update trivy scan (#534)

* Reverting to snapshot to fix build with spring-functions-catalog 5.0.0-M2

* Update Trivy to scan built jars

.github/workflows/ci-pr.yml

@@ -124,6 +124,12 @@ jobs:
           for appdir in $SINKS; do
             ./build-app.sh . "./$appdir" true
           done
+      - name: Scan Jar files
+        shell: bash
+        run: |
+          pushd stream-applications > /dev/null
+            ./scan-folders.sh table
+          popd > /dev/null
       - name: 'Upload: Error logs'
         if: ${{ failure() }}
         uses: actions/upload-artifact@v3
@@ -135,21 +141,6 @@ jobs:
       - name: 'Built'
         shell: bash
         run: echo "::info ::Built"
-  scan:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-      - name: Run Trivy vulnerability scanner in repo mode
-        uses: aquasecurity/trivy-action@master
-        with:
-          scan-type: 'fs'
-          ignore-unfixed: true
-          format: 'table'
-          severity: 'CRITICAL,HIGH'
-          timeout: '15m'
-      - name: 'Scanned'
-        shell: bash
-        run: echo "::info ::Scanned"
   done:
     runs-on: ubuntu-latest
     needs: [ scan, build ]

.github/workflows/common.yml

@@ -37,27 +37,6 @@ env:
   MAVEN_THREADS: ${{ inputs.mavenThreads }}
 
 jobs:
-  scan:
-    if: ${{ github.repository == 'spring-cloud/stream-applications' }}
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-      - name: Run Trivy vulnerability scanner in repo mode
-        uses: aquasecurity/trivy-action@master
-        with:
-          scan-type: 'fs'
-          ignore-unfixed: true
-          format: 'sarif'
-          output: 'trivy-results.sarif'
-          severity: 'CRITICAL,HIGH'
-          timeout: '15m'
-      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v2
-        with:
-          sarif_file: 'trivy-results.sarif'
-      - name: 'Scanned'
-        shell: bash
-        run: echo "::info ::Scanned"
   parameters:
     name: 'parameters - ${{ inputs.branch }}'
     if: ${{ github.repository == 'spring-cloud/stream-applications' }}
@@ -378,6 +357,16 @@ jobs:
               echo "::info ::$MESSAGE"
             fi
           popd > /dev/null
+      - name: Scan Jar files
+        shell: bash
+        run: |
+          pushd stream-applications > /dev/null
+            ./scan-folders.sh
+          popd > /dev/null
+      - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: 'stream-applications/scan.sarif'
       - name: 'Configure: Docker login'
         uses: docker/login-action@v2
         with:
@@ -507,6 +496,16 @@ jobs:
               echo "::info ::$MESSAGE"
             fi
           popd > /dev/null
+      - name: Scan Jar files
+        shell: bash
+        run: |
+          pushd stream-applications > /dev/null
+            ./scan-folders.sh
+          popd > /dev/null
+      - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: 'stream-applications/scan.sarif'
       - name: 'Configure: Docker login'
         uses: docker/login-action@v2
         with:
@@ -637,6 +636,16 @@ jobs:
               echo "::info ::$MESSAGE"
             fi
           popd > /dev/null
+      - name: Scan Jar files
+        shell: bash
+        run: |
+          pushd stream-applications > /dev/null
+            ./scan-folders.sh
+          popd > /dev/null
+      - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: 'stream-applications/scan.sarif'
       - name: 'Configure: Docker login'
         uses: docker/login-action@v2
         with:

scan-folders.sh

@@ -0,0 +1,19 @@
+#!/bin/bash
+SCDIR=$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")
+SCDIR=$(realpath $SCDIR)
+if [ -f $SCDIR/runs.sarif ]; then
+  rm $SCDIR/runs.sarif
+fi
+export TRIVY_UPLOAD=true
+while [ "$1" != "" ]; do
+  if [ "$1" == "table" ]; then
+    export TRIVY_UPLOAD=false
+  fi
+  shift
+done
+find $SCDIR -type d -name target -exec bash "$SCDIR/scan-jars.sh" '{}' \;
+if [ -f "$SCDIR/runs.sarif" ]; then
+  echo "{\"version\": \"2.1.0\", \"\$schema\": \"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json\", \"runs\": [" > $SCDIR/scan.sarif
+  cat "$SCDIR/runs.sarif" >> $SCDIR/scan.sarif
+  echo "]}" >> $SCDIR/scan.sarif
+fi

scan-jar.sh

@@ -0,0 +1,19 @@
+#!/bin/bash
+SCDIR=$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")
+SCDIR=$(realpath $SCDIR)
+if [[ "$1" != *"-sources.jar" ]] && [[ "$1" != *"-javadoc.jar" ]]; then
+    if [ "$TRIVY_UPLOAD" == "true" ]; then
+      echo "Scanning $1"
+      trivy rootfs --format sarif -o "$1.sarif" $1
+      if [ -f $SCDIR/runs.sarif ]; then
+        echo "," >> "$SCDIR/runs.sarif"
+      fi
+      jq -c '.runs | .[]' "$1.sarif" >> "$SCDIR/runs.sarif"
+    else
+      trivy rootfs -q $1
+    fi
+else
+  if [ "$TRIVY_UPLOAD" == "true" ]; then
+    echo "Skipping $1"
+  fi
+fi

scan-jars.sh

@@ -0,0 +1,7 @@
+#!/bin/bash
+SCDIR=$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")
+SCDIR=$(realpath $SCDIR)
+if [ "$TRIVY_UPLOAD" == "true" ]; then
+  echo "Scanning $1"
+fi
+find $1 -type f -name "*.jar" -exec bash "$SCDIR/scan-jar.sh" '{}' \;

trivy.yaml

@@ -1,4 +1,4 @@
 timeout: 10m
 scan:
-  security-checks:
+  scanners:
     - vuln