-
Notifications
You must be signed in to change notification settings - Fork 1
118 lines (104 loc) · 4.85 KB
/
research-vuln-scan.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
name: trivy & grype & sarif & docker scout vulnerability scan
on:
push:
branches: [ "main" ]
pull_request:
# The branches below must be a subset of the branches above
branches: [ "main" ]
permissions:
contents: read
jobs:
trivy:
permissions:
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
name: Trivy
runs-on: self-hosted-generic
steps:
- name: Checkout code
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Login to Greenbone Product container registry
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 #v3.3.0
with:
registry: ${{ vars.GREENBONE_REGISTRY }}
username: ${{ secrets.GREENBONE_REGISTRY_READ_USER }}
password: ${{ secrets.GREENBONE_REGISTRY_READ_TOKEN }}
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@7b7aa264d83dc58691451798b4d117d53d21edfe
with:
image-ref: '${{ vars.GREENBONE_REGISTRY }}/opensight/opensight-postgres:16'
format: 'template'
template: '@/contrib/sarif.tpl'
output: 'trivy-results.sarif'
severity: 'MEDIUM,HIGH,CRITICAL'
github-pat: ${{ secrets.GITHUB_TOKEN }} # or ${{ secrets.github_pat_name }} if you're using a PAT
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@ea9e4e37992a54ee68a9622e985e60c8e8f12d9f # v3.27.4
with:
sarif_file: 'trivy-results.sarif'
category: ${{ github.jobs[github.job].name }}
grype:
permissions:
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
name: Grype
runs-on: self-hosted-generic
steps:
- name: Checkout code
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Login to Greenbone Product container registry
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 #v3.3.0
with:
registry: ${{ vars.GREENBONE_REGISTRY }}
username: ${{ secrets.GREENBONE_REGISTRY_READ_USER }}
password: ${{ secrets.GREENBONE_REGISTRY_READ_TOKEN }}
- name: Run the Anchore Grype scan action
uses: anchore/scan-action@d5aa5b6cb9414b0c7771438046ff5bcfa2854ed7
id: grype
with:
image: '${{ vars.GREENBONE_REGISTRY }}/opensight/opensight-postgres:16'
fail-build: false
severity-cutoff: medium
- name: Upload grype vulnerability report
uses: github/codeql-action/upload-sarif@ea9e4e37992a54ee68a9622e985e60c8e8f12d9f # v3.27.4
with:
sarif_file: ${{ steps.grype.outputs.sarif }}
category: ${{ github.jobs[github.job].name }}
docker-scout:
permissions:
contents: read # for actions/checkout to fetch code
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
pull-requests: write
name: "Docker Scout"
runs-on: self-hosted-generic
steps:
- name: Checkout code
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
- name: Login to Greenbone Product container registry
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 #v3.3.0
with:
registry: ${{ vars.GREENBONE_REGISTRY }}
username: ${{ secrets.GREENBONE_REGISTRY_READ_USER }}
password: ${{ secrets.GREENBONE_REGISTRY_READ_TOKEN }}
- name: Analyze for critical and high CVEs
id: docker-scout-cves
if: ${{ github.event_name != 'pull_request_target' }}
uses: docker/scout-action@v1
with:
command: cves, recommendations, compare
image: '${{ vars.GREENBONE_REGISTRY }}/opensight/opensight-postgres:16'
sarif-file: sarif.output.json
summary: true
dockerhub-user: ${{ secrets.DOCKERHUB_USERNAME }}
dockerhub-password: ${{ secrets.DOCKERHUB_TOKEN }}
only-severities: critical, high, medium
- name: Upload docker scout SARIF result
id: upload-sarif
if: ${{ github.event_name != 'pull_request_target' }}
uses: github/codeql-action/upload-sarif@ea9e4e37992a54ee68a9622e985e60c8e8f12d9f # v3.27.4
with:
sarif_file: sarif.output.json
category: ${{ github.jobs[github.job].name }}