Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Bruce Bujon
|
e5f43133f6 | ||
|
Guilherme Marz VazzollaandDuncan Casteleyn
|
1a09192c0e |
@@ -1,7 +1,7 @@
|
|||||||
name: "build"
|
name: "build"
|
||||||
on: [push, pull_request]
|
on: [push, pull_request]
|
||||||
env:
|
env:
|
||||||
TRIVY_VERSION: 0.38.1
|
TRIVY_VERSION: 0.40.0
|
||||||
BATS_LIB_PATH: '/usr/lib/'
|
BATS_LIB_PATH: '/usr/lib/'
|
||||||
jobs:
|
jobs:
|
||||||
build:
|
build:
|
||||||
|
|||||||
+1
-1
@@ -1,4 +1,4 @@
|
|||||||
FROM ghcr.io/aquasecurity/trivy:0.38.1
|
FROM ghcr.io/aquasecurity/trivy:0.40.0
|
||||||
COPY entrypoint.sh /
|
COPY entrypoint.sh /
|
||||||
RUN apk --no-cache add bash curl npm
|
RUN apk --no-cache add bash curl npm
|
||||||
RUN chmod +x /entrypoint.sh
|
RUN chmod +x /entrypoint.sh
|
||||||
|
|||||||
@@ -299,11 +299,12 @@ jobs:
|
|||||||
```
|
```
|
||||||
|
|
||||||
### Using Trivy to generate SBOM
|
### Using Trivy to generate SBOM
|
||||||
It's possible for Trivy to generate an SBOM of your dependencies and submit them to a consumer like GitHub Dependency Snapshot.
|
It's possible for Trivy to generate an [SBOM](https://www.aquasec.com/cloud-native-academy/supply-chain-security/sbom/) of your dependencies and submit them to a consumer like [GitHub Dependency Graph](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph).
|
||||||
|
|
||||||
The sending of SBOM to GitHub feature is only available if you currently have [GitHub Dependency Snapshot](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/using-the-dependency-submission-api) available to you in your repo.
|
The [sending of an SBOM to GitHub](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/using-the-dependency-submission-api) feature is only available if you currently have GitHub Dependency Graph [enabled in your repo](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/configuring-the-dependency-graph#enabling-and-disabling-the-dependency-graph-for-a-private-repository).
|
||||||
|
|
||||||
|
In order to send results to GitHub Dependency Graph, you will need to create a [GitHub PAT](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token) or use the [GitHub installation access token](https://docs.github.com/en/actions/security-guides/automatic-token-authentication) (also known as `GITHUB_TOKEN`):
|
||||||
|
|
||||||
In order to send results to the GitHub Dependency Snapshot, you will need to create a [GitHub PAT](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token)
|
|
||||||
```yaml
|
```yaml
|
||||||
---
|
---
|
||||||
name: Pull Request
|
name: Pull Request
|
||||||
@@ -311,7 +312,11 @@ on:
|
|||||||
push:
|
push:
|
||||||
branches:
|
branches:
|
||||||
- master
|
- master
|
||||||
pull_request:
|
|
||||||
|
## GITHUB_TOKEN authentication, add only if you're not going to use a PAT
|
||||||
|
permissions:
|
||||||
|
contents: write
|
||||||
|
|
||||||
jobs:
|
jobs:
|
||||||
build:
|
build:
|
||||||
name: Checks
|
name: Checks
|
||||||
@@ -320,14 +325,14 @@ jobs:
|
|||||||
- name: Checkout code
|
- name: Checkout code
|
||||||
uses: actions/checkout@v3
|
uses: actions/checkout@v3
|
||||||
|
|
||||||
- name: Run Trivy in GitHub SBOM mode and submit results to Dependency Snapshots
|
- name: Run Trivy in GitHub SBOM mode and submit results to Dependency Graph
|
||||||
uses: aquasecurity/trivy-action@master
|
uses: aquasecurity/trivy-action@master
|
||||||
with:
|
with:
|
||||||
scan-type: 'fs'
|
scan-type: 'fs'
|
||||||
format: 'github'
|
format: 'github'
|
||||||
output: 'dependency-results.sbom.json'
|
output: 'dependency-results.sbom.json'
|
||||||
image-ref: '.'
