Compare commits
1 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
1975dcb126 |
@@ -1,5 +0,0 @@
|
||||
FROM aquasec/trivy:0.20.2
|
||||
COPY entrypoint.sh /
|
||||
RUN apk --no-cache add bash
|
||||
RUN chmod +x /entrypoint.sh
|
||||
ENTRYPOINT ["/entrypoint.sh"]
|
||||
@@ -12,8 +12,6 @@
|
||||
|
||||
- [Usage](#usage)
|
||||
- [Workflow](#workflow)
|
||||
- [Docker Image Scanning](#using-trivy-with-github-code-scanning)
|
||||
- [Git Repository Scanning](#using-trivy-to-scan-your-git-repo)
|
||||
- [Customizing](#customizing)
|
||||
- [Inputs](#inputs)
|
||||
|
||||
@@ -88,222 +86,6 @@ jobs:
|
||||
|
||||
You can find a more in-depth example here: https://github.com/aquasecurity/trivy-sarif-demo/blob/master/.github/workflows/scan.yml
|
||||
|
||||
### Using Trivy to scan your Git repo
|
||||
It's also possible to scan your git repos with Trivy's built-in repo scan. This can be handy if you want to run Trivy as a build time check on each PR that gets opened in your repo. This helps you identify potential vulnerablites that might get introduced with each PR.
|
||||
|
||||
If you have [GitHub code scanning](https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/about-code-scanning) available you can use Trivy as a scanning tool as follows:
|
||||
```yaml
|
||||
name: build
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- master
|
||||
pull_request:
|
||||
jobs:
|
||||
build:
|
||||
name: Build
|
||||
runs-on: ubuntu-18.04
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v2
|
||||
|
||||
- name: Run Trivy vulnerability scanner in repo mode
|
||||
uses: aquasecurity/trivy-action@master
|
||||
with:
|
||||
scan-type: 'fs'
|
||||
ignore-unfixed: true
|
||||
format: 'template'
|
||||
template: '@/contrib/sarif.tpl'
|
||||
output: 'trivy-results.sarif'
|
||||
severity: 'CRITICAL'
|
||||
|
||||
- name: Upload Trivy scan results to GitHub Security tab
|
||||
uses: github/codeql-action/upload-sarif@v1
|
||||
with:
|
||||
sarif_file: 'trivy-results.sarif'
|
||||
```
|
||||
|
||||
### Using Trivy to scan Infrastucture as Code
|
||||
It's also possible to scan your IaC repos with Trivy's built-in repo scan. This can be handy if you want to run Trivy as a build time check on each PR that gets opened in your repo. This helps you identify potential vulnerablites that might get introduced with each PR.
|
||||
|
||||
If you have [GitHub code scanning](https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/about-code-scanning) available you can use Trivy as a scanning tool as follows:
|
||||
```yaml
|
||||
name: build
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- master
|
||||
pull_request:
|
||||
jobs:
|
||||
build:
|
||||
name: Build
|
||||
runs-on: ubuntu-18.04
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v2
|
||||
|
||||
- name: Run Trivy vulnerability scanner in IaC mode
|
||||
uses: aquasecurity/trivy-action@master
|
||||
with:
|
||||
scan-type: 'config'
|
||||
hide-progress: false
|
||||
format: 'table'
|
||||
exit-code: '1'
|
||||
ignore-unfixed: true
|
||||
severity: 'CRITICAL,HIGH'
|
||||
|
||||
- name: Upload Trivy scan results to GitHub Security tab
|
||||
uses: github/codeql-action/upload-sarif@v1
|
||||
with:
|
||||
sarif_file: 'trivy-results.sarif'
|
||||
```
|
||||
|
||||
### Using Trivy to scan your private registry
|
||||
It's also possible to scan your private registry with Trivy's built-in image scan. All you have to do is set ENV vars.
|
||||
|
||||
#### Docker Hub registry
|
||||
Docker Hub needs `TRIVY_USERNAME` and `TRIVY_PASSWORD`.
|
||||
You don't need to set ENV vars when downloading from a public repository.
