test: volume mount

feat(SBOM): Support SBOM generation (#129 )
* feat(sbom): Support SBOM generation Signed-off-by: Simar <simar@linux.com> * Update README.md Co-authored-by: Itay Shakury <itay@itaysk.com> * feat(sbom): Send results within the entrypoint.sh * fix(sbom): Fix leading whitespaces for format var. Signed-off-by: Simar <simar@linux.com> * docs(sbom): Update README.md * docs(sbom): Update README.md * chore(trivy): Bump Trivy version to 0.29.1 Signed-off-by: Simar <simar@linux.com> * feat(sbom): Change to fs scan. Signed-off-by: Simar <simar@linux.com> * fix(tests): Update SARIF goldenfile Co-authored-by: Itay Shakury <itay@itaysk.com>
2022-06-23 16:33:05 -07:00 · 2022-06-22 11:24:39 -07:00 · 2022-06-21 11:46:57 -07:00 · 2022-06-17 13:27:39 -07:00 · 2022-06-16 08:25:13 -07:00 · 2022-06-15 09:16:34 -07:00
18 changed files with 6680 additions and 63 deletions
@@ -0,0 +1,27 @@
+name: "build"
+on: [push, pull_request]
+env:
+  TRIVY_VERSION: 0.29.1
+jobs:
+  build:
+    name: build
+    runs-on: ubuntu-20.04
+    steps:
+
+      - name: Setup BATS
+        uses: mig4/setup-bats@v1
+        with:
+          bats-version: 1.2.1
+
+      - name: Setup Bats libs
+        uses: brokenpip3/setup-bats-libs@0.1.0
+
+      - name: Check out code
+        uses: actions/checkout@v1
+
+      - name: Install Trivy
+        run: |
+          curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v${{ env.TRIVY_VERSION }}
+
+      - name: Test
+        run: bats -r .
@@ -1 +1,4 @@
 .idea/
+*.test
+!test/data/*.test
+trivyignores
@@ -1,5 +1,6 @@
-FROM aquasec/trivy:0.21.0
+FROM ghcr.io/aquasecurity/trivy:0.29.1
 COPY entrypoint.sh /
-RUN apk --no-cache add bash
+RUN apk --no-cache add bash curl
 RUN chmod +x /entrypoint.sh
+ADD $GITHUB_WORKSPACE /github_workspace
 ENTRYPOINT ["/entrypoint.sh"]
@@ -35,11 +35,11 @@ jobs:
    steps:
      - name: Checkout code
        uses: actions/checkout@v2
-      
+
      - name: Build an image from Dockerfile
        run: |
          docker build -t docker.io/my-organization/my-app:${{ github.sha }} .
-      
+
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
@@ -76,12 +76,11 @@ jobs:
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'docker.io/my-organization/my-app:${{ github.sha }}'
-          format: 'template'
-          template: '@/contrib/sarif.tpl'
+          format: 'sarif'
          output: 'trivy-results.sarif'

      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v1
+        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: 'trivy-results.sarif'
 ```
@@ -112,13 +111,12 @@ jobs:
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'docker.io/my-organization/my-app:${{ github.sha }}'
-          format: 'template'
-          template: '@/contrib/sarif.tpl'
+          format: 'sarif'
          output: 'trivy-results.sarif'

      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v1
-        if: always() 
+        uses: github/codeql-action/upload-sarif@v2
+        if: always()
        with:
          sarif_file: 'trivy-results.sarif'
 ```
@@ -149,13 +147,12 @@ jobs:
        with:
          scan-type: 'fs'
          ignore-unfixed: true
-          format: 'template'
-          template: '@/contrib/sarif.tpl'
+          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL'

      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v1
+        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: 'trivy-results.sarif'
 ```
@@ -185,13 +182,12 @@ jobs:
          scan-type: 'rootfs'
          scan-ref: 'rootfs-example-binary'
          ignore-unfixed: true
-          format: 'template'
-          template: '@/contrib/sarif.tpl'
+          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL'

      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v1
+        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: 'trivy-results.sarif'
 ```
@@ -226,11 +222,43 @@ jobs:
          severity: 'CRITICAL,HIGH'

      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v1
+        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: 'trivy-results.sarif'
 ```

+### Using Trivy to generate SBOM
+It's possible for Trivy to generate an SBOM of your dependencies and submit them to a consumer like GitHub Dependency Snapshot.
