From ec398b6ab1de83122761a66b2e644b7a7510c84f Mon Sep 17 00:00:00 2001 From: Tunahan Cicek Date: Mon, 8 Jul 2024 15:38:54 +0200 Subject: [PATCH] Adjust trivy scan --- .github/workflows/trivy.yml | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-) diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml index 201394a..f550737 100644 --- a/.github/workflows/trivy.yml +++ b/.github/workflows/trivy.yml @@ -44,22 +44,25 @@ jobs: uses: actions/checkout@v3 - name: Run Trivy vulnerability scanner in repo mode - uses: aquasecurity/trivy-action@0.14.0 + uses: aquasecurity/trivy-action@0.18.0 with: scan-type: "config" - # ignore-unfixed: true - hide-progress: false format: "sarif" output: "trivy-results1.sarif" + severity: "CRITICAL,HIGH" # While vulnerabilities of all severities are reported in the SARIF output, the exit code and workflow failure are triggered only by these specified severities (CRITICAL or HIGH). + # ignore-unfixed: true + hide-progress: false vuln-type: "os,library" + exit-code: "1" # Trivy exits with code 1 if vulnerabilities are found, causing the workflow step to fail. + limit-severities-for-sarif: true" - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v2 + uses: github/codeql-action/upload-sarif@v3 if: always() with: sarif_file: "trivy-results1.sarif" - analyze-registry: + analyze-discovery-finder: runs-on: ubuntu-latest permissions: actions: read @@ -79,17 +82,20 @@ jobs: run: mvn clean package - name: Run Trivy vulnerability scanner - uses: aquasecurity/trivy-action@0.14.0 + uses: aquasecurity/trivy-action@0.18.0 with: image-ref: "tractusx/sldt-discovery-finder:latest" + format: "sarif" + output: "trivy-results-bpn-discovery.sarif" + severity: "CRITICAL,HIGH" # While vulnerabilities of all severities are reported in the SARIF output, the exit code and workflow failure are triggered only by these specified severities (CRITICAL or HIGH). # ignore-unfixed: true hide-progress: false - format: "sarif" - output: "trivy-results-registry.sarif" + exit-code: "1" # Trivy exits with code 1 if vulnerabilities are found, causing the workflow step to fail. vuln-type: "os,library" + limit-severities-for-sarif: true - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v2 + uses: github/codeql-action/upload-sarif@v3 if: always() with: sarif_file: "trivy-results-registry.sarif"