Skip to content

Commit 8da8e45

Browse files
authored
CI: Update Trivy DB (#38397)
## Description Update trivy db download failure. Fixes # https://app.zenhub.com/workspaces/stability-pod-6690c4814e31602e25cab7fd/issues/gh/appsmithorg/appsmith/38398 Tested: https://github.com/appsmithorg/appsmith/actions/runs/12543112349 ## Automation /ok-to-test tags="" ### 🔍 Cypress test results <!-- This is an auto-generated comment: Cypress test results --> > [!CAUTION] > If you modify the content in this section, you are likely to disrupt the CI result for your PR. <!-- end of auto-generated comment: Cypress test results --> ## Communication Should the DevRel and Marketing teams inform users about this change? - [ ] Yes - [x] No <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **New Features** - Enhanced script to automatically download Trivy vulnerability database if not present - Added capability to create and manage temporary database download directory - **Chores** - Cleaned up script by removing unnecessary line <!-- end of auto-generated comment: release notes by coderabbit.ai -->
1 parent f9664a3 commit 8da8e45

File tree

1 file changed

+9
-1
lines changed

1 file changed

+9
-1
lines changed

scripts/trivy_vulnerabilities_data.sh

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,14 +71,22 @@ case "$IMAGE" in
7171
*) product_name="UNKNOWN" ;;
7272
esac
7373

74+
# Download Trivy DB if necessary
75+
if [ ! -d "$HOME/.cache/trivy/db" ]; then
76+
echo "Trivy DB not found. Downloading..."
77+
TRIVY_TEMP_DIR=$(mktemp -d)
78+
trivy --cache-dir $TRIVY_TEMP_DIR image --download-db-only
79+
tar -cf ./db.tar.gz -C $TRIVY_TEMP_DIR/db metadata.json trivy.db
80+
rm -rf $TRIVY_TEMP_DIR
81+
fi
82+
7483
# Run Trivy scan
7584
echo "Running Trivy scan for image: $IMAGE..."
7685
trivy image --db-repository public.ecr.aws/aquasecurity/trivy-db --java-db-repository public.ecr.aws/aquasecurity/trivy-java-db --insecure --format json "$IMAGE" > "trivy_vulnerabilities.json" || {
7786
echo "Error: Trivy scan failed for image: $IMAGE"
7887
exit 1
7988
}
8089

81-
8290
# Process vulnerabilities and generate CSV
8391
if jq -e '.Results | length > 0' "trivy_vulnerabilities.json" > /dev/null; then
8492
jq -r --arg product "$product_name" '.Results[]? | .Vulnerabilities[]? | "\(.VulnerabilityID),\($product),TRIVY,\(.Severity)"' "trivy_vulnerabilities.json" | sort -u > "$NEW_VULN_FILE"

0 commit comments

Comments
 (0)