Skip to content

Commit 2f022dc

Browse files
sidnhssidnhs
authored
CCM-15550: Disable Trivy in CI (#255)
1 parent 76e4caa commit 2f022dc

File tree

7 files changed

+107
-99
lines changed

7 files changed

+107
-99
lines changed

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
- [ ] I have added tests to cover my changes
2626
- [ ] I have updated the documentation accordingly
2727
- [ ] This PR is a result of pair or mob programming
28-
- [ ] If I have used the 'skip-trivy-package' label I have done so responsibly and in the knowledge that this is being fixed as part of a separate ticket/PR.
28+
<!-- - [ ] If I have used the 'skip-trivy-package' label I have done so responsibly and in the knowledge that this is being fixed as part of a separate ticket/PR. TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549 -->
2929

3030
---
3131

‎.github/actions/trivy-iac/action.yaml‎

Lines changed: 19 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,20 @@
1-
name: "Trivy IaC Scan"
2-
description: "Scan Terraform IaC using Trivy"
3-
runs:
4-
using: "composite"
5-
steps:
6-
- name: "Trivy Terraform IaC Scan"
7-
shell: bash
8-
run: |
9-
components_exit_code=0
10-
modules_exit_code=0
11-
asdf plugin add trivy || true
12-
asdf install trivy || true
13-
./scripts/terraform/trivy-scan.sh --mode iac ./infrastructure/terraform/components || components_exit_code=$?
14-
./scripts/terraform/trivy-scan.sh --mode iac ./infrastructure/terraform/modules || modules_exit_code=$?
1+
# TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
2+
# name: "Trivy IaC Scan"
3+
# description: "Scan Terraform IaC using Trivy"
4+
# runs:
5+
# using: "composite"
6+
# steps:
7+
# - name: "Trivy Terraform IaC Scan"
8+
# shell: bash
9+
# run: |
10+
# components_exit_code=0
11+
# modules_exit_code=0
12+
# asdf plugin add trivy || true
13+
# asdf install trivy || true
14+
# ./scripts/terraform/trivy-scan.sh --mode iac ./infrastructure/terraform/components || components_exit_code=$?
15+
# ./scripts/terraform/trivy-scan.sh --mode iac ./infrastructure/terraform/modules || modules_exit_code=$?
1516

16-
if [ $components_exit_code -ne 0 ] || [ $modules_exit_code -ne 0 ]; then
17-
echo "Trivy misconfigurations detected."
18-
exit 1
19-
fi
17+
# if [ $components_exit_code -ne 0 ] || [ $modules_exit_code -ne 0 ]; then
18+
# echo "Trivy misconfigurations detected."
19+
# exit 1
20+
# fi

‎.github/actions/trivy-package/action.yaml‎

Lines changed: 17 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,18 @@
1-
name: "Trivy Package Scan"
2-
description: "Scan project packages using Trivy"
3-
runs:
4-
using: "composite"
5-
steps:
6-
- name: "Trivy Package Scan"
7-
shell: bash
8-
run: |
9-
exit_code=0
10-
asdf plugin add trivy || true
11-
asdf install trivy || true
12-
./scripts/terraform/trivy-scan.sh --mode package . || exit_code=$?
1+
# TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
2+
# name: "Trivy Package Scan"
3+
# description: "Scan project packages using Trivy"
4+
# runs:
5+
# using: "composite"
6+
# steps:
7+
# - name: "Trivy Package Scan"
8+
# shell: bash
9+
# run: |
10+
# exit_code=0
11+
# asdf plugin add trivy || true
12+
# asdf install trivy || true
13+
# ./scripts/terraform/trivy-scan.sh --mode package . || exit_code=$?
1314

14-
if [ $exit_code -ne 0 ]; then
15-
echo "Trivy has detected package vulnerablilites. Please refer to https://nhsd-confluence.digital.nhs.uk/spaces/RIS/pages/1257636917/PLAT-KOP-012+-+Trivy+Pipeline+Vulnerability+Scanning+Exemption"
16-
exit 1
17-
fi
15+
# if [ $exit_code -ne 0 ]; then
16+
# echo "Trivy has detected package vulnerablilites. Please refer to https://nhsd-confluence.digital.nhs.uk/spaces/RIS/pages/1257636917/PLAT-KOP-012+-+Trivy+Pipeline+Vulnerability+Scanning+Exemption"
17+
# exit 1
18+
# fi

