51affaa84c
This commit is a workaround for the TOOMANYREQUESTS issue currently breaking Trivy scan workflow.
57 lines
1.9 KiB
YAML
57 lines
1.9 KiB
YAML
name: Trivy Vulnerability Scan (Repo mode)
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
config-path:
|
|
description: 'Relative path to Trivy config file'
|
|
default: '.github/trivy-to-console.yaml'
|
|
required: false
|
|
type: string
|
|
upload-results:
|
|
description: 'Upload scan results to Github?'
|
|
default: false
|
|
required: false
|
|
type: boolean
|
|
workflow_call:
|
|
inputs:
|
|
config-path:
|
|
description: 'Relative path to Trivy config file'
|
|
default: '.github/trivy-to-console.yaml'
|
|
required: false
|
|
type: string
|
|
upload-results:
|
|
description: 'Upload scan results to Github?'
|
|
default: false
|
|
required: false
|
|
type: boolean
|
|
schedule:
|
|
- cron: '0 14 * * */3' # Once every 3 day at 14:00 UTC
|
|
|
|
jobs:
|
|
run_trivy_scan:
|
|
name: Run Trivy Scan
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
LOCAL_REPOSITORY_PATH: ./build/publications/repos
|
|
TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db,aquasec/trivy-db,ghcr.io/aquasecurity/trivy-db
|
|
TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db,aquasec/trivy-java-db,ghcr.io/aquasecurity/trivy-java-db
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: spring-io/spring-gradle-build-action@v2
|
|
- name: Publish to local repo (poms)
|
|
run: |
|
|
./gradlew publishMavenJavaPublicationToLocalRepository
|
|
- name: Run Trivy scan in repo mode (fs)
|
|
uses: aquasecurity/trivy-action@master
|
|
with:
|
|
scan-type: 'fs'
|
|
scan-ref: '${{ env.LOCAL_REPOSITORY_PATH }}/org/springframework/pulsar'
|
|
trivy-config: ${{ inputs.config-path }}
|
|
github-pat: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
|
|
- name: Upload Trivy scan results to GitHub Security tab
|
|
if: inputs.upload-results
|
|
uses: github/codeql-action/upload-sarif@v3
|
|
with:
|
|
sarif_file: 'trivy-results.sarif'
|