docker-image-scan.yml

name: Docker Image Scan
on:
  workflow_dispatch:
  schedule:
    - cron: "0 0 * * *"

jobs:
  scan:
    name: DockerImageScan
    runs-on: ubuntu-latest
    outputs:
      result: ${{ steps.trivy-result.outputs.result }}
      version: ${{ steps.extract-version.outputs.version }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
      - name: Extract latest release
        id: extract-release
        uses: pozetroninc/github-action-get-latest-release@v0.7.0
        with:
          token: ${{ github.token }}
          repository: ${{ github.repository }}
      - name: Extract version
        id: extract-version
        run: |
          tag=${{ steps.extract-release.outputs.release }}
          version=${tag%-*}
          echo $version
          echo "version=${version}" >> $GITHUB_OUTPUT

      - id: trivy-db
        name: Check trivy db sha
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          endpoint='/orgs/aquasecurity/packages/container/trivy-db/versions'
          headers='Accept: application/vnd.github+json'
          jqFilter='.[] | select(.metadata.container.tags[] | contains("latest")) | .name | sub("sha256:";"")'
          sha=$(gh api -H "${headers}" "${endpoint}" | jq --raw-output "${jqFilter}")
          echo "Trivy DB sha256:${sha}"
          echo "sha=${sha}" >> $GITHUB_OUTPUT
      - id: ignore-policies
        name: Ignore some policies
        run: |
          cat > .trivyignore << EOL
          # Ignore gosu issue. They say they are not affected. Issue will be removed as soon
          # as wiremock image updates to a newer gosu version, which removed runc.
          CVE-2023-27561
          EOL
      - uses: actions/cache@v3
        with:
          path: .trivy
          key: ${{ runner.os }}-trivy-db-${{ steps.trivy-db.outputs.sha }}
      - name: Run Trivy json result
        uses: aquasecurity/trivy-action@0.16.0
        with:
          image-ref: 'docker.io/holomekc/wiremock-gui'
          format: 'json'
          exit-code: '0'
          output: trivy-result.json
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'
          hide-progress: true
          cache-dir: .trivy
      - name: Run Trivy sarif result
        uses: aquasecurity/trivy-action@0.16.0
        with:
          image-ref: 'docker.io/holomekc/wiremock-gui'
          format: 'sarif'
          exit-code: '0'
          output: trivy-result.sarif
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'
          hide-progress: true
          cache-dir: .trivy
      - name: Run Trivy sbom result
        uses: aquasecurity/trivy-action@0.16.0
        with:
          image-ref: 'docker.io/holomekc/wiremock-gui'
          format: 'github'
          exit-code: '0'
          output: dependency-results.sbom.json
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'
          hide-progress: true
          cache-dir: .trivy
          github-pat: ${{ secrets.GITHUB_TOKEN }}
      - name: Fix .trivy permissions
        run: sudo chown -R $(stat . -c %u:%g) .trivy

      - name: Check result
        id: trivy-result
        run: |
          jq -e 'select((.Results[].Vulnerabilities | length) > 0)' trivy-result.json && code=$? || code=$?
          echo "result=${code}" >> $GITHUB_OUTPUT

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: 'trivy-result.sarif'

  docker:
    needs: [scan]
    # Looks strange, but 0=Vulnerabilities found
    if: ${{ needs.scan.outputs.result == 0 }}
    uses: ./.github/workflows/docker-release.yml
    with:
      version: ${{ needs.scan.outputs.version }}
    secrets:
      dockerUsername: ${{ secrets.DOCKERHUB_USERNAME }}
      dockerToken: ${{ secrets.DOCKERHUB_TOKEN }}