From eccdc0647be898fdc5886860d12a9d028ff5c43f Mon Sep 17 00:00:00 2001 From: Tunahan Cicek Date: Mon, 8 Jul 2024 10:38:08 +0200 Subject: [PATCH] Fix trivy scan yaml --- .github/workflows/trivy.yml | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml index 429e03cd..60d0a356 100644 --- a/.github/workflows/trivy.yml +++ b/.github/workflows/trivy.yml @@ -46,17 +46,20 @@ jobs: uses: actions/checkout@v3 - name: Run Trivy vulnerability scanner in repo mode - uses: aquasecurity/trivy-action@0.14.0 + uses: aquasecurity/trivy-action@0.18.0 with: scan-type: "config" - # ignore-unfixed: true - hide-progress: false format: "sarif" output: "trivy-results1.sarif" + severity: "CRITICAL,HIGH" # While vulnerabilities of all severities are reported in the SARIF output, the exit code and workflow failure are triggered only by these specified severities (CRITICAL or HIGH). + # ignore-unfixed: true + hide-progress: false vuln-type: "os,library" + exit-code: "1" # Trivy exits with code 1 if vulnerabilities are found, causing the workflow step to fail. + limit-severities-for-sarif: true - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v2 + uses: github/codeql-action/upload-sarif@v3 if: always() with: sarif_file: "trivy-results1.sarif" @@ -81,18 +84,19 @@ jobs: run: mvn clean package - name: Run Trivy vulnerability scanner - uses: aquasecurity/trivy-action@0.14.0 + uses: aquasecurity/trivy-action@0.18.0 with: image-ref: "tractusx/sldt-digital-twin-registry:latest" + format: "sarif" + output: "trivy-results-registry.sarif" + severity: "CRITICAL,HIGH" # While vulnerabilities of all severities are reported in the SARIF output, the exit code and workflow failure are triggered only by these specified severities (CRITICAL or HIGH). # ignore-unfixed: true hide-progress: false exit-code: "1" # Trivy exits with code 1 if vulnerabilities are found, causing the workflow step to fail. - limit-severities-for-sarif: true - format: "sarif" - output: "trivy-results-registry.sarif" vuln-type: "os,library" + limit-severities-for-sarif: true - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v2 + uses: github/codeql-action/upload-sarif@v3 if: always() with: sarif_file: "trivy-results-registry.sarif"