+
+The sending of SBOM to GitHub feature is only available if you currently have [GitHub Dependency Snapshot](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/using-the-dependency-submission-api) available to you in your repo. 
+
+In order to send results to the GitHub Dependency Snapshot, you will need to create a [GitHub PAT](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token)
+```yaml
+---
+name: Pull Request
+on:
+  push:
+    branches:
+    - master
+  pull_request:
+jobs:
+  build:
+    name: Checks
+    runs-on: ubuntu-20.04
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Run Trivy in GitHub SBOM mode and submit results to Dependency Snapshots
+        uses: aquasecurity/trivy-action@master
+        with:
+          scan-type: 'fs'
+          format: 'github'
+          output: 'dependency-results.sbom.json'
+          image-ref: '.'
+          github-pat: '<github_pat_token>'
+```
+
 ### Using Trivy to scan your private registry
 It's also possible to scan your private registry with Trivy's built-in image scan. All you have to do is set ENV vars.

@@ -251,20 +279,19 @@ jobs:
    steps:
      - name: Checkout code
        uses: actions/checkout@v2
-        
+
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'docker.io/my-organization/my-app:${{ github.sha }}'
-          format: 'template'
-          template: '@/contrib/sarif.tpl'
+          format: 'sarif'
          output: 'trivy-results.sarif'
        env:
          TRIVY_USERNAME: Username
-          TRIVY_PASSWORD: Password        
+          TRIVY_PASSWORD: Password

      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v1
+        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: 'trivy-results.sarif'
 ```
@@ -288,13 +315,12 @@ jobs:
    steps:
      - name: Checkout code
        uses: actions/checkout@v2
-        
+
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'aws_account_id.dkr.ecr.region.amazonaws.com/imageName:${{ github.sha }}'
-          format: 'template'
-          template: '@/contrib/sarif.tpl'
+          format: 'sarif'
          output: 'trivy-results.sarif'
        env:
          AWS_ACCESS_KEY_ID: key_id
@@ -302,7 +328,7 @@ jobs:
          AWS_DEFAULT_REGION: us-west-2

      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v1
+        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: 'trivy-results.sarif'
 ```
@@ -325,19 +351,18 @@ jobs:
    steps:
      - name: Checkout code
        uses: actions/checkout@v2
-        
+
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'docker.io/my-organization/my-app:${{ github.sha }}'
-          format: 'template'
-          template: '@/contrib/sarif.tpl'
+          format: 'sarif'
          output: 'trivy-results.sarif'
        env:
          GOOGLE_APPLICATION_CREDENTIAL: /path/to/credential.json

      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v1
+        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: 'trivy-results.sarif'
 ```
@@ -359,20 +384,19 @@ jobs:
    steps:
      - name: Checkout code
        uses: actions/checkout@v2
-        
+
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'docker.io/my-organization/my-app:${{ github.sha }}'
-          format: 'template'
-          template: '@/contrib/sarif.tpl'
+          format: 'sarif'
          output: 'trivy-results.sarif'
        env:
          TRIVY_USERNAME: Username
-          TRIVY_PASSWORD: Password        
+          TRIVY_PASSWORD: Password

      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v1
+        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: 'trivy-results.sarif'
 ```
@@ -383,24 +407,29 @@ jobs:

 Following inputs can be used as `step.with` keys:

-| Name             | Type    | Default                            | Description                                   |
-|------------------|---------|------------------------------------|-----------------------------------------------|
-| `scan-type`      | String  | `image`                            | Scan type, e.g. `image` or `fs`|
-| `input`          | String  |                                    | Tar reference, e.g. `alpine-latest.tar` |
-| `image-ref`      | String  |                                    | Image reference, e.g. `alpine:3.10.2`         |
-| `scan-ref`       | String  | `/github/workspace/`               | Scan reference, e.g. `/github/workspace/` or `.`|
-| `format`         | String  | `table`                            | Output format (`table`, `json`, `template`)   |
-| `template`       | String  |                                    | Output template (`@/contrib/sarif.tpl`, `@/contrib/gitlab.tpl`, `@/contrib/junit.tpl`)|
