|
|
@@ -39,7 +39,7 @@ jobs:
|
|
|
|
run: |
|
|
|
|
run: |
|
|
|
|
docker build -t docker.io/my-organization/my-app:${{ github.sha }} .
|
|
|
|
docker build -t docker.io/my-organization/my-app:${{ github.sha }} .
|
|
|
|
- name: Run Trivy vulnerability scanner
|
|
|
|
- name: Run Trivy vulnerability scanner
|
|
|
|
uses: aquasecurity/trivy-action@master
|
|
|
|
uses: aquasecurity/trivy-action@0.20.0
|
|
|
|
with:
|
|
|
|
with:
|
|
|
|
image-ref: 'docker.io/my-organization/my-app:${{ github.sha }}'
|
|
|
|
image-ref: 'docker.io/my-organization/my-app:${{ github.sha }}'
|
|
|
|
format: 'table'
|
|
|
|
format: 'table'
|
|
|
@@ -67,7 +67,7 @@ jobs:
|
|
|
|
uses: actions/checkout@v3
|
|
|
|
uses: actions/checkout@v3
|
|
|
|
|
|
|
|
|
|
|
|
- name: Run Trivy vulnerability scanner in fs mode
|
|
|
|
- name: Run Trivy vulnerability scanner in fs mode
|
|
|
|
uses: aquasecurity/trivy-action@master
|
|
|
|
uses: aquasecurity/trivy-action@0.20.0
|
|
|
|
with:
|
|
|
|
with:
|
|
|
|
scan-type: 'fs'
|
|
|
|
scan-type: 'fs'
|
|
|
|
scan-ref: '.'
|
|
|
|
scan-ref: '.'
|
|
|
@@ -117,7 +117,7 @@ jobs:
|
|
|
|
docker save -o vuln-image.tar <your-docker-image>
|
|
|
|
docker save -o vuln-image.tar <your-docker-image>
|
|
|
|
|
|
|
|
|
|
|
|
- name: Run Trivy vulnerability scanner in tarball mode
|
|
|
|
- name: Run Trivy vulnerability scanner in tarball mode
|
|
|
|
uses: aquasecurity/trivy-action@master
|
|
|
|
uses: aquasecurity/trivy-action@0.20.0
|
|
|
|
with:
|
|
|
|
with:
|
|
|
|
input: /github/workspace/vuln-image.tar
|
|
|
|
input: /github/workspace/vuln-image.tar
|
|
|
|
severity: 'CRITICAL,HIGH'
|
|
|
|
severity: 'CRITICAL,HIGH'
|
|
|
@@ -145,7 +145,7 @@ jobs:
|
|
|
|
docker build -t docker.io/my-organization/my-app:${{ github.sha }} .
|
|
|
|
docker build -t docker.io/my-organization/my-app:${{ github.sha }} .
|
|
|
|
|
|
|
|
|
|
|
|
- name: Run Trivy vulnerability scanner
|
|
|
|
- name: Run Trivy vulnerability scanner
|
|
|
|
uses: aquasecurity/trivy-action@master
|
|
|
|
uses: aquasecurity/trivy-action@0.20.0
|
|
|
|
with:
|
|
|
|
with:
|
|
|
|
image-ref: 'docker.io/my-organization/my-app:${{ github.sha }}'
|
|
|
|
image-ref: 'docker.io/my-organization/my-app:${{ github.sha }}'
|
|
|
|
format: 'sarif'
|
|
|
|
format: 'sarif'
|
|
|
@@ -180,7 +180,7 @@ jobs:
|
|
|
|
docker build -t docker.io/my-organization/my-app:${{ github.sha }} .
|
|
|
|
docker build -t docker.io/my-organization/my-app:${{ github.sha }} .
