Skip to content

Trivy Vulnerability Scan (Repo mode) #54

Trivy Vulnerability Scan (Repo mode)

Trivy Vulnerability Scan (Repo mode) #54

Workflow file for this run

name: Trivy Vulnerability Scan (Repo mode)
on:
workflow_dispatch:
inputs:
config-path:
description: 'Relative path to Trivy config file'
default: '.github/trivy-to-console.yaml'
required: false
type: string
upload-results:
description: 'Upload scan results to Github?'
default: false
required: false
type: boolean
workflow_call:
inputs:
config-path:
description: 'Relative path to Trivy config file'
default: '.github/trivy-to-console.yaml'
required: false
type: string
upload-results:
description: 'Upload scan results to Github?'
default: false
required: false
type: boolean
schedule:
- cron: '0 14 * * */3' # Once every 3 day at 14:00 UTC
jobs:
run_trivy_scan:
name: Run Trivy Scan
runs-on: ubuntu-latest
env:
LOCAL_REPOSITORY_PATH: ./build/publications/repos
TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db,aquasec/trivy-db,ghcr.io/aquasecurity/trivy-db
TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db,aquasec/trivy-java-db,ghcr.io/aquasecurity/trivy-java-db
steps:
- uses: actions/checkout@v4
- uses: spring-io/spring-gradle-build-action@v2
- name: Publish to local repo (poms)
run: |
./gradlew publishMavenJavaPublicationToLocalRepository
- name: Run Trivy scan in repo mode (fs)
uses: aquasecurity/trivy-action@master
with:
scan-type: 'fs'
scan-ref: '${{ env.LOCAL_REPOSITORY_PATH }}/org/springframework/pulsar'
trivy-config: ${{ inputs.config-path }}
github-pat: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
- name: Upload Trivy scan results to GitHub Security tab
if: inputs.upload-results
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: 'trivy-results.sarif'