feat: add support for trivy on lock files (#249)

* feat: add support for trivy on lock files

* Add trivy_enable to workflow

* Use mp/trivy_on_lock_files

* Only check for critical vulnerabilities

* Add trivy_severity input

* Add trivy stuff to individual build workflows

* Revert to main

* Add github format

Author: puehringer

.github/actions/build-node-python/action.yml

@@ -59,6 +59,13 @@ inputs:
     description: "run node bundle"
     default: "false"
     required: false
+  trivy_enable:
+    description: "Enable trivy scans on lock files"
+    default: "false"  # Enable this by default?
+    required: false
+  trivy_severity:
+    description: "Severity level for trivy"
+    required: false
   chromatic_enable:
     description: "Enable Chromatic tests"
     required: false
@@ -287,6 +294,35 @@ runs:
         UV_SYSTEM_PYTHON: 1  # In case uv pip is used, install into the system python environment https://docs.astral.sh/uv/guides/integration/github/#using-uv-pip
         UV_HTTP_TIMEOUT: 300  # https://docs.astral.sh/uv/reference/environment/#uv_http_timeout
 
+    # Trivy
+    - name: Run Trivy vulnerability scanner on uv.lock
+      if: inputs.trivy_enable == 'true' && inputs.enable_python == 'true'
+      uses: aquasecurity/[email protected]
+      with:
+        scan-type: "fs"
+        scan-ref: "uv.lock"
+        exit-code: "1"
+        format: "github"
+        scanners: "vuln"
+        severity: ${{ inputs.trivy_severity || 'CRITICAL' }}
+        ignore-unfixed: false
+        # The cache update takes quite long, so let's try to disable it for now: https://github.com/aquasecurity/trivy-action#cache
+        cache: "false"
+      continue-on-error: false
+    - name: Run Trivy vulnerability scanner on yarn.lock
+      if: inputs.trivy_enable == 'true' && inputs.enable_node == 'true'
+      uses: aquasecurity/[email protected]
+      with:
+        scan-type: "fs"
+        scan-ref: "yarn.lock"
+        exit-code: "1"
+        format: "github"
+        scanners: "vuln"
+        severity: ${{ inputs.trivy_severity || 'CRITICAL' }}
+        ignore-unfixed: false
+        # The cache update takes quite long, so let's try to disable it for now: https://github.com/aquasecurity/trivy-action#cache
+        cache: "false"
+      continue-on-error: false
     # Node
     - name: Save yarn cache
       uses: actions/cache/save@v4

.github/workflows/build-docker-artifacts.yml

@@ -294,7 +294,7 @@ jobs:
           image-ref: ${{ matrix.component.image_ref }}
           # Disable scanning the current directory (defaults to .)
           scan-ref: "/dev/null"
-          format: "table"
+          format: "github"
           exit-code: "1"
           ignore-unfixed: false
           vuln-type: "os,library"

.github/workflows/build-node-python.yml

@@ -74,6 +74,15 @@ on:
         required: false
         description: Unique id per workflow run. Must be set to unique value if dispatched multiple times for a single workflow.
         default: ""
+      trivy_enable:
+        description: "Enable trivy scans on lock files"
+        default: false  # Enable this by default?
+        type: boolean
+        required: false
+      trivy_severity:
+        description: "Severity for the trivy scans"
+        type: string
+        required: false
       chromatic_enable:
         description: 'Enable Chromatic tests'
         required: false
@@ -151,6 +160,8 @@ jobs:
           enable_python: false
           # We probably won't need Rust on Node builds...
           # enable_rust: ${{ inputs.rust_enable }}
+          trivy_enable: ${{ inputs.trivy_enable }}
+          trivy_severity: ${{ inputs.trivy_severity }}
           run_parallel: ${{ inputs.run_parallel }}
           node_version: ${{ vars.NODE_VERSION || inputs.node_version }}
           npm_registry: ${{ vars.NPM_REGISTRY }}
@@ -191,6 +202,8 @@ jobs:
         with:
           enable_node: false
           enable_python: true
+          trivy_enable: ${{ inputs.trivy_enable }}
+          trivy_severity: ${{ inputs.trivy_severity }}
           enable_rust: ${{ inputs.rust_enable }}
           run_parallel: ${{ inputs.run_parallel }}
           node_version: ${{ vars.NODE_VERSION || inputs.node_version }}
@@ -282,6 +295,8 @@ jobs:
       - name: Build node and python
         uses: ./tmp/github-workflows/.github/actions/build-node-python
         with:
+          trivy_enable: ${{ inputs.trivy_enable }}
+          trivy_severity: ${{ inputs.trivy_severity }}
           enable_rust: ${{ inputs.rust_enable }}
           run_parallel: ${{ inputs.run_parallel }}
           node_version: ${{ vars.NODE_VERSION || inputs.node_version }}
@@ -425,6 +440,8 @@ jobs:
       - name: Build node and python
         uses: ./tmp/github-workflows/.github/actions/build-node-python
         with:
+          trivy_enable: ${{ inputs.trivy_enable }}
+          trivy_severity: ${{ inputs.trivy_severity }}
           enable_rust: ${{ inputs.rust_enable }}
           run_parallel: ${{ inputs.run_parallel }}
           node_version: ${{ vars.NODE_VERSION || inputs.node_version }}

.github/workflows/build-node.yml

@@ -7,6 +7,15 @@ on:
         type: string
         required: false
         default: ${{ github.ref || github.head_ref }}
+      trivy_enable:
+        description: "Enable trivy scans on lock files"
+        default: false  # Enable this by default?
+        type: boolean
+        required: false
+      trivy_severity:
+        description: "Severity for the trivy scans"
+        type: string
+        required: false
       chromatic_enable:
         description: 'Enable Chromatic tests'
         required: false
@@ -69,6 +78,8 @@ jobs:
         with:
           enable_node: true
           enable_python: false
+          trivy_enable: ${{ inputs.trivy_enable }}
+          trivy_severity: ${{ inputs.trivy_severity }}
           node_version: ${{ vars.NODE_VERSION || inputs.node_version }}
           npm_registry: ${{ vars.NPM_REGISTRY }}
           github_ro_token: ${{ github.event.repository.private == true && secrets.DATAVISYN_BOT_REPO_TOKEN || github.token  }}

.github/workflows/build-python.yml

@@ -7,6 +7,15 @@ on:
         type: string
         required: false
         default: ${{ github.ref || github.head_ref }}
+      trivy_enable:
+        description: "Enable trivy scans on lock files"
+        default: false  # Enable this by default?
+        type: boolean
+        required: false
+      trivy_severity:
+        description: "Severity for the trivy scans"
+        type: string
+        required: false
       runs_on:
         type: string
         required: false
@@ -56,6 +65,8 @@ jobs:
         with:
           enable_node: false
           enable_python: true
+          trivy_enable: ${{ inputs.trivy_enable }}
+          trivy_severity: ${{ inputs.trivy_severity }}
           github_ro_token: ${{ github.event.repository.private == true && secrets.DATAVISYN_BOT_REPO_TOKEN || github.token  }}
           python_version: ${{ vars.PYTHON_VERSION || inputs.python_version }}
           enable_python_cache: ${{ inputs.runs_on != 'self-hosted' }}