‎.github/workflows/cicd-1-pull-request.yaml‎

Lines changed: 23 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,8 @@ jobs:
3636
is_version_prerelease: ${{ steps.variables.outputs.is_version_prerelease }}
3737
does_pull_request_exist: ${{ steps.pr_exists.outputs.does_pull_request_exist }}
3838
pr_number: ${{ steps.pr_exists.outputs.pr_number }}
39-
skip_trivy_package: ${{ steps.skip_trivy.outputs.skip_trivy_package }}
39+
# TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
40+
# skip_trivy_package: ${{ steps.skip_trivy.outputs.skip_trivy_package }}
4041
steps:
4142
- name: "Checkout code"
4243
uses: actions/checkout@v5
@@ -76,26 +77,27 @@ jobs:
7677
echo "does_pull_request_exist=false" >> $GITHUB_OUTPUT
7778
echo "pr_number=" >> $GITHUB_OUTPUT
7879
fi
79-
- name: "Determine if Trivy package scan should be skipped"
80-
id: skip_trivy
81-
env:
82-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
83-
PR_NUMBER: ${{ steps.pr_exists.outputs.pr_number }}
84-
run: |
85-
if [[ -z "$PR_NUMBER" ]]; then
86-
echo "No pull request detected; Trivy package scan will run."
87-
echo "skip_trivy_package=false" >> $GITHUB_OUTPUT
88-
exit 0
89-
fi
80+
# TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
81+
# - name: "Determine if Trivy package scan should be skipped"
82+
# id: skip_trivy
83+
# env:
84+
# GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
85+
# PR_NUMBER: ${{ steps.pr_exists.outputs.pr_number }}
86+
# run: |
87+
# if [[ -z "$PR_NUMBER" ]]; then
88+
# echo "No pull request detected; Trivy package scan will run."
89+
# echo "skip_trivy_package=false" >> $GITHUB_OUTPUT
90+
# exit 0
91+
# fi
9092

91-
labels=$(gh pr view "$PR_NUMBER" --json labels --jq '.labels[].name')
92-
echo "Labels on PR #$PR_NUMBER: $labels"
93+
# labels=$(gh pr view "$PR_NUMBER" --json labels --jq '.labels[].name')
94+
# echo "Labels on PR #$PR_NUMBER: $labels"
9395

94-
if echo "$labels" | grep -Fxq 'skip-trivy-package'; then
95-
echo "skip_trivy_package=true" >> $GITHUB_OUTPUT
96-
else
97-
echo "skip_trivy_package=false" >> $GITHUB_OUTPUT
98-
fi
96+
# if echo "$labels" | grep -Fxq 'skip-trivy-package'; then
97+
# echo "skip_trivy_package=true" >> $GITHUB_OUTPUT
98+
# else
99+
# echo "skip_trivy_package=false" >> $GITHUB_OUTPUT
100+
# fi
99101
- name: "List variables"
100102
run: |
101103
export BUILD_DATETIME_LONDON="${{ steps.variables.outputs.build_datetime_london }}"
@@ -119,7 +121,8 @@ jobs:
119121
build_epoch: "${{ needs.metadata.outputs.build_epoch }}"
120122
nodejs_version: "${{ needs.metadata.outputs.nodejs_version }}"
121123
python_version: "${{ needs.metadata.outputs.python_version }}"
122-
skip_trivy_package: ${{ needs.metadata.outputs.skip_trivy_package == 'true' }}
124+
# TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
125+
# skip_trivy_package: ${{ needs.metadata.outputs.skip_trivy_package == 'true' }}
123126
terraform_version: "${{ needs.metadata.outputs.terraform_version }}"
124127
version: "${{ needs.metadata.outputs.version }}"
125128
# secrets: inherit