-| `output`         | String  |                                    | Save results to a file                        |
-| `exit-code`      | String  | `0`                                | Exit code when specified vulnerabilities are found     |
-| `ignore-unfixed` | Boolean | false                              | Ignore unpatched/unfixed vulnerabilities      |
-| `vuln-type`      | String  | `os,library`                       | Vulnerability types (os,library)              |
-| `severity`       | String  | `UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL` | Severities of vulnerabilities to scanned for and displayed |
-| `skip-dirs`      | String  |                                    | Comma separated list of directories where traversal is skipped |
-| `skip-files`     | String  |                                    | Comma separated list of files where traversal is skipped |
-| `cache-dir`      | String  |                                    | Cache directory                               |
-| `timeout`        | String  | `2m0s`                             | Scan timeout duration                         |
-| `ignore-policy`  | String  |                                    | Filter vulnerabilities with OPA rego language |
+| Name              | Type    | Default                            | Description                                                                                     |
+|-------------------|---------|------------------------------------|-------------------------------------------------------------------------------------------------|
+| `scan-type`       | String  | `image`                            | Scan type, e.g. `image` or `fs`                                                                 |
+| `input`           | String  |                                    | Tar reference, e.g. `alpine-latest.tar`                                                         |
+| `image-ref`       | String  |                                    | Image reference, e.g. `alpine:3.10.2`                                                           |
+| `scan-ref`        | String  | `/github/workspace/`               | Scan reference, e.g. `/github/workspace/` or `.`                                                |
+| `format`          | String  | `table`                            | Output format (`table`, `json`, `sarif`, `github`)                                              |
+| `template`        | String  |                                    | Output template (`@/contrib/gitlab.tpl`, `@/contrib/junit.tpl`)                                 |
+| `output`          | String  |                                    | Save results to a file                                                                          |
+| `exit-code`       | String  | `0`                                | Exit code when specified vulnerabilities are found                                              |
+| `ignore-unfixed`  | Boolean | false                              | Ignore unpatched/unfixed vulnerabilities                                                        |
+| `vuln-type`       | String  | `os,library`                       | Vulnerability types (os,library)                                                                |
+| `severity`        | String  | `UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL` | Severities of vulnerabilities to scanned for and displayed                                      |
+| `skip-dirs`       | String  |                                    | Comma separated list of directories where traversal is skipped                                  |
+| `skip-files`      | String  |                                    | Comma separated list of files where traversal is skipped                                        |
+| `cache-dir`       | String  |                                    | Cache directory                                                                                 |
+| `timeout`         | String  | `5m0s`                             | Scan timeout duration                                                                           |
+| `ignore-policy`   | String  |                                    | Filter vulnerabilities with OPA rego language                                                   |
+| `hide-progress`   | String  | `true`                             | Suppress progress bar                                                                           |
