Skip to content

Commit c962e4b

Browse files
fyzanshaik-atlanfyzanshaik-atlan
committed
chore(ci): add trivy image and deps scans
1 parent c73aa21 commit c962e4b

1 file changed

Lines changed: 184 additions & 0 deletions

File tree

‎.github/workflows/trivy.yml‎

Lines changed: 184 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,184 @@
1+
name: Trivy Image and Dependency Scan
2+
3+
on:
4+
pull_request:
5+
types: [opened, synchronize, reopened]
6+
branches: [main]
7+
push:
8+
branches: [main]
9+
10+
permissions:
11+
contents: read
12+
pull-requests: write
13+
actions: read
14+
security-events: write
15+
16+
jobs:
17+
trivy:
18+
runs-on: ubuntu-latest
19+
timeout-minutes: 20
20+
steps:
21+
- name: Checkout
22+
uses: actions/checkout@v4
23+
24+
- name: Set up Docker Buildx
25+
uses: docker/setup-buildx-action@v3
26+
27+
- name: Build image
28+
uses: docker/build-push-action@v6
29+
with:
30+
context: .
31+
file: ./Dockerfile
32+
push: false
33+
load: true
34+
tags: pyatlan-trivy:latest
35+
36+
- name: Trivy image scan (table)
37+
uses: aquasecurity/trivy-action@0.33.1
38+
with:
39+
image-ref: pyatlan-trivy:latest
40+
scanners: 'vuln'
41+
version: 'v0.69.0'
42+
ignore-unfixed: true
43+
format: 'table'
44+
output: 'trivy-image.txt'
45+
severity: 'CRITICAL,HIGH'
46+
exit-code: '0'
47+
env:
48+
TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
49+
TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db:1
50+
51+
- name: Show Trivy image table
52+
if: always()
53+
shell: bash
54+
run: |
55+
echo "Trivy image scan (table)";
56+
if [ -f trivy-image.txt ]; then
57+
cat trivy-image.txt;
58+
else
59+
echo "No trivy-image.txt output found.";
60+
fi
61+
62+
- name: Trivy image scan (SARIF)
63+
uses: aquasecurity/trivy-action@0.33.1
64+
with:
65+
image-ref: pyatlan-trivy:latest
66+
scanners: 'vuln'
67+
version: 'v0.69.0'
68+
ignore-unfixed: true
69+
format: 'sarif'
70+
output: 'trivy-image.sarif'
71+
severity: 'CRITICAL,HIGH'
72+
exit-code: '0'
73+
env:
74+
TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
75+
TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db:1
76+
77+
- name: Trivy dependency scan (uv.lock, table)
78+
uses: aquasecurity/trivy-action@0.33.1
79+
with:
80+
scan-type: fs
81+
input: uv.lock
82+
scanners: 'vuln'
83+
version: 'v0.69.0'
84+
ignore-unfixed: true
85+
format: 'table'
86+
output: 'trivy-deps.txt'
87+
severity: 'CRITICAL,HIGH'
88+
exit-code: '0'
89+
env:
90+
TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
91+
92+
- name: Show Trivy dependency table
93+
if: always()
94+
shell: bash
95+
run: |
96+
echo "Trivy dependency scan (table)";
97+
if [ -f trivy-deps.txt ]; then
98+
cat trivy-deps.txt;
99+
else
100+
echo "No trivy-deps.txt output found.";
101+
fi
102+
103+
- name: Trivy dependency scan (uv.lock, SARIF)
104+
uses: aquasecurity/trivy-action@0.33.1
105+
with:
106+
scan-type: fs
107+
input: uv.lock
108+
scanners: 'vuln'
109+
version: 'v0.69.0'
110+
ignore-unfixed: true
111+
format: 'sarif'
112+
output: 'trivy-deps.sarif'
113+
severity: 'CRITICAL,HIGH'
114+
exit-code: '0'
115+
env:
116+
TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
117+
118+
- name: Upload Trivy image results
119+
if: github.event.repository.security_and_analysis.advanced_security.status == 'enabled'
120+
uses: github/codeql-action/upload-sarif@v3
121+
with:
122+
sarif_file: 'trivy-image.sarif'
123+
category: 'trivy-image'
124+
125+
- name: Upload Trivy dependency results
126+
if: github.event.repository.security_and_analysis.advanced_security.status == 'enabled'
127+
uses: github/codeql-action/upload-sarif@v3
128+
with:
129+
sarif_file: 'trivy-deps.sarif'
130+
category: 'trivy-deps'
131+
132+
- name: Publish Trivy summary
133+
if: always()
134+
shell: bash
135+
run: |
136+
{
137+
echo "## Trivy Image Scan (pyatlan-trivy:latest)";
138+
echo "";
139+
if [ -f trivy-image.txt ]; then
140+
echo '```';
141+
cat trivy-image.txt;
142+
echo '```';
143+
else
144+
echo "No image scan output found.";
145+
fi
146+
echo "";
147+
echo "## Trivy Dependency Scan (uv.lock)";
148+
echo "";
149+
if [ -f trivy-deps.txt ]; then
150+
echo '```';
151+
cat trivy-deps.txt;
152+
echo '```';
153+
else
154+
echo "No dependency scan output found.";
155+
fi
156+
} >> "$GITHUB_STEP_SUMMARY"
157+
158+
- name: Fail on High/Critical vulnerabilities (image)
159+
uses: aquasecurity/trivy-action@0.33.1
160+
with:
161+
image-ref: pyatlan-trivy:latest
162+
scanners: 'vuln'
163+
version: 'v0.69.0'
164+
ignore-unfixed: true
165+
format: 'table'
166+
severity: 'CRITICAL,HIGH'
167+
exit-code: '1'
168+
env:
169+
TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
170+
TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db:1
171+
172+
- name: Fail on High/Critical vulnerabilities (uv.lock)
173+
uses: aquasecurity/trivy-action@0.33.1
174+
with:
175+
scan-type: fs
176+
input: uv.lock
177+
scanners: 'vuln'
178+
version: 'v0.69.0'
179+
ignore-unfixed: true
180+
format: 'table'
181+
severity: 'CRITICAL,HIGH'
182+
exit-code: '1'
183+
env:
184+
TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2

0 commit comments

Comments
 (0)