|
||||
```yaml
|
||||
name: build
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- master
|
||||
pull_request:
|
||||
jobs:
|
||||
build:
|
||||
name: Build
|
||||
runs-on: ubuntu-18.04
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v2
|
||||
|
||||
- name: Run Trivy vulnerability scanner
|
||||
uses: aquasecurity/trivy-action@master
|
||||
with:
|
||||
image-ref: 'docker.io/my-organization/my-app:${{ github.sha }}'
|
||||
format: 'template'
|
||||
template: '@/contrib/sarif.tpl'
|
||||
output: 'trivy-results.sarif'
|
||||
env:
|
||||
TRIVY_USERNAME: Username
|
||||
TRIVY_PASSWORD: Password
|
||||
|
||||
- name: Upload Trivy scan results to GitHub Security tab
|
||||
uses: github/codeql-action/upload-sarif@v1
|
||||
with:
|
||||
sarif_file: 'trivy-results.sarif'
|
||||
```
|
||||
|
||||
#### AWS ECR (Elastic Container Registry)
|
||||
Trivy uses AWS SDK. You don't need to install `aws` CLI tool.
|
||||
You can use [AWS CLI's ENV Vars][env-var].
|
||||
|
||||
[env-var]: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-envvars.html
|
||||
```yaml
|
||||
name: build
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- master
|
||||
pull_request:
|
||||
jobs:
|
||||
build:
|
||||
name: Build
|
||||
runs-on: ubuntu-18.04
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v2
|
||||
|
||||
- name: Run Trivy vulnerability scanner
|
||||
uses: aquasecurity/trivy-action@master
|
||||
with:
|
||||
image-ref: 'aws_account_id.dkr.ecr.region.amazonaws.com/imageName:${{ github.sha }}'
|
||||
format: 'template'
|
||||
template: '@/contrib/sarif.tpl'
|
||||
output: 'trivy-results.sarif'
|
||||
env:
|
||||
AWS_ACCESS_KEY_ID: key_id
|
||||
AWS_SECRET_ACCESS_KEY: access_key
|
||||
AWS_DEFAULT_REGION: us-west-2
|
||||
|
||||
- name: Upload Trivy scan results to GitHub Security tab
|
||||
uses: github/codeql-action/upload-sarif@v1
|
||||
with:
|
||||
sarif_file: 'trivy-results.sarif'
|
||||
```
|
||||
|
||||
#### GCR (Google Container Registry)
|
||||
Trivy uses Google Cloud SDK. You don't need to install `gcloud` command.
|
||||
|
||||
If you want to use target project's repository, you can set it via `GOOGLE_APPLICATION_CREDENTIAL`.
|
||||
```yaml
|
||||
name: build
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- master
|
||||
pull_request:
|
||||
jobs:
|
||||
build:
|
||||
name: Build
|
||||
runs-on: ubuntu-18.04
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v2
|
||||
|
||||
- name: Run Trivy vulnerability scanner
|
||||
uses: aquasecurity/trivy-action@master
|
||||
with:
|
||||
image-ref: 'docker.io/my-organization/my-app:${{ github.sha }}'
|
||||
format: 'template'
|
||||
template: '@/contrib/sarif.tpl'
|
||||
output: 'trivy-results.sarif'
|
||||
env:
|
||||
GOOGLE_APPLICATION_CREDENTIAL: /path/to/credential.json
|
||||
|
||||
- name: Upload Trivy scan results to GitHub Security tab
|
||||
uses: github/codeql-action/upload-sarif@v1
|
||||
with:
|
||||
sarif_file: 'trivy-results.sarif'
|
||||
```
|
||||
|
||||
#### Self-Hosted
|
||||
BasicAuth server needs `TRIVY_USERNAME` and `TRIVY_PASSWORD`.
