a
/
code-server
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

feat(ci): add trivy scans to workflow 

This adds both a trivy scan for the repo and a trivy scan for our Docker image.
This commit is contained in:
Joe Previte 2021-04-29 12:12:03 -07:00
parent f8d8ad38c1
commit 6d5c60387c
No known key found for this signature in database
GPG Key ID: 2C91590C6B742C24
1 changed files with 58 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

58
.github/workflows/ci.yaml vendored
View File

@ -406,3 +406,61 @@ jobs:
with:
name: release-images
path: ./release-images
trivy-scan-image:
runs-on: ubuntu-20.04
needs: docker-amd64
steps:
- name: Checkout code
uses: actions/checkout@v2
- name: Download release images
uses: actions/download-artifact@v2
with:
name: release-images
path: ./release-images
- name: Run Trivy vulnerability scanner in image mode
# Commit SHA for v0.0.14
uses: aquasecurity/trivy-action@b38389f8efef9798810fe0c5b5096ac198cffd54
with:
input: "./release-images/code-server-amd64-*.tar"
scan-type: "image"
ignore-unfixed: true
format: "template"
template: "@/contrib/sarif.tpl"
output: "trivy-image-results.sarif"
severity: "HIGH,CRITICAL"
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v1
with:
sarif_file: "trivy-image-results.sarif"
# We have to use two trivy jobs
# because GitHub only allows
# codeql/upload-sarif action per job
trivy-scan-repo:
runs-on: ubuntu-20.04
steps:
- name: Checkout code
uses: actions/checkout@v2
- name: Run Trivy vulnerability scanner in repo mode
# Commit SHA for v0.0.14
uses: aquasecurity/trivy-action@b38389f8efef9798810fe0c5b5096ac198cffd54
with:
scan-type: "fs"
scan-ref: "."
ignore-unfixed: true
format: "template"
template: "@/contrib/sarif.tpl"
output: "trivy-repo-results.sarif"
severity: "HIGH,CRITICAL"
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v1
with:
sarif_file: "trivy-repo-results.sarif"