+| `list-all-pkgs`   | String  |                                    | Output all packages regardless of vulnerability                                                 |
+| `security-checks` | String  | `vuln,secret`                      | comma-separated list of what security issues to detect (`vuln`,`secret`,`config`)               |
+| `trivyignores`    | String  |                                    | comma-separated list of relative paths in repository to one or more `.trivyignore` files        |
+| `github-pat`      | String  |                                    | GitHub Personal Access Token (PAT) for sending SBOM scan results to GitHub Dependency Snapshots |

 [release]: https://github.com/aquasecurity/trivy-action/releases/latest
 [release-img]: https://img.shields.io/github/release/aquasecurity/trivy-action.svg?logo=github
@@ -20,7 +20,6 @@ inputs:
  exit-code:
    description: 'exit code when vulnerabilities were found'
    required: false
-    default: '0'
  ignore-unfixed:
    description: 'ignore unfixed vulnerabilities'
    required: false
@@ -38,7 +37,7 @@ inputs:
    required: false
    default: 'table'
  template:
-    description: 'use an existing template for rendering output (@/contrib/sarif.tpl, @/contrib/gitlab.tpl, @/contrib/junit.tpl'
+    description: 'use an existing template for rendering output (@/contrib/gitlab.tpl, @/contrib/junit.tpl, @/contrib/html.tpl)'
    required: false
    default: ''
  output:
@@ -68,7 +67,25 @@ inputs:
  hide-progress:
    description: 'hide progress output'
    required: false
-    default: 'true'
+  list-all-pkgs:
+    description: 'output all packages regardless of vulnerability'
+    required: false
+    default: 'false'
+  security-checks:
+    description: 'comma-separated list of what security issues to detect'
+    required: false
+    default: ''
+  trivyignores:
+    description: 'comma-separated list of relative paths in repository to one or more .trivyignore files'
+    required: false
+    default: ''
+  artifact-type:
+    description: 'input artifact type (image, fs, repo, archive) for SBOM generation'
+    required: false
+  github-pat:
+    description: 'GitHub Personal Access Token (PAT) for submitting SBOM to GitHub Dependency Snapshot API'
+    required: false
+
 runs:
  using: 'docker'
  image: "Dockerfile"
@@ -90,3 +107,7 @@ runs:
    - '-o ${{ inputs.ignore-policy }}'
    - '-p ${{ inputs.hide-progress }}'
    - '-q ${{ inputs.skip-files }}'
+    - '-r ${{ inputs.list-all-pkgs }}'
+    - '-s ${{ inputs.security-checks }}'
+    - '-t ${{ inputs.trivyignores }}'
+    - '-u ${{ inputs.github-pat }}'
@@ -1,6 +1,6 @@
 #!/bin/bash
 set -e
-while getopts "a:b:c:d:e:f:g:h:i:j:k:l:m:n:o:p:q:" o; do
+while getopts "a:b:c:d:e:f:g:h:i:j:k:l:m:n:o:p:q:r:s:t:u:" o; do
   case "${o}" in
       a)
         export scanType=${OPTARG}
@@ -53,12 +53,24 @@ while getopts "a:b:c:d:e:f:g:h:i:j:k:l:m:n:o:p:q:" o; do
       q)
         export skipFiles=${OPTARG}
       ;;
+       r)
+         export listAllPkgs=${OPTARG}
+       ;;
+       s)
+         export securityChecks=${OPTARG}
+       ;;
+       t)
+         export trivyIgnores=${OPTARG}
+       ;;
+       u)
+         export githubPAT=${OPTARG}
+       ;;
  esac
 done

 scanType=$(echo $scanType | tr -d '\r')
 export artifactRef="${imageRef}"
-if [ "${scanType}" = "fs" ] ||  [ "${scanType}" = "config" ] ||  [ "${scanType}" = "rootfs" ];then
+if [ "${scanType}" = "repo" ] || [ "${scanType}" = "fs" ] ||  [ "${scanType}" = "config" ] ||  [ "${scanType}" = "rootfs" ];then
  artifactRef=$(echo $scanRef | tr -d '\r')
 fi
 input=$(echo $input | tr -d '\r')
@@ -75,6 +87,7 @@ fi

 SARIF_ARGS=""
 ARGS=""
+format=$(echo $format | xargs)
 if [ $format ];then
 ARGS="$ARGS --format $format"
 fi
@@ -88,10 +101,13 @@ if [ "$ignoreUnfixed" == "true" ] && [ "$scanType" != "config" ];then
  ARGS="$ARGS --ignore-unfixed"
  SARIF_ARGS="$SARIF_ARGS --ignore-unfixed"
 fi
-if [ $vulnType ] && [ "$scanType" != "config" ];then
+if [ $vulnType ] && [ "$scanType" != "config" ] && [ "$scanType" != "sbom" ];then
  ARGS="$ARGS --vuln-type $vulnType"
  SARIF_ARGS="$SARIF_ARGS --vuln-type $vulnType"
 fi
+if [ $securityChecks ];then
+  ARGS="$ARGS --security-checks $securityChecks"
+fi
 if [ $severity ];then
  ARGS="$ARGS --severity $severity"
 fi
@@ -105,6 +121,20 @@ if [ $skipDirs ];then
    SARIF_ARGS="$SARIF_ARGS --skip-dirs $i"
  done
 fi
+if [ $trivyIgnores ];then
+  for f in $(echo $trivyIgnores | tr "," "\n")
+  do
+    if [ -f "$f" ]; then
+      echo "Found ignorefile '${f}':"
+      cat "${f}"
+      cat "${f}" >> ./trivyignores
+    else
+      echo "ERROR: cannot find ignorefile '${f}'."