|
image-ref: '.'
|
||||||
github-pat: '<github_pat_token>'
|
github-pat: ${{ secrets.GITHUB_TOKEN }} # or ${{ secrets.github_pat_name }} if you're using a PAT
|
||||||
```
|
```
|
||||||
|
|
||||||
### Using Trivy to scan your private registry
|
### Using Trivy to scan your private registry
|
||||||
@@ -478,31 +483,31 @@ jobs:
|
|||||||
|
|
||||||
Following inputs can be used as `step.with` keys:
|
Following inputs can be used as `step.with` keys:
|
||||||
|
|
||||||
| Name | Type | Default | Description |
|
| Name | Type | Default | Description |
|
||||||
|------------------------------|---------|------------------------------------|-------------------------------------------------------------------------------------------------|
|
|-------------------|---------|------------------------------------|-------------------------------------------------------------------------------------------------|
|
||||||
| `scan-type` | String | `image` | Scan type, e.g. `image` or `fs` |
|
| `scan-type` | String | `image` | Scan type, e.g. `image` or `fs` |
|
||||||
| `input` | String | | Tar reference, e.g. `alpine-latest.tar` |
|
| `input` | String | | Tar reference, e.g. `alpine-latest.tar` |
|
||||||
| `image-ref` | String | | Image reference, e.g. `alpine:3.10.2` |
|
| `image-ref` | String | | Image reference, e.g. `alpine:3.10.2` |
|
||||||
| `scan-ref` | String | `/github/workspace/` | Scan reference, e.g. `/github/workspace/` or `.` |
|
| `scan-ref` | String | `/github/workspace/` | Scan reference, e.g. `/github/workspace/` or `.` |
|
||||||
| `format` | String | `table` | Output format (`table`, `json`, `sarif`, `github`) |
|
| `format` | String | `table` | Output format (`table`, `json`, `sarif`, `github`) |
|
||||||
| `template` | String | | Output template (`@/contrib/gitlab.tpl`, `@/contrib/junit.tpl`) |
|
| `template` | String | | Output template (`@/contrib/gitlab.tpl`, `@/contrib/junit.tpl`) |
|
||||||
| `output` | String | | Save results to a file |
|
| `output` | String | | Save results to a file |
|
||||||
| `exit-code` | String | `0` | Exit code when specified vulnerabilities are found |
|
| `exit-code` | String | `0` | Exit code when specified vulnerabilities are found |
|
||||||
| `ignore-unfixed` | Boolean | false | Ignore unpatched/unfixed vulnerabilities |
|
| `ignore-unfixed` | Boolean | false | Ignore unpatched/unfixed vulnerabilities |
|
||||||
| `vuln-type` | String | `os,library` | Vulnerability types (os,library) |
|
| `vuln-type` | String | `os,library` | Vulnerability types (os,library) |
|
||||||
| `severity` | String | `UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL` | Severities of vulnerabilities to scanned for and displayed |
|
| `severity` | String | `UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL` | Severities of vulnerabilities to scanned for and displayed |
|
||||||
| `skip-dirs` | String | | Comma separated list of directories where traversal is skipped |
|
| `skip-dirs` | String | | Comma separated list of directories where traversal is skipped |
|
||||||
| `skip-files` | String | | Comma separated list of files where traversal is skipped |
|
| `skip-files` | String | | Comma separated list of files where traversal is skipped |
|
||||||
| `cache-dir` | String | | Cache directory |
|
| `cache-dir` | String | | Cache directory |
|
||||||
| `timeout` | String | `5m0s` | Scan timeout duration |
|
| `timeout` | String | `5m0s` | Scan timeout duration |
|
||||||
| `ignore-policy` | String | | Filter vulnerabilities with OPA rego language |
|
| `ignore-policy` | String | | Filter vulnerabilities with OPA rego language |
|
||||||
| `hide-progress` | String | `true` | Suppress progress bar |
|
| `hide-progress` | String | `true` | Suppress progress bar |
|
||||||
