Vulnerability Scanning with Trivy #42
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Vulnerability Scanning with Trivy | |
| on: | |
| workflow_dispatch: | |
| schedule: | |
| - cron: '0 0 * * *' # Test Trivy daily at midnight | |
| permissions: | |
| contents: read | |
| security-events: write # for uploading SARIF results to the security tab | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }} | |
| cancel-in-progress: true | |
| defaults: | |
| run: | |
| shell: bash | |
| jobs: | |
| trivy-repo: | |
| name: Trivy vulnerability scanner - Repository | |
| runs-on: ubuntu-22.04 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: main | |
| - name: Install Trivy | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| mkdir -p /home/runner/vuln-cache | |
| latest=$(gh release view --repo aquasecurity/trivy --json tagName -q '.tagName' | head -n 1) | |
| wget https://github.com/aquasecurity/trivy/releases/download/${latest}/trivy_${latest#v}_Linux-64bit.deb | |
| sudo dpkg -i trivy_${latest#v}_Linux-64bit.deb | |
| - name: Run Trivy vulnerability scanner | |
| run: | | |
| trivy fs --quiet --scanners vuln,secret,misconfig --format sarif --cache-dir /home/runner/vuln-cache \ | |
| --severity LOW,MEDIUM,HIGH,CRITICAL --output trivy-lxd-repo-scan-results.sarif . | |
| - name: Cache trivy and vulnerability database | |
| uses: actions/cache/save@v4 | |
| with: | |
| path: /home/runner/vuln-cache | |
| key: trivy-cache-${{ github.run_id }} | |
| - name: Upload Trivy scan results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: "trivy-lxd-repo-scan-results.sarif" | |
| sha: ${{ github.sha }} | |
| ref: refs/heads/main | |
| trivy-snap: | |
| name: Trivy vulnerability scanner - Snap | |
| runs-on: ubuntu-22.04 | |
| needs: trivy-repo | |
| strategy: | |
| matrix: | |
| version: | |
| - "latest" | |
| - "5.21" | |
| - "5.0" | |
| - "4.0" | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Install Trivy | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| latest=$(gh release view --repo aquasecurity/trivy --json tagName -q '.tagName' | head -n 1) | |
| wget https://github.com/aquasecurity/trivy/releases/download/${latest}/trivy_${latest#v}_Linux-64bit.deb | |
| sudo dpkg -i trivy_${latest#v}_Linux-64bit.deb | |
| - name: Restore cached Trivy and vulnerability database | |
| uses: actions/cache/restore@v4 | |
| with: | |
| path: /home/runner/vuln-cache | |
| key: trivy-cache-${{ github.run_id }} | |
| - name: Download snap for scan | |
| run: | | |
| snap download lxd --channel=${{ matrix.version }}/stable | |
| unsquashfs ./lxd*.snap | |
| - name: Run Trivy vulnerability scanner | |
| run: | | |
| trivy rootfs --quiet --scanners vuln,secret,misconfig --format sarif --cache-dir /home/runner/vuln-cache \ | |
| --severity LOW,MEDIUM,HIGH,CRITICAL --output ${{ matrix.version }}-stable.sarif squashfs-root | |
| - name: Flag alerts from snap scanning | |
| run: | | |
| jq '.runs[].tool.driver.rules[] |= (.shortDescription.text |= "Snap scan - " + .)' ${{ matrix.version }}-stable.sarif > tmp.json | |
| mv tmp.json ${{ matrix.version }}-stable.sarif | |
| - name: Get correct SHA for the version used in snap | |
| run: | | |
| git fetch --tags | |
| tag=$(git tag -l '${{ (matrix.version == 'latest' && 'lxd-') || format('lxd-{0}.', matrix.version) }}*' --sort=-v:refname | head -n 1) | |
| sha=$(git rev-list -n 1 $tag) | |
| echo "sha=$sha" >> $GITHUB_ENV | |
| - name: Upload Trivy scan results to GitHub security tab | |
| uses: github/codeql-action/upload-sarif@v3 | |
| with: | |
| sarif_file: "${{ matrix.version }}-stable.sarif" | |
| # Use the sha from the version used in the snap. | |
| sha: ${{ env.sha }} | |
| ref: refs/heads/${{ (matrix.version == 'latest' && 'main') || format('stable-{0}', matrix.version) }} |