-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #11 from jim60105/ubi
Refactor dockerfile and add UBI image
- Loading branch information
Showing
7 changed files
with
335 additions
and
16 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,70 @@ | ||
| name: scan | ||
|
|
||
| on: | ||
| workflow_run: | ||
| workflows: [docker_publish] | ||
| types: [completed] | ||
|
|
||
| # Allows you to run this workflow manually from the Actions tab | ||
| workflow_dispatch: | ||
|
|
||
| jobs: | ||
| scan-python: | ||
| name: Scan Microsoft official base image | ||
| runs-on: ubuntu-latest | ||
| if: ${{ github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch' }} | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| sparse-checkout: | | ||
| .github/workflows/scan/html.tpl | ||
| sparse-checkout-cone-mode: false | ||
|
|
||
| - name: Run Trivy vulnerability scanner for Microsoft official image | ||
| uses: aquasecurity/[email protected] | ||
| with: | ||
| image-ref: "ghcr.io/jim60105/youtubelivechattodiscord:latest" | ||
| vuln-type: "os,library" | ||
| scanners: vuln | ||
| severity: "CRITICAL,HIGH" | ||
| format: "template" | ||
| template: "@.github/workflows/scan/html.tpl" | ||
| output: "trivy-results-microsoft.html" | ||
|
|
||
| - name: Upload Artifact | ||
| uses: actions/upload-artifact@v3 | ||
| with: | ||
| name: trivy-results | ||
| path: trivy-results-microsoft.html | ||
| retention-days: 90 | ||
|
|
||
| scan-ubi: | ||
| name: Scan Red Hat UBI base image | ||
| runs-on: ubuntu-latest | ||
| if: ${{ github.event.workflow_run.conclusion == 'success' || github.event_name == 'workflow_dispatch' }} | ||
| steps: | ||
| - name: Checkout | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| sparse-checkout: | | ||
| .github/workflows/scan/html.tpl | ||
| sparse-checkout-cone-mode: false | ||
|
|
||
| - name: Run Trivy vulnerability scanner for UBI image | ||
| uses: aquasecurity/[email protected] | ||
| with: | ||
| image-ref: "ghcr.io/jim60105/youtubelivechattodiscord:ubi" | ||
| vuln-type: "os,library" | ||
| scanners: vuln | ||
| severity: "CRITICAL,HIGH" | ||
| format: "template" | ||
| template: "@.github/workflows/scan/html.tpl" | ||
| output: "trivy-results-ubi.html" | ||
|
|
||
| - name: Upload Artifact | ||
| uses: actions/upload-artifact@v3 | ||
| with: | ||
| name: trivy-results | ||
| path: trivy-results-ubi.html | ||
| retention-days: 90 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,149 @@ | ||
| <!-- Template from https://github.com/aquasecurity/trivy/blob/main/contrib/html.tpl --> | ||
| <!DOCTYPE html> | ||
| <html> | ||
| <head> | ||
| <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> | ||
| {{- if . }} | ||
| <style> | ||
| * { | ||
| font-family: Arial, Helvetica, sans-serif; | ||
| } | ||
| h1 { | ||
| text-align: center; | ||
| } | ||
| .group-header th { | ||
| font-size: 200%; | ||
| } | ||
| .sub-header th { | ||
| font-size: 150%; | ||
| } | ||
| table, th, td { | ||
| border: 1px solid black; | ||
| border-collapse: collapse; | ||
| white-space: nowrap; | ||
| padding: .3em; | ||
| } | ||
| table { | ||
| margin: 0 auto; | ||
| } | ||
| .severity { | ||
| text-align: center; | ||
| font-weight: bold; | ||
| color: #fafafa; | ||
| } | ||
| .severity-LOW .severity { background-color: #5fbb31; } | ||
| .severity-MEDIUM .severity { background-color: #e9c600; } | ||
| .severity-HIGH .severity { background-color: #ff8800; } | ||
| .severity-CRITICAL .severity { background-color: #e40000; } | ||
| .severity-UNKNOWN .severity { background-color: #747474; } | ||
| .severity-LOW { background-color: #5fbb3160; } | ||
| .severity-MEDIUM { background-color: #e9c60060; } | ||
| .severity-HIGH { background-color: #ff880060; } | ||
| .severity-CRITICAL { background-color: #e4000060; } | ||
| .severity-UNKNOWN { background-color: #74747460; } | ||
