Skip to content

Commit f09651b

Browse files
TomFernTomFern
authored
docs: add Trivy security scanner recipe (#464)
## 📝 Description Add the Trivy security scanner recipe to the docs. We need this to get a backlink from Trivy.
1 parent ab833cb commit f09651b

File tree

6 files changed

+459
-3
lines changed

6 files changed

+459
-3
lines changed

‎docs/docs/using-semaphore/recipes/infracost.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ description: Implement FinOps in your pipeline with Infracost
33
sidebar_position: 1
44
---
55

6-
# Infracost
6+
# Infracost FinOps
77

88
The Infracost CLI tool parses Terraform files and estimates costs for your infrastructure.
99

‎docs/docs/using-semaphore/recipes/trivy.md

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
---
2+
description: Open source security scans in your CI pipelines
3+
sidebar_position: 2
4+
---
5+
6+
# Trivy Vulnerability Scanning
7+
8+
import Tabs from '@theme/Tabs';
9+
import TabItem from '@theme/TabItem';
10+
import Available from '@site/src/components/Available';
11+
import VideoTutorial from '@site/src/components/VideoTutorial';
12+
import Steps from '@site/src/components/Steps';
13+
14+
This page explains how to run the open source [Trivy security scanner](https://github.com/aquasecurity/trivy) in Semaphore.
15+
16+
## Overview
17+
18+
Trivy is a comprehensive security scanner that detects various security issues across different targets.
19+
20+
It can scan:
21+
22+
- container images
23+
- software dependencies
24+
- Git repositories
25+
- VM images and OS packages
26+
- Kubernetes environments
27+
- Infrastructure-as-Code (IaC) files
28+
- filesystems for misconfigurations, leaked secrets, and license check
29+
30+
Trivy works with most programming languages and operating systems. You can check if your stack is supported in the [Trivy scanning coverage page](https://trivy.dev/latest/docs/coverage/).
31+
32+
## Install Trivy in Semaphore {#install}
33+
34+
You must install Trivy in the CI environment or use a Docker image with Trivy already installed.
35+
36+
To install Trivy in your CI environment, follow these steps:
37+
38+
<Steps>
39+
40+
1. Find the [latest Trivy release](https://github.com/aquasecurity/trivy/releases)
41+
2. Install Trivy using the package manager (or build from source)
42+
43+
```shell
44+
# replace with the latest release
45+
wget https://github.com/aquasecurity/trivy/releases/download/v0.65.0/trivy_0.65.0_Linux-32bit.deb
46+
sudo dpkg -i trivy_0.65.0_Linux-32bit.deb
47+
```
48+
49+
3. Run Trivy to scan your project. Use the `--exit-code 1` option to exit with error when the scan detects a problem
50+
51+
For example:
52+
53+
```shell
54+
checkout
55+
trivy fs --exit-code 1 .
56+
```
57+
58+
</Steps>
59+
60+
You must repeat Step 2 in every job that uses Trivy. Use the [prologue](../pipelines#prologue) if multiple jobs require Trivy.
61+
62+
## Enabling the cache {#cache}
63+
64+
Trivy keeps the last scans and vulnerability database in a local folder in the CI environment. You can speed up scanning jobs by caching this directory.
65+
66+
Trivy stores its database in `$HOME/.cache/trivy` by default, you can change it by specifing the [`--cache-dir`](https://trivy.dev/latest/docs/configuration/cache/) option. To persist this directory, use the [cache](../cache) command.
67+
68+
The following example runs a [file scan](#files) using the cache:
69+
70+
```shell
71+
cache restore trivy-db
72+
trivy fs --exit-code 1 .
73+
cache store trivy-db $HOME/.cache/trivy
74+
```
75+
76+
You can use this pattern with all types of scanning.
77+
78+
## Scan Files {#files}
79+
80+
Trivy filesystem scan finds problems in your local directories. In the CI environment, you must run [`checkout`](../../reference/toolbox#checkout) to clone the repository in the CI machine.
81+
82+
To run filesystem scan use `trivy fs`.
83+
Filesystem scan can find:
84+
85+
- vulnerabilies
86+
- misconfigurations
87+
- leaked secrets
88+
- license checks
89+
90+
### Vulnerabilities and leaked secrets {#vulnerabilities}
91+
92+
To find vulnerabilities or leaked secrets in your code or dependencies, execute `trivy fs` as follows:
93+
94+
```shell
95+
checkout
96+
trivy fs --exit-code 1 path/to/src
97+
```
98+
99+
### Misconfigurations {#misconfigurations}
100+
101+
By default, Trivy doesn't try to find misconfigurations, to enable this option, follow this example:
102+
103+
```shell
104+
checkout
105+
trivy --scanners misconfig --exit-code 1 path/to/src
106+
```
107+
108+
### License {#license}
109+
110+
To perform [license scanning](https://trivy.dev/latest/docs/scanner/license/) execute Trivy as follows:
111+
112+
```shell
113+
checkout
114+
trivy fs --scanners license --exit-code 1 path/to/src
115+
```
116+
117+
## Scan Container images
118+
119+
To scan your container images, including OS packages, use the following command. You might need to [authenticate with the Docker registry](../containers/docker#auth) first.
120+
121+
```shell
122+
docker pull IMAGE_NAME:TAG
123+
trivy image --exit-code 1 IMAGE_NAME:TAG
124+
```
125+
126+
As with filesystem scans, you can enable [misconfigurations](#misconfigurations) and [license](#license) scans in the container image.
127+
128+
## Generate SBOM
129+
130+
Trivy can generate a [Software Bill of Materials (SBOM)](https://trivy.dev/latest/docs/supply-chain/sbom/).
131+
132+
For example, these command generate the SBOM using the CycloneDX format:
133+
134+
```shell
135+
checkout
136+
trivy fs --format cyclonedx --output sbom.json path/to/src
137+
artifact push workflow sbom.json
138+
```
139+
140+
You can also generate SBOMs for Docker images with:
141+
142+
```shell
143+
docker pull IMAGE_NAME:TAG
144+
trivy image --format cyclonedx --output sbom.json IMAGE_NAME:TAG
145+
artifact push workflow sbom.json
146+
```
147+
148+
## See also
149+
150+
- [Trivy repository](https://github.com/aquasecurity/trivy)
151+
- [Trivy Documentation](https://trivy.dev/latest/docs/)
152+
- [Continuous Container Vulnerability Testing with Trivy](https://semaphore.io/blog/continuous-container-vulnerability-testing-with-trivy#h-vulnerability-testing-for-dependencies)

