From f62b4d2406cdc8eedf3acd8b8c57eb5413fae701 Mon Sep 17 00:00:00 2001 From: Rui Vieira Date: Sat, 26 Oct 2024 22:24:23 +0100 Subject: [PATCH 1/3] Add Trivy scanning --- .github/workflows/security.yaml | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 .github/workflows/security.yaml diff --git a/.github/workflows/security.yaml b/.github/workflows/security.yaml new file mode 100644 index 0000000..6808766 --- /dev/null +++ b/.github/workflows/security.yaml @@ -0,0 +1,27 @@ +name: Security +on: + push: + branches: + - main + pull_request: +jobs: + build: + name: Build + runs-on: ubuntu-20.04 + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Run Trivy vulnerability scanner in repo mode + uses: aquasecurity/trivy-action@0.28.0 + with: + scan-type: "fs" + ignore-unfixed: true + format: "sarif" + output: "trivy-results.sarif" + severity: "CRITICAL,HIGH" + + - name: Upload Trivy scan results to GitHub Security tab + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: "trivy-results.sarif" From 1d78bab369def546c30e85bebfddc0278b0cff22 Mon Sep 17 00:00:00 2001 From: Rui Vieira Date: Sat, 26 Oct 2024 22:30:48 +0100 Subject: [PATCH 2/3] Update severity --- .github/workflows/security.yaml | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/.github/workflows/security.yaml b/.github/workflows/security.yaml index 6808766..3ec9bd4 100644 --- a/.github/workflows/security.yaml +++ b/.github/workflows/security.yaml @@ -17,11 +17,5 @@ jobs: with: scan-type: "fs" ignore-unfixed: true - format: "sarif" - output: "trivy-results.sarif" - severity: "CRITICAL,HIGH" - - - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v3 - with: - sarif_file: "trivy-results.sarif" + format: "table" + severity: "CRITICAL,HIGH,MEDIUM" From 72cd35f569f3397f4807636f844f50559ae6647e Mon Sep 17 00:00:00 2001 From: Rui Vieira Date: Tue, 25 Feb 2025 13:11:10 +0000 Subject: [PATCH 3/3] fix: Upload scan results to security tab --- .github/workflows/security.yaml | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/.github/workflows/security.yaml b/.github/workflows/security.yaml index 3ec9bd4..dc84a07 100644 --- a/.github/workflows/security.yaml +++ b/.github/workflows/security.yaml @@ -8,14 +8,24 @@ jobs: build: name: Build runs-on: ubuntu-20.04 + permissions: + contents: read + security-events: write steps: - name: Checkout code uses: actions/checkout@v4 - - name: Run Trivy vulnerability scanner in repo mode + - name: Trivy scan uses: aquasecurity/trivy-action@0.28.0 with: - scan-type: "fs" - ignore-unfixed: true - format: "table" - severity: "CRITICAL,HIGH,MEDIUM" + scan-type: 'fs' + format: 'sarif' + output: 'trivy-results.sarif' + severity: 'MEDIUM,HIGH,CRITICAL' + exit-code: '0' + ignore-unfixed: false + + - name: Update Security tab + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: 'trivy-results.sarif' \ No newline at end of file