Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Viktor Sadovnikov
|
1f0aa582c8 | ||
|
DmitriyLewen
|
43849adf01 | ||
|
Falk Puschner
|
8bd2f9fbda |
@@ -1,7 +1,7 @@
|
|||||||
name: "build"
|
name: "build"
|
||||||
on: [push, pull_request]
|
on: [push, pull_request]
|
||||||
env:
|
env:
|
||||||
TRIVY_VERSION: 0.37.1
|
TRIVY_VERSION: 0.38.1
|
||||||
BATS_LIB_PATH: '/usr/lib/'
|
BATS_LIB_PATH: '/usr/lib/'
|
||||||
jobs:
|
jobs:
|
||||||
build:
|
build:
|
||||||
|
|||||||
+1
-1
@@ -1,4 +1,4 @@
|
|||||||
FROM ghcr.io/aquasecurity/trivy:0.37.1
|
FROM ghcr.io/aquasecurity/trivy:0.38.1
|
||||||
COPY entrypoint.sh /
|
COPY entrypoint.sh /
|
||||||
RUN apk --no-cache add bash curl npm
|
RUN apk --no-cache add bash curl npm
|
||||||
RUN chmod +x /entrypoint.sh
|
RUN chmod +x /entrypoint.sh
|
||||||
|
|||||||
@@ -478,31 +478,31 @@ jobs:
|
|||||||
|
|
||||||
Following inputs can be used as `step.with` keys:
|
Following inputs can be used as `step.with` keys:
|
||||||
|
|
||||||
| Name | Type | Default | Description |
|
| Name | Type | Default | Description |
|
||||||
|-------------------|---------|------------------------------------|-------------------------------------------------------------------------------------------------|
|
|------------------------------|---------|------------------------------------|-------------------------------------------------------------------------------------------------|
|
||||||
| `scan-type` | String | `image` | Scan type, e.g. `image` or `fs` |
|
| `scan-type` | String | `image` | Scan type, e.g. `image` or `fs` |
|
||||||
| `input` | String | | Tar reference, e.g. `alpine-latest.tar` |
|
| `input` | String | | Tar reference, e.g. `alpine-latest.tar` |
|
||||||
| `image-ref` | String | | Image reference, e.g. `alpine:3.10.2` |
|
| `image-ref` | String | | Image reference, e.g. `alpine:3.10.2` |
|
||||||
| `scan-ref` | String | `/github/workspace/` | Scan reference, e.g. `/github/workspace/` or `.` |
|
| `scan-ref` | String | `/github/workspace/` | Scan reference, e.g. `/github/workspace/` or `.` |
|
||||||
| `format` | String | `table` | Output format (`table`, `json`, `sarif`, `github`) |
|
| `format` | String | `table` | Output format (`table`, `json`, `sarif`, `github`) |
|
||||||
| `template` | String | | Output template (`@/contrib/gitlab.tpl`, `@/contrib/junit.tpl`) |
|
| `template` | String | | Output template (`@/contrib/gitlab.tpl`, `@/contrib/junit.tpl`) |
|
||||||
| `output` | String | | Save results to a file |
|
| `output` | String | | Save results to a file |
|
||||||
| `exit-code` | String | `0` | Exit code when specified vulnerabilities are found |
|
| `exit-code` | String | `0` | Exit code when specified vulnerabilities are found |
|
||||||
| `ignore-unfixed` | Boolean | false | Ignore unpatched/unfixed vulnerabilities |
|
| `ignore-unfixed` | Boolean | false | Ignore unpatched/unfixed vulnerabilities |
|
||||||
| `vuln-type` | String | `os,library` | Vulnerability types (os,library) |
|
| `vuln-type` | String | `os,library` | Vulnerability types (os,library) |
|
||||||
| `severity` | String | `UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL` | Severities of vulnerabilities to scanned for and displayed |
|
| `severity` | String | `UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL` | Severities of vulnerabilities to scanned for and displayed |
|
||||||
| `skip-dirs` | String | | Comma separated list of directories where traversal is skipped |
|
| `skip-dirs` | String | | Comma separated list of directories where traversal is skipped |
|
||||||