‎docs/versioned_docs/version-CE/using-semaphore/recipes/infracost.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ description: Implement FinOps in your pipeline with Infracost
33
sidebar_position: 1
44
---
55

6-
# Infracost
6+
# Infracost FinOps
77

88
The Infracost CLI tool parses Terraform files and estimates costs for your infrastructure.
99

‎docs/versioned_docs/version-CE/using-semaphore/recipes/trivy.md

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
---
2+
description: Open source security scans in your CI pipelines
3+
sidebar_position: 2
4+
---
5+
6+
# Trivy Vulnerability Scanning
7+
8+
import Tabs from '@theme/Tabs';
9+
import TabItem from '@theme/TabItem';
10+
import Available from '@site/src/components/Available';
11+
import VideoTutorial from '@site/src/components/VideoTutorial';
12+
import Steps from '@site/src/components/Steps';
13+
14+
This page explains how to run the open source [Trivy security scanner](https://github.com/aquasecurity/trivy) in Semaphore.
15+
16+
## Overview
17+
18+
Trivy is a comprehensive security scanner that detects various security issues across different targets.
19+
20+
It can scan:
21+
22+
- container images
23+
- software dependencies
24+
- Git repositories
25+
- VM images and OS packages
26+
- Kubernetes environments
27+
- Infrastructure-as-Code (IaC) files
28+
- filesystems for misconfigurations, leaked secrets, and license check
29+
30+
Trivy works with most programming languages and operating systems. You can check if your stack is supported in the [Trivy scanning coverage page](https://trivy.dev/latest/docs/coverage/).
31+
32+
## Install Trivy in Semaphore {#install}
33+
34+
You must install Trivy in the CI environment or use a Docker image with Trivy already installed.
35+
36+
To install Trivy in your CI environment, follow these steps:
37+
38+
<Steps>
39+
40+
1. Find the [latest Trivy release](https://github.com/aquasecurity/trivy/releases)
41+
2. Install Trivy using the package manager (or build from source)
42+
43+
```shell
44+
# replace with the latest release
45+
wget https://github.com/aquasecurity/trivy/releases/download/v0.65.0/trivy_0.65.0_Linux-32bit.deb
46+
sudo dpkg -i trivy_0.65.0_Linux-32bit.deb
47+
```
48+
49+
3. Run Trivy to scan your project. Use the `--exit-code 1` option to exit with error when the scan detects a problem
50+
51+
For example:
52+
53+
```shell
54+
checkout
55+
trivy fs --exit-code 1 .
56+
```
57+
58+
</Steps>
59+
60+
You must repeat Step 2 in every job that uses Trivy. Use the [prologue](../pipelines#prologue) if multiple jobs require Trivy.
61+
62+
## Enabling the cache {#cache}
63+
64+
Trivy keeps the last scans and vulnerability database in a local folder in the CI environment. You can speed up scanning jobs by caching this directory.
65+
66+
Trivy stores its database in `$HOME/.cache/trivy` by default, you can change it by specifing the [`--cache-dir`](https://trivy.dev/latest/docs/configuration/cache/) option. To persist this directory, use the [cache](../cache) command.
67+
68+
The following example runs a [file scan](#files) using the cache:
69+
70+
```shell
71+
