Skip to content

Trivy Analysis (indy_node:latest) #94

Trivy Analysis (indy_node:latest)

Trivy Analysis (indy_node:latest) #94

Workflow file for this run

name: Trivy Analysis (indy_node:latest)
on:
schedule:
# run every Wednesday at 23:20
- cron: '20 23 * * 3'
workflow_dispatch:
jobs:
workflow_setup:
name: Setup variables
runs-on: ubuntu-latest
outputs:
repo_owner: ${{ steps.repo_owner.outputs.lowercase }}
steps:
- name: Lowercase repo owner
id: repo_owner
run: echo "lowercase=$(echo ${{ github.repository_owner }} | tr \"[:upper:]\" \"[:lower:]\")" >> $GITHUB_OUTPUT
shell: bash
trivy_analysis:
name: Trivy Analysis of Indy Node Images
runs-on: "ubuntu-20.04"
needs: workflow_setup
strategy:
matrix:
os_version: [ debian10, debian11, ubuntu16, ubuntu18, ubuntu20 ]
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: indy-node-version
id: indy-node-version
shell: bash
run: |
export nodeVersion=$(sed "s/~/-/" <<<$(grep -oP "indy-node=\"?\d+.\d+.\d+((~|.)?rc\d+)?\"?" build/Dockerfile.${{ matrix.os_version }} | grep -oP "\d+.\d+.\d+((~|.|-)?rc\d+)?"))
echo "::debug::IndyNode Version is ${nodeVersion}"
echo "::group::DEBUG"
echo "IndyNode Version is ${nodeVersion}"
echo "::endgroup::"
echo "nodeVersion=${nodeVersion}">> $GITHUB_OUTPUT
- name: Run Trivy on indy_node${{ steps.indy-node-version.outputs.nodeVersion }}:${{ matrix.os_version }}
uses: aquasecurity/trivy-action@master
with:
image-ref: 'ghcr.io/${{ needs.workflow_setup.outputs.repo_owner }}/indy-node-container/indy_node:${{ steps.indy-node-version.outputs.nodeVersion }}-${{ matrix.os_version }}-main'
format: 'template'
template: '@/contrib/sarif.tpl'
output: 'trivy-indy-node-${{ steps.indy-node-version.outputs.nodeVersion }}-${{ matrix.os_version }}.sarif'
ignore-unfixed: true
severity: 'CRITICAL,HIGH'
- name: Patch tool name for ${{ matrix.os_version }} scan
run: |
sed -i 's/"name": "Trivy",/"name": "Trivy${{ matrix.os_version }}Latest",/g' trivy-indy-node-${{ steps.indy-node-version.outputs.nodeVersion }}-${{ matrix.os_version }}.sarif
- name: 'Safe trivy-indy-node-${{ matrix.os_version }}.sarif'
uses: actions/upload-artifact@v4
with:
name: trivy-indy-node-${{ steps.indy-node-version.outputs.nodeVersion }}-${{ matrix.os_version }}.sarif
path: trivy-indy-node-${{ steps.indy-node-version.outputs.nodeVersion }}-${{ matrix.os_version }}.sarif
retention-days: 8
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: 'trivy-indy-node-${{ steps.indy-node-version.outputs.nodeVersion }}-${{ matrix.os_version }}.sarif'