| table tr td:first-of-type { | ||
| font-weight: bold; | ||
| } | ||
| .links a, | ||
| .links[data-more-links=on] a { | ||
| display: block; | ||
| } | ||
| .links[data-more-links=off] a:nth-of-type(1n+5) { | ||
| display: none; | ||
| } | ||
| a.toggle-more-links { cursor: pointer; } | ||
| </style> | ||
| <title>{{- escapeXML ( index . 0 ).Target }} - Trivy Report - {{ now }} </title> | ||
| <script> | ||
| window.onload = function() { | ||
| document.querySelectorAll('td.links').forEach(function(linkCell) { | ||
| var links = [].concat.apply([], linkCell.querySelectorAll('a')); | ||
| [].sort.apply(links, function(a, b) { | ||
| return a.href > b.href ? 1 : -1; | ||
| }); | ||
| links.forEach(function(link, idx) { | ||
| if (links.length > 3 && 3 === idx) { | ||
| var toggleLink = document.createElement('a'); | ||
| toggleLink.innerText = "Toggle more links"; | ||
| toggleLink.href = "#toggleMore"; | ||
| toggleLink.setAttribute("class", "toggle-more-links"); | ||
| linkCell.appendChild(toggleLink); | ||
| } | ||
| linkCell.appendChild(link); | ||
| }); | ||
| }); | ||
| document.querySelectorAll('a.toggle-more-links').forEach(function(toggleLink) { | ||
| toggleLink.onclick = function() { | ||
| var expanded = toggleLink.parentElement.getAttribute("data-more-links"); | ||
| toggleLink.parentElement.setAttribute("data-more-links", "on" === expanded ? "off" : "on"); | ||
| return false; | ||
| }; | ||
| }); | ||
| }; | ||
| </script> | ||
| </head> | ||
| <body> | ||
| <h1>{{- escapeXML ( index . 0 ).Target }} - Trivy Report - {{ now }}</h1> | ||
| <table> | ||
| {{- range . }} | ||
| <tr class="group-header"><th colspan="6">{{ .Type | toString | escapeXML }}</th></tr> | ||
| {{- if (eq (len .Vulnerabilities) 0) }} | ||
| <tr><th colspan="6">No Vulnerabilities found</th></tr> | ||
| {{- else }} | ||
| <tr class="sub-header"> | ||
| <th>Package</th> | ||
| <th>Vulnerability ID</th> | ||
| <th>Severity</th> | ||
| <th>Installed Version</th> | ||
| <th>Fixed Version</th> | ||
| <th>Links</th> | ||
| </tr> | ||
| {{- range .Vulnerabilities }} | ||
| <tr class="severity-{{ escapeXML .Vulnerability.Severity }}"> | ||
| <td class="pkg-name">{{ escapeXML .PkgName }}</td> | ||
| <td>{{ escapeXML .VulnerabilityID }}</td> | ||
| <td class="severity">{{ escapeXML .Vulnerability.Severity }}</td> | ||
| <td class="pkg-version">{{ escapeXML .InstalledVersion }}</td> | ||
| <td>{{ escapeXML .FixedVersion }}</td> | ||
| <td class="links" data-more-links="off"> | ||
| {{- range .Vulnerability.References }} | ||
| <a href={{ escapeXML . | printf "%q" }}>{{ escapeXML . }}</a> | ||
| {{- end }} | ||
| </td> | ||
| </tr> | ||
| {{- end }} | ||
| {{- end }} | ||
| {{- if (eq (len .Misconfigurations ) 0) }} | ||
| <tr><th colspan="6">No Misconfigurations found</th></tr> | ||
| {{- else }} | ||
| <tr class="sub-header"> | ||
| <th>Type</th> | ||
| <th>Misconf ID</th> | ||
| <th>Check</th> | ||
| <th>Severity</th> | ||
| <th>Message</th> | ||
| </tr> | ||
| {{- range .Misconfigurations }} | ||
| <tr class="severity-{{ escapeXML .Severity }}"> | ||
| <td class="misconf-type">{{ escapeXML .Type }}</td> | ||
| <td>{{ escapeXML .ID }}</td> | ||
| <td class="misconf-check">{{ escapeXML .Title }}</td> | ||
| <td class="severity">{{ escapeXML .Severity }}</td> | ||
| <td class="link" data-more-links="off" style="white-space:normal;"> | ||
| {{ escapeXML .Message }} | ||
| <br> | ||
| <a href={{ escapeXML .PrimaryURL | printf "%q" }}>{{ escapeXML .PrimaryURL }}</a> | ||
| </br> | ||
| </td> | ||
| </tr> | ||
| {{- end }} | ||
| {{- end }} | ||
| {{- end }} | ||
| </table> | ||
| {{- else }} | ||
| </head> | ||
| <body> | ||
| <h1>Trivy Returned Empty Report</h1> | ||
| {{- end }} | ||
| </body> | ||
| </html> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.