Skip to content

Commit 4a7b6c3

Browse files
committed
Update Trivy versions
1 parent 2f6ccd1 commit 4a7b6c3

File tree

4 files changed

+101
-5
lines changed

4 files changed

+101
-5
lines changed

.github/workflows/ci.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ jobs:
4444
- name: Push images
4545
run: ./build --push
4646
- name: Run Trivy vulnerability scanner
47-
uses: aquasecurity/trivy-action@6c175e9c4083a92bbca2f9724c8a5e33bc2d97a5 # v0.30.0
47+
uses: aquasecurity/trivy-action@76071ef0d7ec797419534a183b498b4d6366cf37 # v0.31.0
4848
with:
4949
image-ref: '${{ steps.build.outputs.LATEST_IMAGE_TAG }}'
5050
format: 'sarif'
@@ -55,6 +55,6 @@ jobs:
5555
TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db
5656
TRIVY_JAVA_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-java-db,public.ecr.aws/aquasecurity/trivy-java-db
5757
- name: Upload Trivy scan results to GitHub Security tab
58-
uses: github/codeql-action/upload-sarif@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
58+
uses: github/codeql-action/upload-sarif@fca7ace96b7d713c7035871441bd52efbe39e27e # v3.28.19
5959
with:
6060
sarif_file: 'trivy-results.sarif'

.github/workflows/registry-cleanup.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ jobs:
1313
packages: write
1414
steps:
1515
- name: Prune untagged images
16-
uses: vlaurin/action-ghcr-prune@0cf7d39f88546edd31965acba78cdcb0be14d641 #v0.6.0
16+
uses: vlaurin/action-ghcr-prune@0cf7d39f88546edd31965acba78cdcb0be14d641 # v0.6.0
1717
with:
1818
token: ${{ secrets.GITHUB_TOKEN }}
1919
organization: Datadog

.github/workflows/vuln-check.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ jobs:
3030
docker-images: false # Do not remove locally built images (including trivy scanner)
3131

3232
- name: Run Trivy vulnerability scanner
33-
uses: aquasecurity/trivy-action@6c175e9c4083a92bbca2f9724c8a5e33bc2d97a5 # v0.30.0
33+
uses: aquasecurity/trivy-action@76071ef0d7ec797419534a183b498b4d6366cf37 # v0.31.0
3434
with:
3535
image-ref: 'ghcr.io/datadog/dd-trace-java-docker-build:latest'
3636
format: 'sarif'
@@ -42,7 +42,7 @@ jobs:
4242
TRIVY_JAVA_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-java-db,public.ecr.aws/aquasecurity/trivy-java-db
4343

4444
- name: Upload Trivy scan results to GitHub Security tab
45-
uses: github/codeql-action/upload-sarif@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
45+
uses: github/codeql-action/upload-sarif@fca7ace96b7d713c7035871441bd52efbe39e27e # v3.28.19
4646
if: always()
4747
with:
4848
sarif_file: 'trivy-results.sarif'

update-oracle-jdk.sh

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
#!/usr/bin/env bash
2+
set -eu
3+
4+
# This script updates the Oracle JDK download URL in the Dockerfile
5+
6+
# Function to update the Dockerfile with the new URL
7+
update_dockerfile() {
8+
local new_url="$1"
9+
local dockerfile="Dockerfile"
10+
11+
# Check if the file exists
12+
if [ ! -f "$dockerfile" ]; then
13+
echo "Error: $dockerfile not found"
14+
exit 1
15+
fi
16+
17+
# Get the current URL for comparison
18+
local current_url=$(grep -o "https://javadl.oracle.com/webapps/download/AutoDL?BundleId=[^\"]*" "$dockerfile" | head -1)
19+
20+
if [ "$current_url" = "$new_url" ]; then
21+
echo "URL is already up to date: $current_url"
22+
exit 0
23+
fi
24+
25+
# Update the Dockerfile, replacing the old URL with the new one
26+
sed -i.bak -E "s|https://javadl.oracle.com/webapps/download/AutoDL\?BundleId=[^\"]*|$new_url|g" "$dockerfile"
27+
28+
echo "Updated Dockerfile with new Oracle JDK 8 download URL:"
29+
echo "- Old: $current_url"
30+
echo "- New: $new_url"
31+
32+
# Print diff to show what changed
33+
echo "Changes made to Dockerfile:"
34+
diff -u Dockerfile.bak Dockerfile || true
35+
36+
# Remove backup file
37+
rm Dockerfile.bak
38+
}
39+
40+
# Function to fetch the latest Oracle JDK 8 URL from Oracle's website
41+
fetch_latest_oracle_jdk8_url() {
42+
echo "Checking Oracle's website for the latest JDK 8 download URL..."
43+
44+
# This needs to be updated with the actual logic to find the latest URL
45+
# Since Oracle's download page requires authentication, we need a different approach
46+
47+
# Option 1: Check a reliable source like AdoptOpenJDK for the latest version number
48+
local latest_version=$(curl -s "https://api.adoptium.net/v3/info/release_versions?release_type=ga&architecture=x64&image_type=jdk&vendor=oracle&version=8" | jq -r '.versions[0].openjdk_version')
49+
50+
echo "Latest Oracle JDK 8 version: $latest_version"
51+
52+
# For now, we need to manually update this when Oracle releases a new version
53+
# We can track Oracle releases at: https://www.oracle.com/java/technologies/javase/javase8-archive-downloads.html
54+
55+
# Current URL (as of the script creation)
56+
local latest_url="https://javadl.oracle.com/webapps/download/AutoDL?BundleId=252034_8a1589aa0fe24566b4337beee47c2d29"
57+
58+
echo "Using Oracle JDK 8 download URL: $latest_url"
59+
echo "Note: This URL needs to be manually updated periodically when Oracle releases updates."
60+
61+
echo "$latest_url"
62+
}
63+
64+
check_for_update() {
65+
# We can check the Oracle release notes or version information
66+
# For example: https://www.oracle.com/java/technologies/javase/8u-relnotes.html
67+
68+
echo "Checking for Oracle JDK 8 updates..."
69+
70+
# This is a placeholder for actual update checking logic
71+
# You would need to track the current version (from the BundleId in the URL)
72+
# and compare it with the latest available version
73+
74+
# The actual implementation would depend on how you want to track updates
75+
# Options include:
76+
# 1. Periodic manual checks of Oracle's release pages
77+
# 2. Subscribing to Oracle's security bulletins or release announcements
78+
# 3. Using a third-party API that tracks Java releases
79+
}
80+
81+
# Main execution
82+
echo "Starting Oracle JDK URL update process..."
83+
84+
LATEST_URL=$(fetch_latest_oracle_jdk8_url)
85+
86+
if [ -z "$LATEST_URL" ]; then
87+
echo "Error: Could not determine Oracle JDK 8 download URL"
88+
exit 1
89+
fi
90+
91+
update_dockerfile "$LATEST_URL"
92+
93+
echo "Tip: To keep the Oracle JDK URL up-to-date, you should:"
94+
echo "1. Periodically check https://www.oracle.com/java/technologies/javase/javase8-archive-downloads.html"
95+
echo "2. Look for the 'jdk-8u*-linux-x64.tar.gz' download link"
96+
echo "3. Update this script with the new BundleId when a new version is available"

0 commit comments

Comments
 (0)