Merge pull request #149 from bci-oss/chore/fix-trivy-scan

Adjust trivy scan
eclipse-tractusx · Jul 8, 2024 · 273350a · 273350a
2 parents 1562e06 + ec398b6
commit 273350a
Showing 1 changed file with 15 additions and 9 deletions.
diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml
@@ -44,22 +44,25 @@ jobs:
         uses: actions/checkout@v3
 
       - name: Run Trivy vulnerability scanner in repo mode
-        uses: aquasecurity/trivy-action@0.14.0
+        uses: aquasecurity/trivy-action@0.18.0
         with:
           scan-type: "config"
-          # ignore-unfixed: true
-          hide-progress: false
           format: "sarif"
           output: "trivy-results1.sarif"
+          severity: "CRITICAL,HIGH" # While vulnerabilities of all severities are reported in the SARIF output, the exit code and workflow failure are triggered only by these specified severities (CRITICAL or HIGH).
+          # ignore-unfixed: true
+          hide-progress: false
           vuln-type: "os,library"
+          exit-code: "1" # Trivy exits with code 1 if vulnerabilities are found, causing the workflow step to fail.
+          limit-severities-for-sarif: true"
 
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v2
+        uses: github/codeql-action/upload-sarif@v3
         if: always()
         with:
           sarif_file: "trivy-results1.sarif"
 
-  analyze-registry:
+  analyze-discovery-finder:
     runs-on: ubuntu-latest
     permissions:
       actions: read
@@ -79,17 +82,20 @@ jobs:
         run: mvn clean package
 
       - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@0.14.0
+        uses: aquasecurity/trivy-action@0.18.0
         with:
           image-ref: "tractusx/sldt-discovery-finder:latest"
+          format: "sarif"
+          output: "trivy-results-bpn-discovery.sarif"
+          severity: "CRITICAL,HIGH" # While vulnerabilities of all severities are reported in the SARIF output, the exit code and workflow failure are triggered only by these specified severities (CRITICAL or HIGH).
           # ignore-unfixed: true
           hide-progress: false
-          format: "sarif"
-          output: "trivy-results-registry.sarif"
+          exit-code: "1" # Trivy exits with code 1 if vulnerabilities are found, causing the workflow step to fail.
           vuln-type: "os,library"
+          limit-severities-for-sarif: true
 
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v2
+        uses: github/codeql-action/upload-sarif@v3
         if: always()
         with:
           sarif_file: "trivy-results-registry.sarif"