diff --git a/README.md b/README.md index 0519583..ecbc297 100644 --- a/README.md +++ b/README.md @@ -291,6 +291,7 @@ Following inputs can be used as `step.with` keys: | `skip-dirs` | String | | Comma separated list of directories where traversal is skipped | | `cache-dir` | String | | Cache directory | | `timeout` | String | `2m0s` | Scan timeout duration | +| `ignore-policy` | String | | Filter vulnerabilities with OPA rego language | [release]: https://github.com/aquasecurity/trivy-action/releases/latest [release-img]: https://img.shields.io/github/release/aquasecurity/trivy-action.svg?logo=github diff --git a/action.yaml b/action.yaml index 239c2e9..f02e7f4 100644 --- a/action.yaml +++ b/action.yaml @@ -57,6 +57,10 @@ inputs: description: 'timeout (default 2m0s)' required: false default: '' + ignore-policy: + description: 'filter vulnerabilities with OPA rego language' + required: false + default: '' runs: using: 'docker' image: "Dockerfile" @@ -75,3 +79,4 @@ runs: - '-l ${{ inputs.input }}' - '-m ${{ inputs.cache-dir }}' - '-n ${{ inputs.timeout }}' + - '-o ${{ inputs.ignore-policy }}' diff --git a/entrypoint.sh b/entrypoint.sh index 84dd08b..c47f31b 100755 --- a/entrypoint.sh +++ b/entrypoint.sh @@ -1,6 +1,6 @@ #!/bin/bash set -e -while getopts "a:b:c:d:e:f:g:h:i:j:k:l:m:n:" o; do +while getopts "a:b:c:d:e:f:g:h:i:j:k:l:m:n:o:" o; do case "${o}" in a) export scanType=${OPTARG} @@ -44,6 +44,9 @@ while getopts "a:b:c:d:e:f:g:h:i:j:k:l:m:n:" o; do n) export timeout=${OPTARG} ;; + o) + export ignorePolicy=${OPTARG} + ;; esac done @@ -92,6 +95,9 @@ fi if [ $timeout ];then ARGS="$ARGS --timeout $timeout" fi +if [ $ignorePolicy ];then + ARGS="$ARGS --ignore-policy $ignorePolicy" +fi echo "Running trivy with options: " --no-progress "${ARGS}" "${artifactRef}" trivy ${scanType} --no-progress $ARGS ${artifactRef}