Bump trufflesecurity/trufflehog from 3.95.8 to 3.95.9 #180
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Supply Chain Security | |
| on: | |
| push: | |
| branches: ["master"] | |
| pull_request: | |
| branches: ["master"] | |
| schedule: | |
| - cron: "45 03 * * *" | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| security-events: write | |
| actions: read | |
| concurrency: | |
| group: supply-chain-security-${{ github.workflow_ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| repository-scan: | |
| name: Repository Scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 | |
| - name: Trivy filesystem scan | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 | |
| with: | |
| scan-type: fs | |
| scan-ref: . | |
| format: sarif | |
| output: trivy-fs.sarif | |
| severity: HIGH,CRITICAL | |
| ignore-unfixed: true | |
| - name: Normalize filesystem SARIF category | |
| env: | |
| SARIF_CATEGORY: trivy/filesystem | |
| SARIF_FILE: trivy-fs.sarif | |
| run: | | |
| python - <<'PY' | |
| import json | |
| import os | |
| from pathlib import Path | |
| path = Path(os.environ["SARIF_FILE"]) | |
| sarif = json.loads(path.read_text(encoding="utf-8")) | |
| for run in sarif.get("runs", []): | |
| run.setdefault("automationDetails", {})["id"] = os.environ["SARIF_CATEGORY"] | |
| path.write_text(json.dumps(sarif, separators=(",", ":")), encoding="utf-8") | |
| PY | |
| - name: Upload filesystem SARIF | |
| if: ${{ always() }} | |
| uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 | |
| with: | |
| sarif_file: trivy-fs.sarif | |
| category: trivy/filesystem | |
| - name: Trivy IaC/config scan | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 | |
| with: | |
| scan-type: config | |
| scan-ref: . | |
| format: sarif | |
| output: trivy-config.sarif | |
| severity: MEDIUM,HIGH,CRITICAL | |
| - name: Normalize IaC SARIF category | |
| env: | |
| SARIF_CATEGORY: trivy/config | |
| SARIF_FILE: trivy-config.sarif | |
| run: | | |
| python - <<'PY' | |
| import json | |
| import os | |
| from pathlib import Path | |
| path = Path(os.environ["SARIF_FILE"]) | |
| sarif = json.loads(path.read_text(encoding="utf-8")) | |
| for run in sarif.get("runs", []): | |
| run.setdefault("automationDetails", {})["id"] = os.environ["SARIF_CATEGORY"] | |
| path.write_text(json.dumps(sarif, separators=(",", ":")), encoding="utf-8") | |
| PY | |
| - name: Upload IaC SARIF | |
| if: ${{ always() }} | |
| uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 | |
| with: | |
| sarif_file: trivy-config.sarif | |
| category: trivy/config | |
| image-scan: | |
| name: Image Scan (${{ matrix.service }}) | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - service: aimer-web | |
| context: ./services/aimer-web | |
| dockerfile: ./services/aimer-web/Dockerfile | |
| image: aimer-web-supply-chain:ci | |
| - service: aimer-rag | |
| context: ./services/aimer-web | |
| dockerfile: ./services/aimer-web/Dockerfile.rag | |
| image: aimer-rag-supply-chain:ci | |
| - service: MAGE | |
| context: ./services/MAGE | |
| dockerfile: ./services/MAGE/Dockerfile | |
| image: mage-supply-chain:ci | |
| - service: FARM | |
| context: ./services/FARM | |
| dockerfile: ./services/FARM/Dockerfile | |
| image: farm-supply-chain:ci | |
| steps: | |
| - name: Free Disk Space (Ubuntu) | |
| uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be | |
| with: | |
| tool-cache: false | |
| android: true | |
| dotnet: true | |
| haskell: true | |
| large-packages: true | |
| docker-images: false | |
| swap-storage: true | |
| - name: Checkout code | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c | |
| - name: Build local image | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a | |
| with: | |
| context: ${{ matrix.context }} | |
| file: ${{ matrix.dockerfile }} | |
| push: false | |
| load: true | |
| tags: ${{ matrix.image }} | |
| - name: Generate CycloneDX SBOM | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 | |
| with: | |
| scan-type: image | |
| image-ref: ${{ matrix.image }} | |
| format: cyclonedx | |
| output: sbom-${{ matrix.service }}.json | |
| - name: Scan image | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 | |
| with: | |
| scan-type: image | |
| image-ref: ${{ matrix.image }} | |
| format: sarif | |
| output: trivy-image-${{ matrix.service }}.sarif | |
| severity: HIGH,CRITICAL | |
| ignore-unfixed: true | |
| - name: Normalize image SARIF category | |
| env: | |
| SARIF_CATEGORY: trivy/image/${{ matrix.service }} | |
| SARIF_FILE: trivy-image-${{ matrix.service }}.sarif | |
| run: | | |
| python - <<'PY' | |
| import json | |
| import os | |
| from pathlib import Path | |
| path = Path(os.environ["SARIF_FILE"]) | |
| sarif = json.loads(path.read_text(encoding="utf-8")) | |
| for run in sarif.get("runs", []): | |
| run.setdefault("automationDetails", {})["id"] = os.environ["SARIF_CATEGORY"] | |
| path.write_text(json.dumps(sarif, separators=(",", ":")), encoding="utf-8") | |
| PY | |
| - name: Upload image SARIF | |
| if: ${{ always() }} | |
| uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 | |
| with: | |
| sarif_file: trivy-image-${{ matrix.service }}.sarif | |
| category: trivy/image/${{ matrix.service }} | |
| - name: Upload SBOM | |
| if: ${{ always() }} | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a | |
| with: | |
| name: sbom-${{ matrix.service }} | |
| path: sbom-${{ matrix.service }}.json | |
| if-no-files-found: error |