Skip to content
This repository was archived by the owner on May 14, 2025. It is now read-only.

Commit 420a498

Browse files
author
Corneil du Plessis
authored
Adding Trivy scan to ga (#5316)
1 parent 49fa6d6 commit 420a498

File tree

3 files changed

+73
-0
lines changed

3 files changed

+73
-0
lines changed

‎.github/workflows/build-snapshot-worker.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,3 +101,29 @@ jobs:
101101
- name: Clean cache
102102
run: |
103103
find ~/.m2/repository -type d -name '*SNAPSHOT' | xargs rm -fr
104+
scan:
105+
runs-on: ubuntu-latest
106+
steps:
107+
- uses: actions/checkout@v2
108+
- name: Run Trivy vulnerability scanner in repo mode
109+
uses: aquasecurity/trivy-action@master
110+
with:
111+
scan-type: 'fs'
112+
ignore-unfixed: true
113+
format: 'sarif'
114+
output: 'trivy-results.sarif'
115+
severity: 'CRITICAL,HIGH'
116+
- name: Upload Trivy scan results to GitHub Security tab
117+
uses: github/codeql-action/upload-sarif@v2
118+
with:
119+
sarif_file: 'trivy-results.sarif'
120+
- name: 'Scanned'
121+
shell: bash
122+
run: echo "::info ::Scanned"
123+
done:
124+
runs-on: ubuntu-latest
125+
needs: [ scan, build ]
126+
steps:
127+
- name: 'Done'
128+
shell: bash
129+
run: echo "::info ::Done"

‎.github/workflows/ci-pr.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,3 +31,24 @@ jobs:
3131
- name: Clean cache
3232
run: |
3333
find ~/.m2/repository -type d -name '*SNAPSHOT' | xargs rm -fr
34+
scan:
35+
runs-on: ubuntu-latest
36+
steps:
37+
- uses: actions/checkout@v2
38+
- name: Run Trivy vulnerability scanner in repo mode
39+
uses: aquasecurity/trivy-action@master
40+
with:
41+
scan-type: 'fs'
42+
ignore-unfixed: true
43+
format: 'table'
44+
severity: 'CRITICAL,HIGH'
45+
- name: 'Scanned'
46+
shell: bash
47+
run: echo "::info ::Scanned"
48+
done:
49+
runs-on: ubuntu-latest
50+
needs: [ scan, build ]
51+
steps:
52+
- name: 'Done'
53+
shell: bash
54+
run: echo "::info ::Done"

‎.github/workflows/ci.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,3 +76,29 @@ jobs:
7676
- name: Clean cache
7777
run: |
7878
find ~/.m2/repository -type d -name '*SNAPSHOT' | xargs rm -fr
79+
scan:
80+
runs-on: ubuntu-latest
81+
steps:
82+
- uses: actions/checkout@v2
83+
- name: Run Trivy vulnerability scanner in repo mode
84+
uses: aquasecurity/trivy-action@master
85+
with:
86+
scan-type: 'fs'
87+
ignore-unfixed: true
88+
format: 'sarif'
89+
output: 'trivy-results.sarif'
90+
severity: 'CRITICAL,HIGH'
91+
- name: Upload Trivy scan results to GitHub Security tab
92+
uses: github/codeql-action/upload-sarif@v2
93+
with:
94+
sarif_file: 'trivy-results.sarif'
95+
- name: 'Scanned'
96+
shell: bash
97+
run: echo "::info ::Scanned"
98+
done:
99+
runs-on: ubuntu-latest
100+
needs: [ scan, build ]
101+
steps:
102+
- name: 'Done'
103+
shell: bash
104+
run: echo "::info ::Done"

0 commit comments

Comments
 (0)