‎.github/workflows/stage-1-commit.yaml‎

Lines changed: 41 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -23,10 +23,11 @@ on:
2323
description: "Python version, set by the CI/CD pipeline workflow"
2424
required: true
2525
type: string
26-
skip_trivy_package:
27-
description: "Skip Trivy package scan when true"
28-
type: boolean
29-
default: false
26+
# TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
27+
# skip_trivy_package:
28+
# description: "Skip Trivy package scan when true"
29+
# type: boolean
30+
# default: false
3031
terraform_version:
3132
description: "Terraform version, set by the CI/CD pipeline workflow"
3233
required: true
@@ -144,41 +145,42 @@ jobs:
144145
uses: asdf-vm/actions/setup@b7bcd026f18772e44fe1026d729e1611cc435d47 # v4
145146
- name: "Lint Terraform"
146147
uses: ./.github/actions/lint-terraform
147-
trivy-iac:
148-
name: "Trivy IaC Scan"
149-
runs-on: ubuntu-latest
150-
timeout-minutes: 10
151-
needs: detect-terraform-changes
152-
if: needs.detect-terraform-changes.outputs.terraform_changed == 'true'
153-
permissions:
154-
contents: read
155-
packages: read
156-
env:
157-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
158-
steps:
159-
- name: "Checkout code"
160-
uses: actions/checkout@v4
161-
- name: "Setup ASDF"
162-
uses: asdf-vm/actions/setup@b7bcd026f18772e44fe1026d729e1611cc435d47 # v4
163-
- name: "Trivy IaC Scan"
164-
uses: ./.github/actions/trivy-iac
165-
trivy-package:
166-
if: ${{ !inputs.skip_trivy_package }}
167-
name: "Trivy Package Scan"
168-
runs-on: ubuntu-latest
169-
timeout-minutes: 10
170-
permissions:
171-
contents: read
172-
packages: read
173-
env:
174-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
175-
steps:
176-
- name: "Checkout code"
177-
uses: actions/checkout@v4
178-
- name: "Setup ASDF"
179-
uses: asdf-vm/actions/setup@1902764435ca0dd2f3388eea723a4f92a4eb8302
180-
- name: "Trivy Package Scan"
181-
uses: ./.github/actions/trivy-package
148+
# TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
149+
# trivy-iac:
150+
# name: "Trivy IaC Scan"
151+
# runs-on: ubuntu-latest
152+
# timeout-minutes: 10
153+
# needs: detect-terraform-changes
154+
# if: needs.detect-terraform-changes.outputs.terraform_changed == 'true'
155+
# permissions:
156+
# contents: read
157+
# packages: read
158+
# env:
159+
# GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
160+
# steps:
161+
# - name: "Checkout code"
162+
# uses: actions/checkout@v4
163+
# - name: "Setup ASDF"
164+
# uses: asdf-vm/actions/setup@b7bcd026f18772e44fe1026d729e1611cc435d47 # v4
165+
# - name: "Trivy IaC Scan"
166+
# uses: ./.github/actions/trivy-iac
167+
# trivy-package:
168+
# if: ${{ !inputs.skip_trivy_package }}
169+
# name: "Trivy Package Scan"
170+
# runs-on: ubuntu-latest
171+
# timeout-minutes: 10
172+
# permissions:
173+
# contents: read
174+
# packages: read
175+
# env:
176+
# GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
177+
# steps:
178+
# - name: "Checkout code"
179+
# uses: actions/checkout@v4
180+
# - name: "Setup ASDF"
181+
# uses: asdf-vm/actions/setup@1902764435ca0dd2f3388eea723a4f92a4eb8302
182+
# - name: "Trivy Package Scan"
183+
# uses: ./.github/actions/trivy-package
182184
count-lines-of-code:
183185
name: "Count lines of code"
184186
runs-on: ubuntu-latest

‎.tool-versions‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,8 @@ pre-commit 3.6.0
66
python 3.14.0
77
terraform 1.10.1
88
terraform-docs 0.19.0
9-
trivy 0.69.2
109
vale 3.6.0
10+
# trivy 0.61.0 - TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
1111
# ==============================================================================
1212
# The section below is reserved for Docker image versions.
1313

‎scripts/terraform/terraform.mk‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -118,9 +118,10 @@ terraform-validate-all: # Validate all Terraform components @Quality
118118
fi; \
119119
done
120120

121-
terraform-sec: # Run Trivy IaC security scanning on Terraform code @Quality
122-
# Example: make terraform-sec
123-
./scripts/terraform/trivy-scan.sh --mode iac infrastructure/terraform
121+
# TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
122+
# terraform-sec: # Run Trivy IaC security scanning on Terraform code @Quality
123+
# # Example: make terraform-sec
124+
# ./scripts/terraform/trivy-scan.sh --mode iac infrastructure/terraform
124125

125126
terraform-docs: # Generate Terraform documentation - optional: component=[specific component, or all if omitted] @Quality
126127
# Example: make terraform-docs component=mycomp
@@ -168,6 +169,6 @@ ${VERBOSE}.SILENT: \
168169
terraform-output \
169170
terraform-plan \
170171
terraform-plan-destroy \
171-
terraform-sec \
172+
# terraform-sec \
172173
terraform-validate \
173174
terraform-validate-all \

0 commit comments

Comments
 (0)