Trivy CVE Scan CI (#79)

Signed-off-by: Nikolay Mordvintsev <[email protected]>

Author: Nikolay1224

.github/workflows/trivy_image_check.yaml

@@ -1,83 +1,58 @@
 name: Trivy images check
 
-env:
-  MODULES_MODULE_NAME: ${{ vars.MODULE_NAME }}
-  MODULES_MODULE_SOURCE: ${{ vars.DEV_MODULE_SOURCE }}
-  PR_NUMBER: ${{ github.event.pull_request.number }}
-  MODULES_REGISTRY: ${{ vars.DEV_REGISTRY }}
-  MODULES_REGISTRY_LOGIN: ${{ vars.DEV_MODULES_REGISTRY_LOGIN }}
-  MODULES_REGISTRY_PASSWORD: ${{ secrets.DEV_MODULES_REGISTRY_PASSWORD }}
-
 on:
   pull_request:
+    types: [opened, reopened, labeled, synchronize]
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+    inputs:
+      release_branch:
+        description: 'release branch name, example: release-1.68'
+        required: false
 
 jobs:
   build_dev:
+    if: github.event_name == 'pull_request'
     uses: ./.github/workflows/build_dev.yml
     secrets: inherit
-  test:
+  cve_scan_on_pr:
+    if: github.event_name == 'pull_request'
     name: Trivy images check
     runs-on: [self-hosted, regular]
     needs: [build_dev]
-
     steps:
       - uses: actions/checkout@v4
-      - uses: deckhouse/modules-actions/setup@v1
-
-      - name: Check and Install Latest Trivy
-        run: |
-          mkdir -p $HOME/bin
-
-          LATEST_VERSION=$(curl -sL https://api.github.com/repos/aquasecurity/trivy/releases/latest | jq -r ".tag_name")
-          CLEAN_VERSION=${LATEST_VERSION#v}
-
-          INSTALL_TRIVY=true
-
-          if [[ -f "$HOME/bin/trivy" ]]; then
-            INSTALLED_VERSION=$("$HOME/bin/trivy" --version | grep -oE 'Version: [0-9]+\.[0-9]+\.[0-9]+' | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')
-            if [ "$INSTALLED_VERSION" == "$CLEAN_VERSION" ]; then
-              echo "Trivy is already up-to-date (version $INSTALLED_VERSION)."
-              INSTALL_TRIVY=false
-            else
-              echo "Updating Trivy from version $INSTALLED_VERSION to $CLEAN_VERSION."
-            fi
-          else
-            echo "Trivy is not installed. Installing version $CLEAN_VERSION."
-          fi
-
-          if [ "$INSTALL_TRIVY" = true ]; then
-            wget https://github.com/aquasecurity/trivy/releases/download/$LATEST_VERSION/trivy_${CLEAN_VERSION}_Linux-64bit.tar.gz -O trivy.tar.gz
-            tar zxvf trivy.tar.gz -C $HOME/bin
-          fi
-
-          echo "$HOME/bin" >> $GITHUB_PATH
-
-      - name: Run Trivy vulnerability scanner in image mode
+      - uses: deckhouse/modules-actions/cve_scan@main
+        with:
+          image: ${{ vars.DEV_MODULE_SOURCE }}/${{ vars.MODULE_NAME }}
+          tag: pr${{ github.event.number }}
+          module_name: ${{ vars.MODULE_NAME }}
+          dd_url: ${{secrets.DEFECTDOJO_HOST}}
+          dd_token: ${{secrets.DEFECTDOJO_API_TOKEN}}
+          trivy_registry: ${{ vars.PROD_REGISTRY }}
+          trivy_registry_user: ${{ vars.PROD_MODULES_REGISTRY_LOGIN }}
+          trivy_registry_password: ${{ secrets.PROD_MODULES_READ_REGISTRY_PASSWORD }}
+          deckhouse_private_repo: ${{secrets.DECKHOUSE_PRIVATE_REPO}}
+  cve_scan:
+    if: github.event_name != 'pull_request'
+    name: Trivy images check
+    runs-on: [self-hosted, regular]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Sets env vars for manual run
         run: |
-          exit_code=0
-          image_name=$MODULES_MODULE_SOURCE/$MODULES_MODULE_NAME
-          image_name_with_tag=$MODULES_MODULE_SOURCE/$MODULES_MODULE_NAME:pr$PR_NUMBER
-          
-          crane_output=$(crane export $image_name_with_tag | tar -xOf - images_digests.json | jq -c 'to_entries[]')
-          
-          while read -r item; do
-            key=$(echo "$item" | jq -r '.key')
-            value=$(echo "$item" | jq -r '.value')
-
-            echo 'Checking image '$key' '$value
-
-            trivy image --quiet --config trivy-silent.yaml --format table $image_name@$value
-
-            result=$(trivy image --quiet --config trivy-silent.yaml --format json $image_name@$value)
-
-            vulnerabilities=$(echo "$result" | jq '[.Results[]? | select(has("Vulnerabilities")) | .Vulnerabilities | length] | add // 0')
-
-            if [ "$vulnerabilities" -gt 0 ]; then
-              echo "There are vulnerabilities in image"
-              exit_code=1
-            else
-              echo "There are no vulnerabilities in image"
-            fi
-          done <<< "$crane_output"
-
-          exit $exit_code
+          echo "MODULE_IMAGE_TAG=${{ github.event.inputs.release_branch || 'main' }}" >> $GITHUB_ENV
+        if: github.event_name != 'workflow_dispatch'
+      - uses: deckhouse/modules-actions/cve_scan@main
+        with:
+          image: ${{ vars.DEV_MODULE_SOURCE }}/${{ vars.MODULE_NAME }}
+          tag: ${{ env.MODULE_IMAGE_TAG || 'main' }}
+          module_name: ${{ vars.MODULE_NAME }}
+          dd_url: ${{secrets.DEFECTDOJO_HOST}}
+          dd_token: ${{secrets.DEFECTDOJO_API_TOKEN}}
+          trivy_registry: ${{ vars.PROD_REGISTRY }}
+          trivy_registry_user: ${{ vars.PROD_MODULES_REGISTRY_LOGIN }}
+          trivy_registry_password: ${{ secrets.PROD_MODULES_READ_REGISTRY_PASSWORD }}
+          deckhouse_private_repo: ${{secrets.DECKHOUSE_PRIVATE_REPO}}