Skip to content

Commit

Permalink
Merge pull request #97 from catenax-ng/trivyworkflow
Browse files Browse the repository at this point in the history 
chore: Updated Trivy workflow
  • Loading branch information
@almadigabor
almadigabor authored Apr 16, 2024
2 parents 275f455 + a8cae44 commit 44d12b3
Showing 1 changed file with 10 additions and 7 deletions.
17 changes: 10 additions & 7 deletions .github/workflows/trivy-scan.yml
View file
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
################################################################################
# Copyright (c) 2021-2022 Contributors to the Eclipse Foundation
# Copyright (c) 2021,2024 Contributors to the Eclipse Foundation
# Copyright (c) 2024 T-Systems International GmbH

# See the NOTICE file(s) distributed with this work for additional
# information regarding copyright ownership.
Expand All @@ -25,7 +26,7 @@ on:
- main
schedule:
# Once a day
- cron: "0 0 * * *"
- cron: "0 0 * * 0"

workflow_dispatch:
# Trigger manually
Expand All @@ -41,16 +42,18 @@ jobs:

steps:
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@0.12.0
uses: aquasecurity/trivy-action@0.18.0

Check warning on line 45 in .github/workflows/trivy-scan.yml

View workflow job for this annotation

GitHub Actions / Analyze

[MEDIUM] Unpinned Actions Full Length Commit SHA 

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.

Check warning on line 45 in .github/workflows/trivy-scan.yml

View workflow job for this annotation

GitHub Actions / Analyze

[MEDIUM] Unpinned Actions Full Length Commit SHA 

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.

Check warning on line 45 in .github/workflows/trivy-scan.yml

View workflow job for this annotation

GitHub Actions / Analyze

[LOW] Unpinned Actions Full Length Commit SHA 

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.

Check warning on line 45 in .github/workflows/trivy-scan.yml

View workflow job for this annotation

GitHub Actions / Analyze

[LOW] Unpinned Actions Full Length Commit SHA 

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.

Check warning on line 45 in .github/workflows/trivy-scan.yml

View workflow job for this annotation

GitHub Actions / Analyze

[LOW] Unpinned Actions Full Length Commit SHA 

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.
with:
# Path to Docker image
image-ref: "tractusx/managed-simple-data-exchanger-frontend:latest"
image-ref: "tractusx/managed-simple-data-exchanger-backend:latest" # Pull image from Docker Hub and run Trivy vulnerability scanner
format: "sarif"
output: "trivy-results.sarif"
vuln-type: "os,library"
exit-code: "1" # Trivy exits with code 1 if vulnerabilities are found, causing the workflow step to fail.
severity: "CRITICAL,HIGH" # While vulnerabilities of all severities are reported in the SARIF output, the exit code and workflow failure are triggered only by these specified severities (CRITICAL or HIGH).
hide-progress: false

- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v2
uses: github/codeql-action/upload-sarif@v3

Check warning on line 55 in .github/workflows/trivy-scan.yml

View workflow job for this annotation

GitHub Actions / Analyze

[MEDIUM] Unpinned Actions Full Length Commit SHA 

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.

Check warning on line 55 in .github/workflows/trivy-scan.yml

View workflow job for this annotation

GitHub Actions / Analyze

[MEDIUM] Unpinned Actions Full Length Commit SHA 

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.

Check warning on line 55 in .github/workflows/trivy-scan.yml

View workflow job for this annotation

GitHub Actions / Analyze

[LOW] Unpinned Actions Full Length Commit SHA 

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.

Check warning on line 55 in .github/workflows/trivy-scan.yml

View workflow job for this annotation

GitHub Actions / Analyze

[LOW] Unpinned Actions Full Length Commit SHA 

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.

Check warning on line 55 in .github/workflows/trivy-scan.yml

View workflow job for this annotation

GitHub Actions / Analyze

[LOW] Unpinned Actions Full Length Commit SHA 

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload. When selecting a SHA, you should verify it is from the action's repository and not a repository fork.
if: always()
with:
sarif_file: "trivy-results.sarif"

Expand Down

0 comments on commit 44d12b3

Please sign in to comment.