|
||||
if you want to use 80 port, use NonSSL `TRIVY_NON_SSL=true`
|
||||
```yaml
|
||||
name: build
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- master
|
||||
pull_request:
|
||||
jobs:
|
||||
build:
|
||||
name: Build
|
||||
runs-on: ubuntu-18.04
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@v2
|
||||
|
||||
- name: Run Trivy vulnerability scanner
|
||||
uses: aquasecurity/trivy-action@master
|
||||
with:
|
||||
image-ref: 'docker.io/my-organization/my-app:${{ github.sha }}'
|
||||
format: 'template'
|
||||
template: '@/contrib/sarif.tpl'
|
||||
output: 'trivy-results.sarif'
|
||||
env:
|
||||
TRIVY_USERNAME: Username
|
||||
TRIVY_PASSWORD: Password
|
||||
|
||||
- name: Upload Trivy scan results to GitHub Security tab
|
||||
uses: github/codeql-action/upload-sarif@v1
|
||||
with:
|
||||
sarif_file: 'trivy-results.sarif'
|
||||
```
|
||||
|
||||
## Customizing
|
||||
|
||||
### inputs
|
||||
@@ -312,21 +94,14 @@ Following inputs can be used as `step.with` keys:
|
||||
|
||||
| Name | Type | Default | Description |
|
||||
|------------------|---------|------------------------------------|-----------------------------------------------|
|
||||
| `scan-type` | String | `image` | Scan type, e.g. `image` or `fs`|
|
||||
| `input` | String | | Tar reference, e.g. `alpine-latest.tar` |
|
||||
| `image-ref` | String | | Image reference, e.g. `alpine:3.10.2` |
|
||||
| `scan-ref` | String | `/github/workspace/` | Scan reference, e.g. `/github/workspace/` or `.`|
|
||||
| `format` | String | `table` | Output format (`table`, `json`, `template`) |
|
||||
| `template` | String | | Output template (`@/contrib/sarif.tpl`, `@/contrib/gitlab.tpl`, `@/contrib/junit.tpl`)|
|
||||
| `output` | String | | Save results to a file |
|
||||
| `exit-code` | String | `0` | Exit code when specified vulnerabilities are found |
|
||||
| `exit-code` | String | `0` | Exit code when vulnerabilities were found |
|
||||
| `ignore-unfixed` | Boolean | false | Ignore unpatched/unfixed vulnerabilities |
|
||||
| `vuln-type` | String | `os,library` | Vulnerability types (os,library) |
|
||||
| `severity` | String | `UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL` | Severities of vulnerabilities to scanned for and displayed |
|
||||
| `skip-dirs` | String | | Comma separated list of directories where traversal is skipped |
|
||||
| `cache-dir` | String | | Cache directory |
|
||||
| `timeout` | String | `2m0s` | Scan timeout duration |
|
||||
| `ignore-policy` | String | | Filter vulnerabilities with OPA rego language |
|
||||
| `severity` | String | `UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL` | Severities of vulnerabilities to be displayed |
|
||||
|
||||
[release]: https://github.com/aquasecurity/trivy-action/releases/latest
|
||||
[release-img]: https://img.shields.io/github/release/aquasecurity/trivy-action.svg?logo=github
|
||||
|
||||
+19
-51
@@ -2,21 +2,16 @@ name: 'Aqua Security Trivy'
|
||||
description: 'Scans container images for vulnerabilities with Trivy'
|
||||
author: 'Aqua Security'
|
||||
inputs:
|
||||
scan-type:
|
||||
description: 'Scan type to use for scanning vulnerability'
|
||||
required: false
|
||||
default: 'image'
|
||||
image-ref:
|
||||
description: 'image reference(for backward compatibility)'
|
||||
description: 'image reference'
|
||||
required: true
|
||||
artifact-type:
|
||||
description: 'artifact type (image or fs)'
|
||||
required: true
|
||||
default: "image"
|
||||
aritfact-ref:
|
||||
description: 'artifact reference (image reference or file path)'
|
||||
required: true
|
||||
input:
|
||||
description: 'reference of tar file to scan'
|
||||
required: false
|
||||
default: ''
|
||||
scan-ref:
|
||||
description: 'Scan reference'
|
||||
required: false
|
||||
default: '.'