| `skip-files` | String | | Comma separated list of files where traversal is skipped |
|
| `skip-files` | String | | Comma separated list of files where traversal is skipped |
|
||||||
| `cache-dir` | String | | Cache directory |
|
| `cache-dir` | String | | Cache directory |
|
||||||
| `timeout` | String | `5m0s` | Scan timeout duration |
|
| `timeout` | String | `5m0s` | Scan timeout duration |
|
||||||
| `ignore-policy` | String | | Filter vulnerabilities with OPA rego language |
|
| `ignore-policy` | String | | Filter vulnerabilities with OPA rego language |
|
||||||
| `hide-progress` | String | `true` | Suppress progress bar |
|
| `hide-progress` | String | `true` | Suppress progress bar |
|
||||||
| `list-all-pkgs` | String | | Output all packages regardless of vulnerability |
|
| `list-all-pkgs` | String | | Output all packages regardless of vulnerability |
|
||||||
| `security-checks` | String | `vuln,secret` | comma-separated list of what security issues to detect (`vuln`,`secret`,`config`) |
|
| `scanners` | String | `vuln,secret` | comma-separated list of what security issues to detect (`vuln`,`secret`,`config`) |
|
||||||
| `trivyignores` | String | | comma-separated list of relative paths in repository to one or more `.trivyignore` files |
|
| `trivyignores` | String | | comma-separated list of relative paths in repository to one or more `.trivyignore` files |
|
||||||
| `trivy-config` | String | | Path to trivy.yaml config |
|
| `trivy-config` | String | | Path to trivy.yaml config |
|
||||||
| `github-pat` | String | | GitHub Personal Access Token (PAT) for sending SBOM scan results to GitHub Dependency Snapshots |
|
| `github-pat` | String | | GitHub Personal Access Token (PAT) for sending SBOM scan results to GitHub Dependency Snapshots |
|
||||||
| `limit-severities-for-sarif` | Boolean | false | By default *SARIF* format enforces output of all vulnerabilities regardless of configured severities. To override this behavior set this parameter to **true** |
|
| `limit-severities-for-sarif` | Boolean | false | By default *SARIF* format enforces output of all vulnerabilities regardless of configured severities. To override this behavior set this parameter to **true** |
|
||||||
|
|
||||||
[release]: https://github.com/aquasecurity/trivy-action/releases/latest
|
[release]: https://github.com/aquasecurity/trivy-action/releases/latest
|
||||||
[release-img]: https://img.shields.io/github/release/aquasecurity/trivy-action.svg?logo=github
|
[release-img]: https://img.shields.io/github/release/aquasecurity/trivy-action.svg?logo=github
|
||||||
|
|||||||
+2
-2
@@ -71,7 +71,7 @@ inputs:
|
|||||||
description: 'output all packages regardless of vulnerability'
|
description: 'output all packages regardless of vulnerability'
|
||||||
required: false
|
required: false
|
||||||
default: 'false'
|
default: 'false'
|
||||||
security-checks:
|
scanners:
|
||||||
description: 'comma-separated list of what security issues to detect'
|
description: 'comma-separated list of what security issues to detect'
|
||||||
required: false
|
required: false
|
||||||
default: ''
|
default: ''
|
||||||
@@ -114,7 +114,7 @@ runs:
|
|||||||
- '-p ${{ inputs.hide-progress }}'
|
- '-p ${{ inputs.hide-progress }}'
|
||||||
- '-q ${{ inputs.skip-files }}'
|
- '-q ${{ inputs.skip-files }}'
|
||||||
- '-r ${{ inputs.list-all-pkgs }}'
|
- '-r ${{ inputs.list-all-pkgs }}'
|
||||||
- '-s ${{ inputs.security-checks }}'
|
- '-s ${{ inputs.scanners }}'
|
||||||
- '-t ${{ inputs.trivyignores }}'
|
- '-t ${{ inputs.trivyignores }}'
|
||||||
- '-u ${{ inputs.github-pat }}'
