From e704f1c77288c3f4ed8178b166b97f963e709501 Mon Sep 17 00:00:00 2001 From: mamutmk5 <3045922+mamutmk5@users.noreply.github.com> Date: Wed, 6 Nov 2024 16:34:32 +0100 Subject: [PATCH 1/5] BC-8372 - trivy use cache for DBs --- .github/workflows/push.yml | 8 ++++++++ .github/workflows/trivy.yml | 39 +++++++++++++++++++++++++++++++++++++ 2 files changed, 47 insertions(+) create mode 100644 .github/workflows/trivy.yml diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 0726c2cf..485e608e 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -107,6 +107,11 @@ jobs: contents: read security-events: write steps: + - name: Restore cached trivy DBs + uses: actions/cache/restore@v4 + with: + path: ${{ github.workspace }}/.cache/trivy + key: cache-trivy-${{ steps.date.outputs.date }} - name: Checkout code uses: actions/checkout@v4 @@ -119,6 +124,9 @@ jobs: severity: 'CRITICAL,HIGH' exit-code: 1 ignore-unfixed: true + env: + TRIVY_SKIP_DB_UPDATE: true + TRIVY_SKIP_JAVA_DB_UPDATE: true - name: upload trivy results if: ${{ always() }} uses: github/codeql-action/upload-sarif@v3 diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml new file mode 100644 index 00000000..9ba6d25b --- /dev/null +++ b/.github/workflows/trivy.yml @@ -0,0 +1,39 @@ +# Note: This workflow only updates the cache. You should create a separate workflow for your actual Trivy scans. +# In your scan workflow, set TRIVY_SKIP_DB_UPDATE=true and TRIVY_SKIP_JAVA_DB_UPDATE=true. +name: Update Trivy Cache + +on: + schedule: + - cron: '0 0 * * *' # Run daily at midnight UTC + workflow_dispatch: # Allow manual triggering + +jobs: + update-trivy-db: + runs-on: ubuntu-latest + steps: + - name: Setup oras + uses: oras-project/setup-oras@v1 + + - name: Get current date + id: date + run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT + + - name: Download and extract the vulnerability DB + run: | + mkdir -p $GITHUB_WORKSPACE/.cache/trivy/db + oras pull ghcr.io/aquasecurity/trivy-db:2 + tar -xzf db.tar.gz -C $GITHUB_WORKSPACE/.cache/trivy/db + rm db.tar.gz + + - name: Download and extract the Java DB + run: | + mkdir -p $GITHUB_WORKSPACE/.cache/trivy/java-db + oras pull ghcr.io/aquasecurity/trivy-java-db:1 + tar -xzf javadb.tar.gz -C $GITHUB_WORKSPACE/.cache/trivy/java-db + rm javadb.tar.gz + + - name: Cache DBs + uses: actions/cache/save@v4 + with: + path: ${{ github.workspace }}/.cache/trivy + key: cache-trivy-${{ steps.date.outputs.date }} From 24a811ecf47b58859de82acb1174fa32df0b2549 Mon Sep 17 00:00:00 2001 From: mamutmk5 <3045922+mamutmk5@users.noreply.github.com> Date: Wed, 6 Nov 2024 17:07:27 +0100 Subject: [PATCH 2/5] BC-8372 - fix trivy cache name --- .github/workflows/push.yml | 2 +- .github/workflows/trivy.yml | 6 +----- 2 files changed, 2 insertions(+), 6 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 485e608e..c722df2e 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -111,7 +111,7 @@ jobs: uses: actions/cache/restore@v4 with: path: ${{ github.workspace }}/.cache/trivy - key: cache-trivy-${{ steps.date.outputs.date }} + key: cache-trivy - name: Checkout code uses: actions/checkout@v4 diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml index 9ba6d25b..214c7fa0 100644 --- a/.github/workflows/trivy.yml +++ b/.github/workflows/trivy.yml @@ -14,10 +14,6 @@ jobs: - name: Setup oras uses: oras-project/setup-oras@v1 - - name: Get current date - id: date - run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT - - name: Download and extract the vulnerability DB run: | mkdir -p $GITHUB_WORKSPACE/.cache/trivy/db @@ -36,4 +32,4 @@ jobs: uses: actions/cache/save@v4 with: path: ${{ github.workspace }}/.cache/trivy - key: cache-trivy-${{ steps.date.outputs.date }} + key: cache-trivy From 11a6a7f149a21196cbb9891a0856fa98b4bd6fea Mon Sep 17 00:00:00 2001 From: mamutmk5 <3045922+mamutmk5@users.noreply.github.com> Date: Thu, 7 Nov 2024 09:28:08 +0100 Subject: [PATCH 3/5] BC-8372 - fix cache nameing --- .github/workflows/push.yml | 5 ++++- .github/workflows/trivy.yml | 6 +++++- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index c722df2e..1de2c9e1 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -107,11 +107,14 @@ jobs: contents: read security-events: write steps: + - name: Get current date + id: date + run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT - name: Restore cached trivy DBs uses: actions/cache/restore@v4 with: path: ${{ github.workspace }}/.cache/trivy - key: cache-trivy + key: cache-trivy-${{ steps.date.outputs.date }} - name: Checkout code uses: actions/checkout@v4 diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml index 214c7fa0..9ba6d25b 100644 --- a/.github/workflows/trivy.yml +++ b/.github/workflows/trivy.yml @@ -14,6 +14,10 @@ jobs: - name: Setup oras uses: oras-project/setup-oras@v1 + - name: Get current date + id: date + run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT + - name: Download and extract the vulnerability DB run: | mkdir -p $GITHUB_WORKSPACE/.cache/trivy/db @@ -32,4 +36,4 @@ jobs: uses: actions/cache/save@v4 with: path: ${{ github.workspace }}/.cache/trivy - key: cache-trivy + key: cache-trivy-${{ steps.date.outputs.date }} From 3a37b504e74e08f07a7b36b2c9a653aa4508c27f Mon Sep 17 00:00:00 2001 From: mamutmk5 <3045922+mamutmk5@users.noreply.github.com> Date: Thu, 7 Nov 2024 16:04:51 +0100 Subject: [PATCH 4/5] BC-8372 - update trivy version --- .github/workflows/push.yml | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index 1de2c9e1..c84a832e 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -107,19 +107,11 @@ jobs: contents: read security-events: write steps: - - name: Get current date - id: date - run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT - - name: Restore cached trivy DBs - uses: actions/cache/restore@v4 - with: - path: ${{ github.workspace }}/.cache/trivy - key: cache-trivy-${{ steps.date.outputs.date }} - name: Checkout code uses: actions/checkout@v4 - name: run trivy vulnerability scanner - uses: aquasecurity/trivy-action@1f6384b6ceecbbc6673526f865b818a2a06b07c9 + uses: aquasecurity/trivy-action@915b19bbe73b92a6cf82a1bc12b087c9a19a5fe2 with: image-ref: 'ghcr.io/${{ github.repository }}:${{ github.sha }}' format: 'sarif' From 44a014531c24c27ef78b812ecbb7c90017a3b13a Mon Sep 17 00:00:00 2001 From: mamutmk5 <3045922+mamutmk5@users.noreply.github.com> Date: Thu, 7 Nov 2024 16:08:53 +0100 Subject: [PATCH 5/5] BC-8372 - set scan type for trevy --- .github/workflows/push.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml index c84a832e..207bff8a 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/push.yml @@ -119,6 +119,7 @@ jobs: severity: 'CRITICAL,HIGH' exit-code: 1 ignore-unfixed: true + scan-type: 'image' env: TRIVY_SKIP_DB_UPDATE: true TRIVY_SKIP_JAVA_DB_UPDATE: true