|
|
|
|
|
|
|
|
|
|
|
|
- name: Run Trivy vulnerability scanner
|
|
|
|
- name: Run Trivy vulnerability scanner
|
|
|
|
uses: aquasecurity/trivy-action@master
|
|
|
|
uses: aquasecurity/trivy-action@0.20.0
|
|
|
|
with:
|
|
|
|
with:
|
|
|
|
image-ref: 'docker.io/my-organization/my-app:${{ github.sha }}'
|
|
|
|
image-ref: 'docker.io/my-organization/my-app:${{ github.sha }}'
|
|
|
|
format: 'sarif'
|
|
|
|
format: 'sarif'
|
|
|
@@ -215,7 +215,7 @@ jobs:
|
|
|
|
uses: actions/checkout@v3
|
|
|
|
uses: actions/checkout@v3
|
|
|
|
|
|
|
|
|
|
|
|
- name: Run Trivy vulnerability scanner in repo mode
|
|
|
|
- name: Run Trivy vulnerability scanner in repo mode
|
|
|
|
uses: aquasecurity/trivy-action@master
|
|
|
|
uses: aquasecurity/trivy-action@0.20.0
|
|
|
|
with:
|
|
|
|
with:
|
|
|
|
scan-type: 'fs'
|
|
|
|
scan-type: 'fs'
|
|
|
|
ignore-unfixed: true
|
|
|
|
ignore-unfixed: true
|
|
|
@@ -249,7 +249,7 @@ jobs:
|
|
|
|
uses: actions/checkout@v3
|
|
|
|
uses: actions/checkout@v3
|
|
|
|
|
|
|
|
|
|
|
|
- name: Run Trivy vulnerability scanner with rootfs command
|
|
|
|
- name: Run Trivy vulnerability scanner with rootfs command
|
|
|
|
uses: aquasecurity/trivy-action@master
|
|
|
|
uses: aquasecurity/trivy-action@0.20.0
|
|
|
|
with:
|
|
|
|
with:
|
|
|
|
scan-type: 'rootfs'
|
|
|
|
scan-type: 'rootfs'
|
|
|
|
scan-ref: 'rootfs-example-binary'
|
|
|
|
scan-ref: 'rootfs-example-binary'
|
|
|
@@ -284,7 +284,7 @@ jobs:
|
|
|
|
uses: actions/checkout@v3
|
|
|
|
uses: actions/checkout@v3
|
|
|
|
|
|
|
|
|
|
|
|
- name: Run Trivy vulnerability scanner in IaC mode
|
|
|
|
- name: Run Trivy vulnerability scanner in IaC mode
|
|
|
|
uses: aquasecurity/trivy-action@master
|
|
|
|
uses: aquasecurity/trivy-action@0.20.0
|
|
|
|
with:
|
|
|
|
with:
|
|
|
|
scan-type: 'config'
|
|
|
|
scan-type: 'config'
|
|
|
|
hide-progress: true
|
|
|
|
hide-progress: true
|
|
|
@@ -328,7 +328,7 @@ jobs:
|
|
|
|
uses: actions/checkout@v3
|
|
|
|
uses: actions/checkout@v3
|
|
|
|
|
|
|
|
|
|
|
|
- name: Run Trivy in GitHub SBOM mode and submit results to Dependency Graph
|
|
|
|
- name: Run Trivy in GitHub SBOM mode and submit results to Dependency Graph
|
|
|
|
uses: aquasecurity/trivy-action@master
|
|
|
|
uses: aquasecurity/trivy-action@0.20.0
|
|
|
|
with:
|
|
|
|
with:
|
|
|
|
scan-type: 'fs'
|
|
|
|
scan-type: 'fs'
|
|
|
|
format: 'github'
|
|
|
|
format: 'github'
|
|
|
@@ -359,7 +359,7 @@ jobs:
|
|
|
|
runs-on: ubuntu-20.04
|
|
|
|
runs-on: ubuntu-20.04
|
|
|
|
steps:
|
|
|
|
steps:
|
|
|
|
- name: Scan image in a private registry
|
|
|
|
- name: Scan image in a private registry
|
|
|
|
uses: aquasecurity/trivy-action@master
|
|
|
|
uses: aquasecurity/trivy-action@0.20.0
|
|
|
|
with:
|
|
|
|
with:
|
|
|
|
image-ref: "private_image_registry/image_name:image_tag"
