Add trivy scan

mjanez · Sep 14, 2023 · 93b5fad · 93b5fad
1 parent 770bfef
commit 93b5fad
Show file tree

Hide file tree

Showing 2 changed files with 40 additions and 20 deletions.
diff --git a/.github/workflows/docker-dev.yaml b/.github/workflows/docker-dev.yaml
@@ -55,14 +55,24 @@ jobs:
           context: ${{ env.CONTEXT }}
           file: ${{ env.CONTEXT }}${{ env.DOCKERFILE_PATH }}/${{ env.DOCKERFILE }}
 
-      - 
-        name: Scan & lint image
-        uses: ISID/[email protected]
-        continue-on-error: true
-        with:
-          tag: ${{ env.IMAGE_NAME }}
-          path: ${{ env.CONTEXT }}${{ env.DOCKERFILE_PATH }}
-          dockerfile: ${{ env.DOCKERFILE }}
-          hadolint-severity: none
-          dockle-severity: FATAL
-          trivy-severity: CRITICAL
+          - 
+            name: Linting image with hadolint
+            id: hadolint
+            uses: hadolint/[email protected]
+            with:
+              dockerfile: ${{ env.CONTEXT }}${{ env.DOCKERFILE_PATH }}/${{ env.DOCKERFILE }}
+
+          -
+            name: Run Trivy vulnerability scanner
+            uses: aquasecurity/trivy-action@master
+            with:
+              image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}'
+              format: 'sarif'
+              output: 'trivy-results.sarif'
+
+          - 
+            name: Upload Trivy scan results to GitHub Security tab
+            uses: github/codeql-action/upload-sarif@v2
+            if: always()
+            with:
+              sarif_file: 'trivy-results.sarif'
diff --git a/.github/workflows/docker.yaml b/.github/workflows/docker.yaml
@@ -56,13 +56,23 @@ jobs:
           file: ${{ env.CONTEXT }}${{ env.DOCKERFILE_PATH }}/${{ env.DOCKERFILE }}
 
       - 
-        name: Scan & lint image
-        uses: ISID/[email protected]
-        continue-on-error: true
+        name: Linting image with hadolint
+        id: hadolint
+        uses: hadolint/[email protected]
         with:
-          tag: ${{ env.IMAGE_NAME }}
-          path: ${{ env.CONTEXT }}${{ env.DOCKERFILE_PATH }}
-          dockerfile: ${{ env.DOCKERFILE }}
-          hadolint-severity: none
-          dockle-severity: FATAL
-          trivy-severity: CRITICAL
+          dockerfile: ${{ env.CONTEXT }}${{ env.DOCKERFILE_PATH }}/${{ env.DOCKERFILE }}
+
+      -
+        name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}'
+          format: 'sarif'
+          output: 'trivy-results.sarif'
+
+      - 
+        name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v2
+        if: always()
+        with:
+          sarif_file: 'trivy-results.sarif'