cache restore trivy-db
72+
trivy fs --exit-code 1 .
73+
cache store trivy-db $HOME/.cache/trivy
74+
```
75+
76+
You can use this pattern with all types of scanning.
77+
78+
## Scan Files {#files}
79+
80+
Trivy filesystem scan finds problems in your local directories. In the CI environment, you must run [`checkout`](../../reference/toolbox#checkout) to clone the repository in the CI machine.
81+
82+
To run filesystem scan use `trivy fs`.
83+
Filesystem scan can find:
84+
85+
- vulnerabilies
86+
- misconfigurations
87+
- leaked secrets
88+
- license checks
89+
90+
### Vulnerabilities and leaked secrets {#vulnerabilities}
91+
92+
To find vulnerabilities or leaked secrets in your code or dependencies, execute `trivy fs` as follows:
93+
94+
```shell
95+
checkout
96+
trivy fs --exit-code 1 path/to/src
97+
```
98+
99+
### Misconfigurations {#misconfigurations}
100+
101+
By default, Trivy doesn't try to find misconfigurations, to enable this option, follow this example:
102+
103+
```shell
104+
checkout
105+
trivy --scanners misconfig --exit-code 1 path/to/src
106+
```
107+
108+
### License {#license}
109+
110+
To perform [license scanning](https://trivy.dev/latest/docs/scanner/license/) execute Trivy as follows:
111+
112+
```shell
113+
checkout
114+
trivy fs --scanners license --exit-code 1 path/to/src
115+
```
116+
117+
## Scan Container images
118+
119+
To scan your container images, including OS packages, use the following command. You might need to [authenticate with the Docker registry](../containers/docker#auth) first.
120+
121+
```shell
122+
docker pull IMAGE_NAME:TAG
123+
trivy image --exit-code 1 IMAGE_NAME:TAG
124+
```
125+
126+
As with filesystem scans, you can enable [misconfigurations](#misconfigurations) and [license](#license) scans in the container image.
127+
128+
## Generate SBOM
129+
130+
Trivy can generate a [Software Bill of Materials (SBOM)](https://trivy.dev/latest/docs/supply-chain/sbom/).
131+
132+
For example, these command generate the SBOM using the CycloneDX format:
133+
134+
```shell
135+
checkout
136+
trivy fs --format cyclonedx --output sbom.json path/to/src
137+
artifact push workflow sbom.json
138+
```
139+
140+
You can also generate SBOMs for Docker images with:
141+
142+
```shell
143+
docker pull IMAGE_NAME:TAG
144+
trivy image --format cyclonedx --output sbom.json IMAGE_NAME:TAG
145+
artifact push workflow sbom.json
146+
```
147+
148+
## See also
149+
150+
- [Trivy repository](https://github.com/aquasecurity/trivy)
151+
- [Trivy Documentation](https://trivy.dev/latest/docs/)
152+
- [Continuous Container Vulnerability Testing with Trivy](https://semaphore.io/blog/continuous-container-vulnerability-testing-with-trivy#h-vulnerability-testing-for-dependencies)

‎docs/versioned_docs/version-EE/using-semaphore/recipes/infracost.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ description: Implement FinOps in your pipeline with Infracost
33
sidebar_position: 1
44
---
55

6-
# Infracost
6+
# Infracost FinOps
77

88
The Infracost CLI tool parses Terraform files and estimates costs for your infrastructure.
99

0 commit comments

Comments
 (0)