Add secondary db repos

GSA-TTS · Nov 15, 2024 · f1935eb · f1935eb
1 parent 7f812e0
commit f1935eb
Showing 1 changed file with 26 additions and 19 deletions.
diff --git a/.github/workflows/pull-containers-and-push-to-ghcr.yml b/.github/workflows/pull-containers-and-push-to-ghcr.yml
@@ -35,26 +35,33 @@ jobs:
       - name: Pull Docker Image
         run: docker pull ${{ matrix.image.name }}
 
-      - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/[email protected]
-        env:
-          TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db,ghcr.io/aquasecurity/trivy-db
-          TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db,ghcr.io/aquasecurity/trivy-java-db
-          TRIVY_SKIP_DB_UPDATE: true
-          TRIVY_SKIP_JAVA_DB_UPDATE: true
-          TRIVY_DISABLE_VEX_NOTICE: true
-        with:
-          image-ref: '${{ matrix.image.name }}'
-          scan-type: 'image'
-          hide-progress: false
-          exit-code: 1
-          severity: 'CRITICAL,HIGH'
-          scanners: 'vuln'
-          timeout: 15m0s
-          ignore-unfixed: true
+      # - name: Run Trivy vulnerability scanner
+      #   uses: aquasecurity/[email protected]
+      #   env:
+      #     TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db,ghcr.io/aquasecurity/trivy-db
+      #     TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db,ghcr.io/aquasecurity/trivy-java-db
+      #     TRIVY_SKIP_DB_UPDATE: true
+      #     TRIVY_SKIP_JAVA_DB_UPDATE: true
+      #     TRIVY_DISABLE_VEX_NOTICE: true
+      #   with:
+      #     image-ref: '${{ matrix.image.name }}'
+      #     scan-type: 'image'
+      #     hide-progress: false
+      #     exit-code: 1
+      #     format: 'sarif'
+      #     output: 'trivy-pull-image-results.sarif'
+      #     severity: 'CRITICAL,HIGH'
+      #     scanners: 'vuln'
+      #     timeout: 15m0s
+      #     ignore-unfixed: true
+
+      # - name: Upload Trivy scan results to GitHub Security tab for Third Party Images
+      #   uses: github/codeql-action/upload-sarif@v3
+      #   with:
+      #     sarif_file: 'trivy-pull-image-results.sarif'
 
-      # - name: Scan Image
-      #   run: docker run aquasec/trivy:latest image --timeout 5m --scanners vuln --exit-code 1 --severity CRITICAL,HIGH  ${{ matrix.image.name }}
+      - name: Scan Image
+        run: docker run aquasec/trivy:latest image --trivy_db_repository public.ecr.aws/aquasecurity/trivy-db,ghcr.io/aquasecurity/trivy-db --trivy_java_db_repository public.ecr.aws/aquasecurity/trivy-java-db,ghcr.io/aquasecurity/trivy-java-db --timeout 5m --scanners vuln --exit-code 1 --severity CRITICAL,HIGH  ${{ matrix.image.name }}
 
       - name: Tag Image
         run: |