|
||||
exit-code:
|
||||
description: 'exit code when vulnerabilities were found'
|
||||
required: false
|
||||
@@ -24,7 +19,7 @@ inputs:
|
||||
ignore-unfixed:
|
||||
description: 'ignore unfixed vulnerabilities'
|
||||
required: false
|
||||
default: 'false'
|
||||
default: "false"
|
||||
vuln-type:
|
||||
description: 'comma-separated list of vulnerability types (os,library)'
|
||||
required: false
|
||||
@@ -45,43 +40,16 @@ inputs:
|
||||
description: 'writes results to a file with the specified file name'
|
||||
required: false
|
||||
default: ''
|
||||
skip-dirs:
|
||||
description: 'comma separated list of directories where traversal is skipped'
|
||||
required: false
|
||||
default: ''
|
||||
cache-dir:
|
||||
description: 'specify where the cache is stored'
|
||||
required: false
|
||||
default: ''
|
||||
timeout:
|
||||
description: 'timeout (default 5m0s)'
|
||||
required: false
|
||||
default: ''
|
||||
ignore-policy:
|
||||
description: 'filter vulnerabilities with OPA rego language'
|
||||
required: false
|
||||
default: ''
|
||||
hide-progress:
|
||||
description: 'hide progress output'
|
||||
required: false
|
||||
default: 'true'
|
||||
runs:
|
||||
using: 'docker'
|
||||
image: "Dockerfile"
|
||||
image: 'docker://docker.io/aquasec/trivy:latest'
|
||||
args:
|
||||
- '-a ${{ inputs.scan-type }}'
|
||||
- '-b ${{ inputs.format }}'
|
||||
- '-c ${{ inputs.template }}'
|
||||
- '-d ${{ inputs.exit-code }}'
|
||||
- '-e ${{ inputs.ignore-unfixed }}'
|
||||
- '-f ${{ inputs.vuln-type }}'
|
||||
- '-g ${{ inputs.severity }}'
|
||||
- '-h ${{ inputs.output }}'
|
||||
- '-i ${{ inputs.image-ref }}'
|
||||
- '-j ${{ inputs.scan-ref }}'
|
||||
- '-k ${{ inputs.skip-dirs }}'
|
||||
- '-l ${{ inputs.input }}'
|
||||
- '-m ${{ inputs.cache-dir }}'
|
||||
- '-n ${{ inputs.timeout }}'
|
||||
- '-o ${{ inputs.ignore-policy }}'
|
||||
- '-p ${{ inputs.hide-progress }}'
|
||||
- '${{ inputs.artifact-type }}'
|
||||
- '--format=${{ inputs.format }}'
|
||||
- '--template=${{ inputs.template }}'
|
||||
- '--exit-code=${{ inputs.exit-code }}'
|
||||
- '--ignore-unfixed=${{ inputs.ignore-unfixed }}'
|
||||
- '--vuln-type=${{ inputs.vuln-type }}'
|
||||
- '--severity=${{ inputs.severity }}'
|
||||
- '--output=${{ inputs.output }}'
|
||||
- '${{ inputs.artifact-ref }}'
|
||||
|
||||
-129
@@ -1,129 +0,0 @@
|
||||
#!/bin/bash
|
||||
set -e
|
||||
while getopts "a:b:c:d:e:f:g:h:i:j:k:l:m:n:o:p:" o; do
|
||||
case "${o}" in
|
||||
a)
|
||||
export scanType=${OPTARG}
|
||||
;;
|
||||
b)
|
||||
export format=${OPTARG}
|
||||
;;
|
||||
c)
|
||||
export template=${OPTARG}
|
||||
;;
|
||||
d)
|
||||
export exitCode=${OPTARG}
|
||||
;;
|
||||
e)
|
||||
export ignoreUnfixed=${OPTARG}
|
||||
;;
|
||||
f)
|
||||
export vulnType=${OPTARG}
|
||||
;;
|
||||
g)
|
||||
export severity=${OPTARG}
|
||||
;;
|
||||
h)
|
||||
export output=${OPTARG}
|
||||
;;
|
||||
i)
|
||||
export imageRef=${OPTARG}
|
||||
;;
|
||||
j)
|
||||
