-
Notifications
You must be signed in to change notification settings - Fork 4
79 lines (60 loc) · 2.88 KB
/
trivy_image_check.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
name: Trivy images check
env:
MODULES_MODULE_NAME: ${{ vars.RENAMED_MODULE_NAME }}
MODULES_MODULE_SOURCE: ${{ vars.DEV_MODULE_SOURCE }}
PR_NUMBER: ${{ github.event.pull_request.number }}
MODULES_REGISTRY: ${{ vars.DEV_REGISTRY }}
MODULES_REGISTRY_LOGIN: ${{ vars.RENAMED_DEV_MODULES_REGISTRY_LOGIN }}
MODULES_REGISTRY_PASSWORD: ${{ secrets.DEV_MODULES_REGISTRY_PASSWORD }}
on:
pull_request:
jobs:
test:
name: Trivy images check
runs-on: [self-hosted, regular]
steps:
- uses: actions/checkout@v4
- uses: deckhouse/modules-actions/setup@v1
- name: Check and Install Latest Trivy
run: |
mkdir -p $HOME/bin
LATEST_VERSION=$(curl -sL https://api.github.com/repos/aquasecurity/trivy/releases/latest | jq -r ".tag_name")
CLEAN_VERSION=${LATEST_VERSION#v}
INSTALL_TRIVY=true
if [[ -f "$HOME/bin/trivy" ]]; then
INSTALLED_VERSION=$("$HOME/bin/trivy" --version | grep -oE 'Version: [0-9]+\.[0-9]+\.[0-9]+' | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')
if [ "$INSTALLED_VERSION" == "$CLEAN_VERSION" ]; then
echo "Trivy is already up-to-date (version $INSTALLED_VERSION)."
INSTALL_TRIVY=false
else
echo "Updating Trivy from version $INSTALLED_VERSION to $CLEAN_VERSION."
fi
else
echo "Trivy is not installed. Installing version $CLEAN_VERSION."
fi
if [ "$INSTALL_TRIVY" = true ]; then
wget https://github.com/aquasecurity/trivy/releases/download/$LATEST_VERSION/trivy_${CLEAN_VERSION}_Linux-64bit.tar.gz -O trivy.tar.gz
tar zxvf trivy.tar.gz -C $HOME/bin
fi
echo "$HOME/bin" >> $GITHUB_PATH
- name: Run Trivy vulnerability scanner in image mode
run: |
exit_code=0
image_name=$MODULES_MODULE_SOURCE/$MODULES_MODULE_NAME
image_name_with_tag=$MODULES_MODULE_SOURCE/$MODULES_MODULE_NAME:pr$PR_NUMBER
crane_output=$(crane export $image_name_with_tag | tar -xOf - images_digests.json | jq -c 'to_entries[]')
while read -r item; do
key=$(echo "$item" | jq -r '.key')
value=$(echo "$item" | jq -r '.value')
echo 'Checking image '$key' '$value
trivy image --quiet --config trivy-silent.yaml --format table $image_name@$value
result=$(trivy image --quiet --config trivy-silent.yaml --format json $image_name@$value)
vulnerabilities=$(echo "$result" | jq '[.Results[]? | select(has("Vulnerabilities")) | .Vulnerabilities | length] | add // 0')
if [ "$vulnerabilities" -gt 0 ]; then
echo "There are vulnerabilities in image"
exit_code=1
else
echo "There are no vulnerabilities in image"
fi
done <<< "$crane_output"
exit $exit_code