DEVOPS-61 scan dockerofkrishnadhas docker images with trivy

Author: githubofkrishnadhas

.github/workflows/scan-docker-images-using-trivy.yaml

@@ -47,6 +47,8 @@ jobs:
             duration=$((end_time - start_time))
             echo "Scanning ended for image: $image at $(date)"
             echo "Duration for image $image: $duration seconds"
+            echo "Removing image $image"
+            docker image rmi -f $image
           done
     - name: Completed
       run: |

.github/workflows/scan-secific-docker-image-using-trivy.yaml

@@ -0,0 +1,33 @@
+name: scan-docker-images-using-trivy-dockerhubofkrishnadhas
+on:
+  workflow_dispatch:
+    inputs:
+      docker_image_name:
+        description: 'complete image name. eg: dockerofkrishnadhas/alpine:latest'
+        required: true
+        type: string
+        default: 'dockerofkrishnadhas/alpine:latest'
+
+run-name: scan-docker-image-${{ inputs.docker_image_name }}-using-trivy
+jobs:
+  scan-docker-image-using-trivy-from-dockerofkrishnadhas:
+    runs-on: ubuntu-latest
+    steps:
+    - name: set up docker and scan docker image  for vulnerabilities
+      uses: docker-practice/actions-setup-docker@master
+    -  run: |
+        set -x
+        docker version
+            docker pull ${{inputs.docker_image_name}}
+            start_time=$(date +%s)
+            echo "Scanning started for image:  ${{inputs.docker_image_name}} at $(date)"
+            docker run -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy image ${{inputs.docker_image_name}}
+            end_time=$(date +%s)
+            duration=$((end_time - start_time))
+            echo "Scanning ended for image: $image at $(date)"
+            echo "Duration for image $image: $duration seconds"
+            docker system prune -af
+          done
+    - name: Completed
+      run: |
+        echo "program completed successfully"

README.md

@@ -1,2 +1,29 @@
 # trivy-to-scan-all-docker-images-on-dockerofkrishnadhas
 trivy to scan for vulnerabilities on all docker images in dockerofkrishnadhas dockerhub account
+
+# How code works
+
+* Uses Python language
+* using the api end points :
+  * https://hub.docker.com/v2/repositories/{account_name}/ --> lists the images under specific dockerhub account.
+  * https://hub.docker.com/v2/namespaces/{account_name}/repositories/{image}/tags --> lists image tags under a specific image
+
+* Later uses github workflow to pull the image from dockerhub registry and scan using trivy.
+
+### Dependabot is in Guard
+
+dependabot checks for package updates on `weekly` basis on `every saturday` at `9.00` `Asia/kolkata timezone`
+
+```
+The Github workflow is set as cron set to run every week (weekly once) and can be triggered manually at any time.   
+workflow file : scan-docker-images-using-trivy.yaml         
+```
+
+```
+The Github workflow is set as manual and can be triggered any time.   
+workflow file : scan-specific-docker-image-using-trivy.yaml         
+```
+
+
+**The dockerhub registry `dockerofkrishnadhas` is a public one.**
+***While using private registry authentication needs to be performed.***