|
- '-u ${{ inputs.github-pat }}'
|
||||||
- '-v ${{ inputs.trivy-config }}'
|
- '-v ${{ inputs.trivy-config }}'
|
||||||
|
|||||||
+4
-4
@@ -57,7 +57,7 @@ while getopts "a:b:c:d:e:f:g:h:i:j:k:l:m:n:o:p:q:r:s:t:u:v:z:" o; do
|
|||||||
export listAllPkgs=${OPTARG}
|
export listAllPkgs=${OPTARG}
|
||||||
;;
|
;;
|
||||||
s)
|
s)
|
||||||
export securityChecks=${OPTARG}
|
export scanners=${OPTARG}
|
||||||
;;
|
;;
|
||||||
t)
|
t)
|
||||||
export trivyIgnores=${OPTARG}
|
export trivyIgnores=${OPTARG}
|
||||||
@@ -114,9 +114,9 @@ if [ $vulnType ] && [ "$scanType" != "config" ] && [ "$scanType" != "sbom" ];the
|
|||||||
ARGS="$ARGS --vuln-type $vulnType"
|
ARGS="$ARGS --vuln-type $vulnType"
|
||||||
SARIF_ARGS="$SARIF_ARGS --vuln-type $vulnType"
|
SARIF_ARGS="$SARIF_ARGS --vuln-type $vulnType"
|
||||||
fi
|
fi
|
||||||
if [ $securityChecks ];then
|
if [ $scanners ];then
|
||||||
ARGS="$ARGS --security-checks $securityChecks"
|
ARGS="$ARGS --scanners $scanners"
|
||||||
SARIF_ARGS="$SARIF_ARGS --security-checks $securityChecks"
|
SARIF_ARGS="$SARIF_ARGS --scanners $scanners"
|
||||||
fi
|
fi
|
||||||
if [ $severity ];then
|
if [ $severity ];then
|
||||||
ARGS="$ARGS --severity $severity"
|
ARGS="$ARGS --severity $severity"
|
||||||
|
|||||||
@@ -64,7 +64,7 @@
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"version": "0.37.1"
|
"version": "0.38.1"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"results": [
|
"results": [
|
||||||
|
|||||||
@@ -37,7 +37,7 @@
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"version": "0.37.1"
|
"version": "0.38.1"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"results": [
|
"results": [
|
||||||
|
|||||||
+2
-2
@@ -4,7 +4,7 @@ bats_load_library bats-assert
|
|||||||
bats_load_library bats-file
|
bats_load_library bats-file
|
||||||
|
|
||||||
@test "trivy repo with securityCheck secret only" {
|
@test "trivy repo with securityCheck secret only" {
|
||||||
# trivy repo --format json --output repo.test --security-checks=secret https://github.com/krol3/demo-trivy/
|
# trivy repo --format json --output repo.test --scanners=secret https://github.com/krol3/demo-trivy/
|
||||||
run ./entrypoint.sh '-b json' '-h repo.test' '-s secret' '-a repo' '-j https://github.com/krol3/demo-trivy/'
|
run ./entrypoint.sh '-b json' '-h repo.test' '-s secret' '-a repo' '-j https://github.com/krol3/demo-trivy/'
|
||||||
run diff repo.test ./test/data/repo.test
|
run diff repo.test ./test/data/repo.test
|
||||||
echo "$output"
|
echo "$output"
|
||||||
@@ -52,7 +52,7 @@ bats_load_library bats-file
|
|||||||
}
|
}
|
||||||
|
|
||||||
@test "trivy fs with securityChecks option" {
|
@test "trivy fs with securityChecks option" {
|
||||||
# trivy fs --format json --security-checks=vuln,config --output fs-scheck.test .
|
# trivy fs --format json --scanners=vuln,config --output fs-scheck.test .
|
||||||
run ./entrypoint.sh '-a fs' '-b json' '-j .' '-s vuln,config,secret' '-h fs-scheck.test'
|
run ./entrypoint.sh '-a fs' '-b json' '-j .' '-s vuln,config,secret' '-h fs-scheck.test'
|
||||||
run diff fs-scheck.test ./test/data/fs-scheck.test
|
run diff fs-scheck.test ./test/data/fs-scheck.test
|
||||||
echo "$output"
|
echo "$output"
|
||||||
|
|||||||
+1
-1
@@ -7,7 +7,7 @@ on:
|
|||||||
jobs:
|
jobs:
|
||||||
build:
|
build:
|
||||||
name: Build
|
name: Build
|
||||||
runs-on: ubuntu-18.04
|
runs-on: ubuntu-20.04
|
||||||
steps:
|
steps:
|
||||||
- name: Checkout code
|
- name: Checkout code
|
||||||
uses: actions/checkout@v2
|
uses: actions/checkout@v2
|
||||||
|
|||||||
Reference in New Issue
Block a user