|
|
|
|
image-ref: "private_image_registry/image_name:image_tag"
|
|
|
|
scan-type: image
|
|
|
|
scan-type: image
|
|
|
@@ -402,7 +402,7 @@ jobs:
|
|
|
|
uses: actions/checkout@v3
|
|
|
|
uses: actions/checkout@v3
|
|
|
|
|
|
|
|
|
|
|
|
- name: Run Trivy vulnerability scanner
|
|
|
|
- name: Run Trivy vulnerability scanner
|
|
|
|
uses: aquasecurity/trivy-action@master
|
|
|
|
uses: aquasecurity/trivy-action@0.20.0
|
|
|
|
with:
|
|
|
|
with:
|
|
|
|
image-ref: 'docker.io/my-organization/my-app:${{ github.sha }}'
|
|
|
|
image-ref: 'docker.io/my-organization/my-app:${{ github.sha }}'
|
|
|
|
format: 'sarif'
|
|
|
|
format: 'sarif'
|
|
|
@@ -438,7 +438,7 @@ jobs:
|
|
|
|
uses: actions/checkout@v3
|
|
|
|
uses: actions/checkout@v3
|
|
|
|
|
|
|
|
|
|
|
|
- name: Run Trivy vulnerability scanner
|
|
|
|
- name: Run Trivy vulnerability scanner
|
|
|
|
uses: aquasecurity/trivy-action@master
|
|
|
|
uses: aquasecurity/trivy-action@0.20.0
|
|
|
|
with:
|
|
|
|
with:
|
|
|
|
image-ref: 'aws_account_id.dkr.ecr.region.amazonaws.com/imageName:${{ github.sha }}'
|
|
|
|
image-ref: 'aws_account_id.dkr.ecr.region.amazonaws.com/imageName:${{ github.sha }}'
|
|
|
|
format: 'sarif'
|
|
|
|
format: 'sarif'
|
|
|
@@ -474,7 +474,7 @@ jobs:
|
|
|
|
uses: actions/checkout@v3
|
|
|
|
uses: actions/checkout@v3
|
|
|
|
|
|
|
|
|
|
|
|
- name: Run Trivy vulnerability scanner
|
|
|
|
- name: Run Trivy vulnerability scanner
|
|
|
|
uses: aquasecurity/trivy-action@master
|
|
|
|
uses: aquasecurity/trivy-action@0.20.0
|
|
|
|
with:
|
|
|
|
with:
|
|
|
|
image-ref: 'docker.io/my-organization/my-app:${{ github.sha }}'
|
|
|
|
image-ref: 'docker.io/my-organization/my-app:${{ github.sha }}'
|
|
|
|
format: 'sarif'
|
|
|
|
format: 'sarif'
|
|
|
@@ -507,7 +507,7 @@ jobs:
|
|
|
|
uses: actions/checkout@v3
|
|
|
|
uses: actions/checkout@v3
|
|
|
|
|
|
|
|
|
|
|
|
- name: Run Trivy vulnerability scanner
|
|
|
|
- name: Run Trivy vulnerability scanner
|
|
|
|
uses: aquasecurity/trivy-action@master
|
|
|
|
uses: aquasecurity/trivy-action@0.20.0
|
|
|
|
with:
|
|
|
|
with:
|
|
|
|
image-ref: 'docker.io/my-organization/my-app:${{ github.sha }}'
|
|
|
|
image-ref: 'docker.io/my-organization/my-app:${{ github.sha }}'
|
|
|
|
format: 'sarif'
|
|
|
|
format: 'sarif'
|
|
|
@@ -530,7 +530,7 @@ This step is especially useful for private repositories without [GitHub Advanced
|
|
|
|
|
|
|
|
|
|
|
|
```yaml
|
|
|
|
```yaml
|
|
|
|
- name: Run Trivy scanner
|
|
|
|
- name: Run Trivy scanner
|
|
|
|
uses: aquasecurity/trivy-action@master
|
|
|
|
uses: aquasecurity/trivy-action@0.20.0
|
|
|
|
with:
|
|
|
|
with:
|
|
|
|
scan-type: config
|
|
|
|
scan-type: config
|
|
|
|
hide-progress: true
|
|
|
|
hide-progress: true
|
|
|
|
Francisco Javier Barón