environment variable.

Roy-Gal-Git · 2024-10-10T10:37:10Z

@knqyf263 Does your fix work for all TRIVY_XXX variables or you have to use set_env_var_if_provided for every one of them?

I'm encountering the TOOMANYREQUESTS issue #389.
I tried bumping trivy-action to v0.25.0 as people suggested and it didn't solve the problem.
Yesterday v0.26.0 was released where the caching mechanism was added by default but it didn't solve the problem either (well, makes sense as I'm still past the rate limit..).
When I tried adding env variables to set TRIVY_DB_REPOSITORY and TRIVY_JAVA_DB_REPOSITORY (on v0.26.0) I encountered this exact problem.

I don't see that TRIVY_DB_REPOSITORY and TRIVY_JAVA_DB_REPOSITORY are addressed in the code.

knqyf263 · 2024-10-10T10:45:28Z

TRIVY_DB_REPOSITORY and TRIVY_JAVA_DB_REPOSITORY shouldn't be affected by this problem.

Roy-Gal-Git · 2024-10-10T10:46:43Z

@knqyf263 Then how come I'm experiencing the problem when I set them?

      - name: Trivy vulnerability scan
        uses: aquasecurity/trivy-action@0.26.0
        with:
          scan-type: image
          image-ref: 'FILTERED'
          trivy-config: .trivy/trivy.yaml
        env:
          TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
          TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db:1

My trivy-config is ignored.

Roy-Gal-Git · 2024-10-10T10:49:06Z

What I understand is that whenever any TRIVY_XXX variable is set trivy-action would completely ignore action inputs.

knqyf263 · 2024-10-10T10:58:10Z

What I understand is that whenever any TRIVY_XXX variable is set trivy-action would completely ignore action inputs.

No, only variables defined in input are affected.

knqyf263 · 2024-10-10T11:00:45Z

I tested and it worked.
https://github.com/knqyf263/trivy-action-test/actions/runs/11272540264/workflow

Roy-Gal-Git · 2024-10-10T11:10:40Z

@knqyf263 Can you test it with trivy-config set too?

knqyf263 · 2024-10-10T11:37:50Z

Worked.
https://github.com/knqyf263/trivy-action-test/actions/runs/11273222891/workflow#L16

Please create a small repository to reproduce your issue.

Roy-Gal-Git · 2024-10-10T12:24:27Z

No need if it worked :) I'll wait for your merge. Thanks!

Roy-Gal-Git · 2024-10-13T08:53:22Z

I upgraded to 0.27.0 and now a new error was raised...

Error: Bad request - jaxxstorm/action-install-gh-release@v1.10.0 is not allowed to be used in FILTERED. Actions in this workflow must be: within a repository owned by FILTERED, created by GitHub, or verified in the GitHub Marketplace.

I know that there's an open issue (#409) about this bug.
Do you have a time estimation for this fix? I'm in the loop of bumping trivy-action versions and being held by new bugs that appear in each new version.

knqyf263 · 2024-10-14T04:40:29Z

I don't think it's a bug. It just depends on your configuration. We'll fix it anyway, though.

fix: set envs when passed

de3a310

Signed-off-by: knqyf263 <knqyf263@gmail.com>

knqyf263 requested review from simar7 and DmitriyLewen October 9, 2024 08:05

DmitriyLewen reviewed Oct 9, 2024

View reviewed changes

knqyf263 added 2 commits October 9, 2024 13:56

use inputs.<input_id>.default

1a12292

Signed-off-by: knqyf263 <knqyf263@gmail.com>

Revert "use inputs.<input_id>.default"

0a8669c

This reverts commit 1a12292.

knqyf263 marked this pull request as ready for review October 9, 2024 10:17

knqyf263 requested a review from DmitriyLewen October 9, 2024 10:17

knqyf263 changed the title ~~fix: set envs when passed~~ fix: set envs only when passed Oct 9, 2024

DmitriyLewen approved these changes Oct 9, 2024

View reviewed changes

simar7 reviewed Oct 10, 2024

View reviewed changes

simar7 self-requested a review October 11, 2024 04:48

simar7 approved these changes Oct 11, 2024

View reviewed changes

simar7 merged commit 5681af8 into master Oct 11, 2024
3 checks passed

simar7 deleted the fix/config_file branch October 11, 2024 04:48

Roy-Gal-Git mentioned this pull request Oct 13, 2024

Cannot run trivy as of today, problem with dependency #409

Open

Kieffer87 mentioned this pull request Oct 15, 2024

Bump aquasecurity/trivy-action from 0.24.0 to 0.27.0 tkhom3/gha-workflows#37

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: set envs only when passed #405

fix: set envs only when passed #405

knqyf263 commented Oct 9, 2024

DmitriyLewen Oct 9, 2024

knqyf263 Oct 9, 2024

knqyf263 Oct 9, 2024 •

edited

Loading

knqyf263 Oct 9, 2024 •

edited

Loading

DmitriyLewen Oct 9, 2024

simar7 Oct 10, 2024

DmitriyLewen left a comment

simar7 Oct 10, 2024

simar7 Oct 10, 2024

knqyf263 Oct 10, 2024

knqyf263 Oct 10, 2024

Roy-Gal-Git commented Oct 10, 2024 •

edited

Loading

knqyf263 commented Oct 10, 2024

Roy-Gal-Git commented Oct 10, 2024 •

edited

Loading

Roy-Gal-Git commented Oct 10, 2024

knqyf263 commented Oct 10, 2024

knqyf263 commented Oct 10, 2024

Roy-Gal-Git commented Oct 10, 2024

knqyf263 commented Oct 10, 2024

Roy-Gal-Git commented Oct 10, 2024

Roy-Gal-Git commented Oct 13, 2024

knqyf263 commented Oct 14, 2024 •

edited

Loading

fix: set envs only when passed #405

fix: set envs only when passed #405

Conversation

knqyf263 commented Oct 9, 2024

Problem

Proposed Solution

Implementation Details

Testing

Choose a reason for hiding this comment

Choose a reason for hiding this comment

knqyf263 Oct 9, 2024 • edited Loading

Choose a reason for hiding this comment

knqyf263 Oct 9, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

DmitriyLewen left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Roy-Gal-Git commented Oct 10, 2024 • edited Loading

knqyf263 commented Oct 10, 2024

Roy-Gal-Git commented Oct 10, 2024 • edited Loading

Roy-Gal-Git commented Oct 10, 2024

knqyf263 commented Oct 10, 2024

knqyf263 commented Oct 10, 2024

Roy-Gal-Git commented Oct 10, 2024

knqyf263 commented Oct 10, 2024

Roy-Gal-Git commented Oct 10, 2024

Roy-Gal-Git commented Oct 13, 2024

knqyf263 commented Oct 14, 2024 • edited Loading

knqyf263 Oct 9, 2024 •

edited

Loading

knqyf263 Oct 9, 2024 •

edited

Loading

Roy-Gal-Git commented Oct 10, 2024 •

edited

Loading

Roy-Gal-Git commented Oct 10, 2024 •

edited

Loading

knqyf263 commented Oct 14, 2024 •

edited

Loading