+      exit 1
+    fi
+  done
+  ARGS="$ARGS --ignorefile ./trivyignores"
+fi
 if [ $timeout ];then
  ARGS="$ARGS --timeout $timeout"
 fi
@@ -115,6 +145,11 @@ fi
 if [ "$hideProgress" == "true" ];then
  ARGS="$ARGS --no-progress"
 fi
+
+listAllPkgs=$(echo $listAllPkgs | tr -d '\r')
+if [ "$listAllPkgs" == "true" ];then
+  ARGS="$ARGS --list-all-pkgs"
+fi
 if [ "$skipFiles" ];then
  for i in $(echo $skipFiles | tr "," "\n")
  do
@@ -130,9 +165,14 @@ returnCode=$?
 # SARIF is special. We output all vulnerabilities,
 # regardless of severity level specified in this report.
 # This is a feature, not a bug :)
-if [[ ${template} == *"sarif"* ]]; then
+if [[ "${format}" == "sarif" ]]; then
  echo "Building SARIF report with options: ${SARIF_ARGS}" "${artifactRef}"
-  trivy --quiet ${scanType} --format template --template ${template} --output ${output} $SARIF_ARGS ${artifactRef}
+  trivy --quiet ${scanType} --format sarif --output ${output} $SARIF_ARGS ${artifactRef}
+fi
+
+if [[ "${format}" == "github" ]] && [[ "$(echo $githubPAT | xargs)" != "" ]]; then
+  echo "Uploading GitHub Dependency Snapshot"
+  curl -u "${githubPAT}" -H 'Content-Type: application/json' 'https://api.github.com/repos/'$GITHUB_REPOSITORY'/dependency-graph/snapshots' -d @./$(echo $output | xargs)
 fi

 exit $returnCode
@@ -0,0 +1,3 @@
+# test data #1 for trivy-ignores option
+CVE-2020-25576
+CVE-2019-15551
@@ -0,0 +1,2 @@
+# test data #2 for trivy-ignores option
+CVE-2019-15554
@@ -0,0 +1,56 @@
+{
+  "SchemaVersion": 2,
+  "ArtifactName": ".",
+  "ArtifactType": "filesystem",
+  "Metadata": {
+    "ImageConfig": {
+      "architecture": "",
+      "created": "0001-01-01T00:00:00Z",
+      "os": "",
+      "rootfs": {
+        "type": "",
+        "diff_ids": null
+      },
+      "config": {}
+    }
+  },
+  "Results": [
+    {
+      "Target": "Dockerfile",
+      "Class": "config",
+      "Type": "dockerfile",
+      "MisconfSummary": {
+        "Successes": 21,
+        "Failures": 1,
+        "Exceptions": 0
+      },
+      "Misconfigurations": [
+        {
+          "Type": "Dockerfile Security Check",
+          "ID": "DS002",
+          "Title": "Image user should not be 'root'",
+          "Description": "Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.",
+          "Message": "Specify at least 1 USER command in Dockerfile with non-root user as argument",
+          "Namespace": "builtin.dockerfile.DS002",
+          "Query": "data.builtin.dockerfile.DS002.deny",
+          "Resolution": "Add 'USER \u003cnon root user name\u003e' line to the Dockerfile",
+          "Severity": "HIGH",
+          "PrimaryURL": "https://avd.aquasec.com/misconfig/ds002",
+          "References": [
+            "https://docs.docker.com/develop/develop-images/dockerfile_best-practices/",
+            "https://avd.aquasec.com/misconfig/ds002"
+          ],
+          "Status": "FAIL",
+          "Layer": {},
+          "CauseMetadata": {
+            "Provider": "Dockerfile",
+            "Service": "general",
+            "Code": {
+              "Lines": null
+            }
+          }
+        }
+      ]
+    }
+  ]
+}
@@ -0,0 +1,56 @@
+{
+  "SchemaVersion": 2,
+  "ArtifactName": ".",
+  "ArtifactType": "filesystem",
+  "Metadata": {
+    "ImageConfig": {
+      "architecture": "",
+      "created": "0001-01-01T00:00:00Z",
+      "os": "",
+      "rootfs": {
+        "type": "",
+        "diff_ids": null
+      },
+      "config": {}
+    }
+  },
+  "Results": [
+    {
+      "Target": "Dockerfile",
+      "Class": "config",