export scanRef=${OPTARG}
|
||||
;;
|
||||
k)
|
||||
export skipDirs=${OPTARG}
|
||||
;;
|
||||
l)
|
||||
export input=${OPTARG}
|
||||
;;
|
||||
m)
|
||||
export cacheDir=${OPTARG}
|
||||
;;
|
||||
n)
|
||||
export timeout=${OPTARG}
|
||||
;;
|
||||
o)
|
||||
export ignorePolicy=${OPTARG}
|
||||
;;
|
||||
p)
|
||||
export hideProgress=${OPTARG}
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
scanType=$(echo $scanType | tr -d '\r')
|
||||
export artifactRef="${imageRef}"
|
||||
if [ "${scanType}" = "fs" ] || [ "${scanType}" = "config" ];then
|
||||
artifactRef=$(echo $scanRef | tr -d '\r')
|
||||
fi
|
||||
input=$(echo $input | tr -d '\r')
|
||||
if [ $input ]; then
|
||||
artifactRef="--input $input"
|
||||
fi
|
||||
ignoreUnfixed=$(echo $ignoreUnfixed | tr -d '\r')
|
||||
hideProgress=$(echo $hideProgress | tr -d '\r')
|
||||
|
||||
GLOBAL_ARGS=""
|
||||
if [ $cacheDir ];then
|
||||
GLOBAL_ARGS="$GLOBAL_ARGS --cache-dir $cacheDir"
|
||||
fi
|
||||
|
||||
SARIF_ARGS=""
|
||||
ARGS=""
|
||||
if [ $format ];then
|
||||
ARGS="$ARGS --format $format"
|
||||
fi
|
||||
if [ $template ] ;then
|
||||
ARGS="$ARGS --template $template"
|
||||
fi
|
||||
if [ $exitCode ];then
|
||||
ARGS="$ARGS --exit-code $exitCode"
|
||||
fi
|
||||
if [ "$ignoreUnfixed" == "true" ] && [ "$scanType" != "config" ];then
|
||||
ARGS="$ARGS --ignore-unfixed"
|
||||
SARIF_ARGS="$SARIF_ARGS --ignore-unfixed"
|
||||
fi
|
||||
if [ $vulnType ] && [ "$scanType" != "config" ];then
|
||||
ARGS="$ARGS --vuln-type $vulnType"
|
||||
SARIF_ARGS="$SARIF_ARGS --vuln-type $vulnType"
|
||||
fi
|
||||
if [ $severity ];then
|
||||
ARGS="$ARGS --severity $severity"
|
||||
fi
|
||||
if [ $output ];then
|
||||
ARGS="$ARGS --output $output"
|
||||
fi
|
||||
if [ $skipDirs ];then
|
||||
for i in $(echo $skipDirs | tr "," "\n")
|
||||
do
|
||||
ARGS="$ARGS --skip-dirs $i"
|
||||
SARIF_ARGS="$SARIF_ARGS --skip-dirs $i"
|
||||
done
|
||||
fi
|
||||
if [ $timeout ];then
|
||||
ARGS="$ARGS --timeout $timeout"
|
||||
fi
|
||||
if [ $ignorePolicy ];then
|
||||
ARGS="$ARGS --ignore-policy $ignorePolicy"
|
||||
SARIF_ARGS="$SARIF_ARGS --ignore-policy $ignorePolicy"
|
||||
fi
|
||||
if [ "$hideProgress" == "true" ];then
|
||||
ARGS="$ARGS --no-progress"
|
||||
fi
|
||||
|
||||
echo "Running trivy with options: ${ARGS}" "${artifactRef}"
|
||||
echo "Global options: " "${GLOBAL_ARGS}"
|
||||
trivy $GLOBAL_ARGS ${scanType} $ARGS ${artifactRef}
|
||||
returnCode=$?
|
||||
|
||||
# SARIF is special. We output all vulnerabilities,
|
||||
# regardless of severity level specified in this report.
|
||||
# This is a feature, not a bug :)
|
||||
if [[ ${template} == *"sarif"* ]]; then
|
||||
echo "Building SARIF report with options: ${SARIF_ARGS}" "${artifactRef}"
|
||||
trivy --quiet ${scanType} --format template --template ${template} --output ${output} $SARIF_ARGS ${artifactRef}
|
||||
fi
|
||||
|
||||
exit $returnCode
|
||||
Reference in New Issue
Block a user