| `list-all-pkgs` | String | | Output all packages regardless of vulnerability |
|
| `list-all-pkgs` | String | | Output all packages regardless of vulnerability |
|
||||||
| `scanners` | String | `vuln,secret` | comma-separated list of what security issues to detect (`vuln`,`secret`,`config`) |
|
| `scanners` | String | `vuln,secret` | comma-separated list of what security issues to detect (`vuln`,`secret`,`config`) |
|
||||||
| `trivyignores` | String | | comma-separated list of relative paths in repository to one or more `.trivyignore` files |
|
| `trivyignores` | String | | comma-separated list of relative paths in repository to one or more `.trivyignore` files |
|
||||||
| `trivy-config` | String | | Path to trivy.yaml config |
|
| `trivy-config` | String | | Path to trivy.yaml config |
|
||||||
| `github-pat` | String | | GitHub Personal Access Token (PAT) for sending SBOM scan results to GitHub Dependency Snapshots |
|
| `github-pat` | String | | Authentication token to enable sending SBOM scan results to GitHub Dependency Graph. Can be either a GitHub Personal Access Token (PAT) or GITHUB_TOKEN |
|
||||||
| `limit-severities-for-sarif` | Boolean | false | By default *SARIF* format enforces output of all vulnerabilities regardless of configured severities. To override this behavior set this parameter to **true** |
|
| `limit-severities-for-sarif` | Boolean | false | By default *SARIF* format enforces output of all vulnerabilities regardless of configured severities. To override this behavior set this parameter to **true** |
|
||||||
|
|
||||||
[release]: https://github.com/aquasecurity/trivy-action/releases/latest
|
[release]: https://github.com/aquasecurity/trivy-action/releases/latest
|
||||||
[release-img]: https://img.shields.io/github/release/aquasecurity/trivy-action.svg?logo=github
|
[release-img]: https://img.shields.io/github/release/aquasecurity/trivy-action.svg?logo=github
|
||||||
|
|||||||
@@ -43,15 +43,15 @@
|
|||||||
"text": "No HEALTHCHECK defined"
|
"text": "No HEALTHCHECK defined"
|
||||||
},
|
},
|
||||||
"fullDescription": {
|
"fullDescription": {
|
||||||
"text": "You shoud add HEALTHCHECK instruction in your docker container images to perform the health check on running containers."
|
"text": "You should add HEALTHCHECK instruction in your docker container images to perform the health check on running containers."
|
||||||
},
|
},
|
||||||
"defaultConfiguration": {
|
"defaultConfiguration": {
|
||||||
"level": "note"
|
"level": "note"
|
||||||
},
|
},
|
||||||
"helpUri": "https://avd.aquasec.com/misconfig/ds026",
|
"helpUri": "https://avd.aquasec.com/misconfig/ds026",
|
||||||
"help": {
|
"help": {
|
||||||
"text": "Misconfiguration DS026\nType: Dockerfile Security Check\nSeverity: LOW\nCheck: No HEALTHCHECK defined\nMessage: Add HEALTHCHECK instruction in your Dockerfile\nLink: [DS026](https://avd.aquasec.com/misconfig/ds026)\nYou shoud add HEALTHCHECK instruction in your docker container images to perform the health check on running containers.",
|
"text": "Misconfiguration DS026\nType: Dockerfile Security Check\nSeverity: LOW\nCheck: No HEALTHCHECK defined\nMessage: Add HEALTHCHECK instruction in your Dockerfile\nLink: [DS026](https://avd.aquasec.com/misconfig/ds026)\nYou should add HEALTHCHECK instruction in your docker container images to perform the health check on running containers.",
|
||||||
"markdown": "**Misconfiguration DS026**\n| Type | Severity | Check | Message | Link |\n| --- | --- | --- | --- | --- |\n|Dockerfile Security Check|LOW|No HEALTHCHECK defined|Add HEALTHCHECK instruction in your Dockerfile|[DS026](https://avd.aquasec.com/misconfig/ds026)|\n\nYou shoud add HEALTHCHECK instruction in your docker container images to perform the health check on running containers."
