Skip to content

[CRAVEX] SCA Integrations: Trivy #1811

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 26 commits into from
Aug 20, 2025
Merged

[CRAVEX] SCA Integrations: Trivy #1811

merged 26 commits into from
Aug 20, 2025

Conversation

@tdruez
Copy link
Contributor

@tdruez tdruez commented Aug 15, 2025 •
edited
Loading

This PR adds support for importing SBOMs generated with Trivy

Changes:

Workflow

Available at .github/workflows/sca-integration-trivy.yml

Documentation:

# This workflow:
#  1. Generates a CycloneDX SBOM for a container image using Trivy.
#  2. Uploads the SBOM as a GitHub artifact for future inspection.
#  3. Loads the SBOM into ScanCode.io for further analysis.
#  4. Runs assertions to verify that the SBOM was properly processed in ScanCode.io.
#
# It runs on demand, and once a week (scheduled).

tdruez added 26 commits August 15, 2025 16:25
@tdruez
Add GH workflow to generate SBOM with Trivy #1729
c037b25 
Signed-off-by: tdruez <[email protected]>
@tdruez
Refine the args for the trivy-action #1729
b07efe7 
Signed-off-by: tdruez <[email protected]>
@tdruez
Fix the path for upload #1729
1c06d3d 
Signed-off-by: tdruez <[email protected]>
@tdruez
Adjust the trivy workflow #1729
5dc7125 
Signed-off-by: tdruez <[email protected]>
@tdruez
Use a smaller image as input #1729
fdf5bc7 
Signed-off-by: tdruez <[email protected]>
@tdruez
Load the Trivy SBOM into SCIO #1729
033e180 
Signed-off-by: tdruez <[email protected]>
@tdruez
Update the inputs-path #1729
3b1a354 
Signed-off-by: tdruez <[email protected]>
@tdruez
Add support for vulnerabilities in load_sbom pipeline #1729
4efd1d2 
Signed-off-by: tdruez <[email protected]>
@tdruez
Test running scanpipe for checking the loaded content #1729
caaebf0 
Signed-off-by: tdruez <[email protected]>
@tdruez
Test running scanpipe for checking the loaded content #1729
3359dbc 
Signed-off-by: tdruez <[email protected]>
@tdruez
Use the file-as-inputs-path branch #1729
3ade026 
Signed-off-by: tdruez <[email protected]>
@tdruez
Fix #1729
0956cc2 
Signed-off-by: tdruez <[email protected]>
@tdruez
Add proper assertionf or validation of the workflow #1729
b479775 
Signed-off-by: tdruez <[email protected]>
@tdruez
Fix syntax as single line #1729
d258b1c 
Signed-off-by: tdruez <[email protected]>
@tdruez
Fix syntax #1729
efe91c1 
Signed-off-by: tdruez <[email protected]>
@tdruez
Move back at the root #1729
1f033ed 
Signed-off-by: tdruez <[email protected]>
@tdruez
debug #1729
057ce04 
Signed-off-by: tdruez <[email protected]>
@tdruez
Use scancodeio-repo-branch for vuln loading
7a025ce 
Signed-off-by: tdruez <[email protected]>
@tdruez
Add assertion on create dependencies
555408a 
Signed-off-by: tdruez <[email protected]>
@tdruez
Run once a week (every 7 days) at 00:00 UTC on Sunday
5b69e6a 
Signed-off-by: tdruez <[email protected]>
@tdruez
Refine workflow and documentation
2c93e1d 
Signed-off-by: tdruez <[email protected]>
@tdruez
Fix indentation
960a85c 
Signed-off-by: tdruez <[email protected]>
@tdruez
Merge main and fix conflicts #1729
4edb23e 
Signed-off-by: tdruez <[email protected]>
@tdruez
Generate a test SBOM for alpine:3.17.0 #1729
ddb7b41 
Signed-off-by: tdruez <[email protected]>
@tdruez
Restore the workflow using python:3.13.0-slim #1729
d16b63d 
Signed-off-by: tdruez <[email protected]>
@tdruez
Add unit test for the Trivy integration SBOM support #1729
3c55d5a 
Signed-off-by: tdruez <[email protected]>
@tdruez tdruez changed the title SCA Integrations [CRAVEX] SCA Integrations: Trivy Aug 19, 2025
@tdruez tdruez merged commit 19a2bd4 into main Aug 20, 2025
14 checks passed
@tdruez tdruez deleted the 1729-sca-integrations-trivy branch August 20, 2025 07:54
@tdruez tdruez mentioned this pull request Aug 20, 2025
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@tdruez