Skip to content

SCA/Trivy

SCA/Trivy #4

Workflow file for this run

## Scan a docker image -> get a SARIF/SBOM report
name: SCA/Trivy
on:
workflow_dispatch:
inputs:
docker_image:
description: 'The Docker image to scan'
required: true
default: 'appsecco/dvna:sqlite'
# env:
# REGISTRY: ghcr.io
# IMAGE_NAME: ${{ github.repository }}
# SHA: ${{ github.event.pull_request.head.sha || github.event.after }}
jobs:
trivy:
runs-on: ubuntu-latest
permissions:
contents: write
packages: write
security-events: write
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
## Optional: login if your image is private
# - name: Login to Dockerhub
# uses: docker/login-action@v3
# with:
# username: ${{ secrets.DOCKERHUB_USERNAME }}
# password: ${{ secrets.DOCKERHUB_TOKEN }}
# - name: Login to GHCR
# uses: docker/login-action@v3
# with:
# registry: ${{ env.REGISTRY }}
# username: ${{ github.actor }}
# password: ${{ secrets.GITHUB_TOKEN }}
# Pull the github input image or use the default
- name: Pull the image
run: docker pull ${{ github.event.inputs.docker_image }}
- name: Run Trivy vulnerability scanner
uses: aquasecurity/[email protected]
with:
image-ref: ${{ github.event.inputs.docker_image }}
format: 'sarif'
output: sca_trivy.sarif
#exit-code: '1'
ignore-unfixed: true
# severity: 'CRITICAL,HIGH'
scanners: 'vuln'
- name: Run Trivy SBOM scanner
uses: aquasecurity/[email protected]
with:
image-ref: ${{ github.event.inputs.docker_image }}
format: 'spdx-json'
output: sca_trivy.spdx.json
- name: Upload SARIF file as an artifact
uses: actions/upload-artifact@v4
with:
name: sca_trivy.sarif
path: sca_trivy.sarif
- name: Upload SARIF file as an artifact
uses: actions/upload-artifact@v4
with:
name: sca_trivy.spdx.json
path: sca_trivy.spdx.json
# Only available on Github Enterprise or public repositories
- name: Upload SARIF file
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: sca_trivy.sarif
category: Security/SCA