+      "Type": "dockerfile",
+      "MisconfSummary": {
+        "Successes": 21,
+        "Failures": 1,
+        "Exceptions": 0
+      },
+      "Misconfigurations": [
+        {
+          "Type": "Dockerfile Security Check",
+          "ID": "DS002",
+          "Title": "Image user should not be 'root'",
+          "Description": "Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.",
+          "Message": "Specify at least 1 USER command in Dockerfile with non-root user as argument",
+          "Namespace": "builtin.dockerfile.DS002",
+          "Query": "data.builtin.dockerfile.DS002.deny",
+          "Resolution": "Add 'USER \u003cnon root user name\u003e' line to the Dockerfile",
+          "Severity": "HIGH",
+          "PrimaryURL": "https://avd.aquasec.com/misconfig/ds002",
+          "References": [
+            "https://docs.docker.com/develop/develop-images/dockerfile_best-practices/",
+            "https://avd.aquasec.com/misconfig/ds002"
+          ],
+          "Status": "FAIL",
+          "Layer": {},
+          "CauseMetadata": {
+            "Provider": "Dockerfile",
+            "Service": "general",
+            "Code": {
+              "Lines": null
+            }
+          }
+        }
+      ]
+    }
+  ]
+}
@@ -0,0 +1,17 @@
+{
+  "SchemaVersion": 2,
+  "ArtifactName": ".",
+  "ArtifactType": "filesystem",
+  "Metadata": {
+    "ImageConfig": {
+      "architecture": "",
+      "created": "0001-01-01T00:00:00Z",
+      "os": "",
+      "rootfs": {
+        "type": "",
+        "diff_ids": null
+      },
+      "config": {}
+    }
+  }
+}
@@ -0,0 +1,34 @@
+{
+  "SchemaVersion": 2,
+  "ArtifactName": "https://github.com/krol3/demo-trivy/",
+  "ArtifactType": "repository",
+  "Metadata": {
+    "ImageConfig": {
+      "architecture": "",
+      "created": "0001-01-01T00:00:00Z",
+      "os": "",
+      "rootfs": {
+        "type": "",
+        "diff_ids": null
+      },
+      "config": {}
+    }
+  },
+  "Results": [
+    {
+      "Target": "env",
+      "Class": "secret",
+      "Secrets": [
+        {
+          "RuleID": "github-pat",
+          "Category": "GitHub",
+          "Severity": "CRITICAL",
+          "Title": "GitHub Personal Access Token",
+          "StartLine": 5,
+          "EndLine": 5,
+          "Match": "export GITHUB_PAT=*****"
+        }
+      ]
+    }
+  ]
+}
@@ -0,0 +1,17 @@
+{
+  "SchemaVersion": 2,
+  "ArtifactName": ".",
+  "ArtifactType": "filesystem",
+  "Metadata": {
+    "ImageConfig": {
+      "architecture": "",
+      "created": "0001-01-01T00:00:00Z",
+      "os": "",
+      "rootfs": {
+        "type": "",
+        "diff_ids": null
+      },
+      "config": {}
+    }
+  }
+}
@@ -0,0 +1,65 @@
+#!/usr/bin/env bats
+load '/usr/lib/bats-support/load.bash'
+load '/usr/lib/bats-assert/load.bash'
+
+@test "trivy image" {
+  # trivy image --severity CRITICAL --format json --output image.test knqyf263/vuln-image:1.2.3
+  ./entrypoint.sh '-a image' '-i knqyf263/vuln-image:1.2.3' '-b json' '-h image.test' '-g CRITICAL'
+  result="$(diff ./test/data/image.test image.test)"
+  [ "$result" == '' ]
+}
+
+@test "trivy image sarif report" {
+  # trivy image --severity CRITICAL -f sarif --output image-sarif.test knqyf263/vuln-image:1.2.3
+  ./entrypoint.sh '-a image' '-i knqyf263/vuln-image:1.2.3' '-b sarif' '-h image-sarif.test' '-g CRITICAL'
+  result="$(diff ./test/data/image-sarif.test image-sarif.test)"
+  [ "$result" == '' ]
+}
+
+@test "trivy config" {
+  # trivy config --format json --output config.test .