|
"markdown": "**Misconfiguration DS026**\n| Type | Severity | Check | Message | Link |\n| --- | --- | --- | --- | --- |\n|Dockerfile Security Check|LOW|No HEALTHCHECK defined|Add HEALTHCHECK instruction in your Dockerfile|[DS026](https://avd.aquasec.com/misconfig/ds026)|\n\nYou should add HEALTHCHECK instruction in your docker container images to perform the health check on running containers."
|
||||||
},
|
},
|
||||||
"properties": {
|
"properties": {
|
||||||
"precision": "very-high",
|
"precision": "very-high",
|
||||||
@@ -64,7 +64,7 @@
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"version": "0.38.1"
|
"version": "0.40.0"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"results": [
|
"results": [
|
||||||
|
|||||||
@@ -20,7 +20,7 @@
|
|||||||
"Class": "config",
|
"Class": "config",
|
||||||
"Type": "dockerfile",
|
"Type": "dockerfile",
|
||||||
"MisconfSummary": {
|
"MisconfSummary": {
|
||||||
"Successes": 22,
|
"Successes": 24,
|
||||||
"Failures": 2,
|
"Failures": 2,
|
||||||
"Exceptions": 0
|
"Exceptions": 0
|
||||||
},
|
},
|
||||||
@@ -56,7 +56,7 @@
|
|||||||
"ID": "DS026",
|
"ID": "DS026",
|
||||||
"AVDID": "AVD-DS-0026",
|
"AVDID": "AVD-DS-0026",
|
||||||
"Title": "No HEALTHCHECK defined",
|
"Title": "No HEALTHCHECK defined",
|
||||||
"Description": "You shoud add HEALTHCHECK instruction in your docker container images to perform the health check on running containers.",
|
"Description": "You should add HEALTHCHECK instruction in your docker container images to perform the health check on running containers.",
|
||||||
"Message": "Add HEALTHCHECK instruction in your Dockerfile",
|
"Message": "Add HEALTHCHECK instruction in your Dockerfile",
|
||||||
"Namespace": "builtin.dockerfile.DS026",
|
"Namespace": "builtin.dockerfile.DS026",
|
||||||
"Query": "data.builtin.dockerfile.DS026.deny",
|
"Query": "data.builtin.dockerfile.DS026.deny",
|
||||||
|
|||||||
@@ -20,7 +20,7 @@
|
|||||||
"Class": "config",
|
"Class": "config",
|
||||||
"Type": "dockerfile",
|
"Type": "dockerfile",
|
||||||
"MisconfSummary": {
|
"MisconfSummary": {
|
||||||
"Successes": 22,
|
"Successes": 24,
|
||||||
"Failures": 2,
|
"Failures": 2,
|
||||||
"Exceptions": 0
|
"Exceptions": 0
|
||||||
},
|
},
|
||||||
@@ -56,7 +56,7 @@
|
|||||||
"ID": "DS026",
|
"ID": "DS026",
|
||||||
"AVDID": "AVD-DS-0026",
|
"AVDID": "AVD-DS-0026",
|
||||||
"Title": "No HEALTHCHECK defined",
|
"Title": "No HEALTHCHECK defined",
|
||||||
"Description": "You shoud add HEALTHCHECK instruction in your docker container images to perform the health check on running containers.",
|
"Description": "You should add HEALTHCHECK instruction in your docker container images to perform the health check on running containers.",
|
||||||
"Message": "Add HEALTHCHECK instruction in your Dockerfile",
|
"Message": "Add HEALTHCHECK instruction in your Dockerfile",
|
||||||
"Namespace": "builtin.dockerfile.DS026",
|
"Namespace": "builtin.dockerfile.DS026",
|
||||||
"Query": "data.builtin.dockerfile.DS026.deny",
|
"Query": "data.builtin.dockerfile.DS026.deny",
|
||||||
|
|||||||
@@ -37,7 +37,7 @@
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
],
|
],
|
||||||
"version": "0.38.1"
|
"version": "0.40.0"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"results": [
|
"results": [
|
||||||
|
|||||||
Reference in New Issue
Block a user