Skip to content

Run Trivy scan and upload SARIF #581

Run Trivy scan and upload SARIF

Run Trivy scan and upload SARIF #581

Workflow file for this run

#
# Copyright (c) 2023 Volkswagen AG
# Copyright (c) 2023 Fraunhofer-Gesellschaft zur Foerderung der angewandten Forschung e.V. (represented by Fraunhofer ISST)
# Copyright (c) 2023 Contributors to the Eclipse Foundation
#
# See the NOTICE file(s) distributed with this work for additional
# information regarding copyright ownership.
#
# This program and the accompanying materials are made available under the
# terms of the Apache License, Version 2.0 which is available at
# https://www.apache.org/licenses/LICENSE-2.0.
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
# License for the specific language governing permissions and limitations
# under the License.
#
# SPDX-License-Identifier: Apache-2.0
#
name: "Run Trivy scan and upload SARIF"
on:
workflow_dispatch:
schedule:
- cron: "0 0 * * *" # Once a day
jobs:
analyze-frontend:
name: Analyze frontend
runs-on: ubuntu-latest
permissions:
actions: read
contents: read
security-events: write
steps:
- name: Checkout repository
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
- name: Run Trivy vulnerability scanner in repo mode
uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8 # v0.24.0
with:
image-ref: "tractusx/app-puris-frontend:latest"
format: "sarif"
output: "trivy-results-1.sarif"
vuln-type: "os,library"
severity: "CRITICAL,HIGH" # While vulnerabilities of all severities are reported in the SARIF output, the exit code and workflow failure are triggered only by these specified severities (CRITICAL or HIGH).
exit-code: "1"
limit-severities-for-sarif: true
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@2c779ab0d087cd7fe7b826087247c2c81f27bfa6 # v3.26.5
if: always()
with:
sarif_file: "trivy-results-1.sarif"
analyze-backend:
name: Analyze backend
runs-on: ubuntu-latest
permissions:
actions: read
contents: read
security-events: write
steps:
# Pull image from Docker Hub and run Trivy vulnerability scanner
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8 # v0.24.0
with:
image-ref: "tractusx/app-puris-backend:latest"
format: "sarif"
output: "trivy-results-2.sarif"
vuln-type: "os,library"
severity: "CRITICAL,HIGH" # While vulnerabilities of all severities are reported in the SARIF output, the exit code and workflow failure are triggered only by these specified severities (CRITICAL or HIGH).
exit-code: "1"
limit-severities-for-sarif: true
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@2c779ab0d087cd7fe7b826087247c2c81f27bfa6 # v3.26.5
with:
sarif_file: "trivy-results-2.sarif"