+  ./entrypoint.sh '-a config' '-j .' '-b json' '-h config.test'
+  result="$(diff ./test/data/config.test config.test)"
+  [ "$result" == '' ]
+}
+
+@test "trivy rootfs" {
+  # trivy rootfs --format json --output rootfs.test .
+  ./entrypoint.sh '-a rootfs' '-j .' '-b json' '-h rootfs.test'
+  result="$(diff ./test/data/rootfs.test rootfs.test)"
+  [ "$result" == '' ]
+}
+
+@test "trivy fs" {
+  # trivy fs --format json --output fs.test .
+  ./entrypoint.sh '-a fs' '-j .' '-b json' '-h fs.test'
+  result="$(diff ./test/data/fs.test fs.test)"
+  [ "$result" == '' ]
+}
+
+@test "trivy fs with securityChecks option" {
+  # trivy fs --format json --security-checks=vuln,config --output fs-scheck.test .
+  ./entrypoint.sh '-a fs' '-j .' '-b json' '-s vuln,config,secret' '-h fs-scheck.test'
+  result="$(diff ./test/data/fs-scheck.test fs-scheck.test)"
+  [ "$result" == '' ]
+}
+
+@test "trivy repo with securityCheck secret only" {
+  # trivy repo --format json --output repo.test --security-checks=secret https://github.com/krol3/demo-trivy/
+  ./entrypoint.sh '-b json' '-h repo.test' '-s secret' '-a repo' '-j https://github.com/krol3/demo-trivy/'
+  result="$(diff ./test/data/repo.test repo.test)"
+  [ "$result" == '' ]
+}
+
+@test "trivy image with trivyIgnores option" {
+  # cat ./test/data/.trivyignore1 ./test/data/.trivyignore2 > ./trivyignores ; trivy image --severity CRITICAL --format json --output image-trivyignores.test --ignorefile ./trivyignores knqyf263/vuln-image:1.2.3
+  ./entrypoint.sh '-a image' '-i knqyf263/vuln-image:1.2.3' '-b json' '-h image-trivyignores.test' '-g CRITICAL' '-t ./test/data/.trivyignore1,./test/data/.trivyignore2'
+  result="$(diff ./test/data/image-trivyignores.test image-trivyignores.test)"
+  [ "$result" == '' ]
+}
+
+@test "trivy image with sbom output" {
+  # trivy image --format  github knqyf263/vuln-image:1.2.3
+  run ./entrypoint.sh  "-a image" "-b github" "-i knqyf263/vuln-image:1.2.3"
+  assert_output --partial '"package_url": "pkg:apk/ca-certificates@20171114-r0",' # TODO: Output contains time, need to mock
+}
@@ -29,6 +29,6 @@ jobs:
          severity: 'CRITICAL,HIGH'

      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v1
+        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: 'trivy-results.sarif'
Author	SHA1	Message	Date
Simar	74194a9efa	test: volume mount	2022-06-23 16:33:05 -07:00
simar7	7b7aa264d8	feat(SBOM): Support SBOM generation (#129 ) * feat(sbom): Support SBOM generation Signed-off-by: Simar <simar@linux.com> * Update README.md Co-authored-by: Itay Shakury <itay@itaysk.com> * feat(sbom): Send results within the entrypoint.sh * fix(sbom): Fix leading whitespaces for format var. Signed-off-by: Simar <simar@linux.com> * docs(sbom): Update README.md * docs(sbom): Update README.md * chore(trivy): Bump Trivy version to 0.29.1 Signed-off-by: Simar <simar@linux.com> * feat(sbom): Change to fs scan. Signed-off-by: Simar <simar@linux.com> * fix(tests): Update SARIF goldenfile Co-authored-by: Itay Shakury <itay@itaysk.com>	2022-06-22 11:24:39 -07:00
nleconte-csgroup	63b6e4c61b	docs: added missing HTML template and removed deprecated SARIF template (#132 ) * docs: add missing template * docs: add missing template and remove deprecated Add missing HTML template Remove deprecated SARIF template * docs: remove deprecated SARIF template	2022-06-21 11:46:57 -07:00
Carol Valencia	49e970d7ac	chore: pinning 0.29.0 trivy (#128 ) Co-authored-by: carolina valencia <krol3@users.noreply.github.com>	2022-06-17 13:27:39 -07:00
Achton Smidt Winther	c666240787	Add missing option to README. (#127 )	2022-06-16 08:25:13 -07:00
David Calvert	e27605859b	feat: update codeql-action/upload-sarif to v2 (#124 )	2022-06-15 09:16:34 -07:00
Achton Smidt Winther	2b22459068	Update tests for 0.28.1 and convert to JSON (#126 ) * Fix bug with test for securityChecks option which caused it to be skipped. * Convert tests to JSON output only, and update them for Trivy 0.28.1. * Update CI test to use Trivy 0.28.1.	2022-06-15 08:23:38 -07:00
Achton Smidt Winther	4b3b5f928b	Add support for --ignorefile option (.trivyignore) (#122 ) * Add support for supplying one or more .trivyignore files. * Fix gitignore for test data. * Add test for trivyignores option. * Be explicit about the trivy options we use during testing. * Add documentation of trivyignores option.	2022-06-14 07:41:49 -07:00
Tanguy Segarra	1a53202fc4	Use AWS public ECR instead of rate-limiting dockerhub (#118 )	2022-06-08 11:17:38 -07:00
James Luther	df3fb7d00b	Update Trivy Version in Dockerfile (#117 ) Updated the dockerfile to use the latest release of Trivy.	2022-06-02 14:53:00 -07:00
Tanguy Segarra	987beb8186	Enable security checks option for image type (#112 ) * Enable security checks option for image type * Readme: update security checks option * action.yaml: add default value for security checks option * echo env var * action.yaml: remove default value for security checks * remove useless echo	2022-06-02 14:52:06 -07:00
Carol Valencia	4b9b6fb4ef	chore: update test to version 0.27.1 (#106 ) * chore: update test to version 0.27.0 * chore: add test file secret and update to 0.27.1 * fix: support repository with securityCheck secret Co-authored-by: carolina valencia <krol3@users.noreply.github.com>	2022-05-09 13:12:55 -07:00
Carol Valencia	2b30463ddb	chore: Update trivy version to 0.26.0 (#102 ) * chore: Update trivy version to 0.25.3 * feat: trivy fs - securityCheck test * chore: update trivy 0.26.0 Co-authored-by: carolina valencia <krol3@users.noreply.github.com>	2022-04-18 08:40:37 -07:00
jerbia	d7a51817e8	Merge pull request #104 from aquasecurity/feat/security-checks (feat) Add support for security-checks flag	2022-04-13 22:10:55 +03:00
oranmoshai	9fbcc91008	(feat) Add support for security-checks flag When using fs mode add option to list of what security issues to detect	2022-04-13 16:25:40 +03:00
Carol Valencia	40c4ca9e74	feat: bash unit test - adding repo (#101 ) * feat: bash unit test - adding repo * fix: clean dummy data Co-authored-by: carolina valencia <krol3@users.noreply.github.com>	2022-04-08 15:57:27 -07:00
Carol Valencia	f39d29766a	chore: Update trivy version to 0.25 (#100 ) Co-authored-by: carolina valencia <krol3@users.noreply.github.com>	2022-04-04 10:05:28 -07:00
Chanaka Lakmal	296212627a	Update default value of timeout configuration (#97 )	2022-02-24 14:33:03 -08:00
Oran Moshai	a7a829a434	chore: update trivy version Dockerfile (#96 ) * chore: update trivy version Dockerfile * Update readme for sarif deprecate https://github.com/aquasecurity/trivy/discussions/1571 * docs: revert template and remove sarif.tpl * fix: update condition to use format variable Co-authored-by: oranmoshai <oran.moshai@aquasec.com> Co-authored-by: knqyf263 <knqyf263@gmail.com>	2022-02-02 15:19:51 -08:00
Carol Valencia	9c21d3ca2c	chore: update trivy version Dockerfile (#89 ) Co-authored-by: carolina valencia <krol3@users.noreply.github.com>	2022-01-10 16:47:20 -08:00
Masayoshi Mizutani	8f4c7160b4	feat: Add list-all-pkgs option (#88 )	2021-12-16 08:31:49 -08:00
Carol Valencia	81cc8cd841	chore: update trivy version - fixed sarif (#87 )	2021-12-10 10:18:11 -08:00