Rename security-checks to scanners (#211 )

* Renaming securityChecks to runners * Renaming securityChecks to runners * Renaming securityChecks to runners * Correcting README
bump trivy to v0.38.1 (#215 )
2023-03-06 21:00:01 -08:00 · 2023-03-06 20:58:30 -08:00 · 2023-02-10 16:20:50 +09:00 · 2023-02-01 16:40:29 -08:00
11 changed files with 148 additions and 42 deletions
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -1,7 +1,7 @@
 name: "build"
 on: [push, pull_request]
 env:
-  TRIVY_VERSION: 0.34.0
+  TRIVY_VERSION: 0.38.1
  BATS_LIB_PATH: '/usr/lib/'
 jobs:
  build:
--- a/2
+++ b/2
@@ -1,4 +1,4 @@
-FROM ghcr.io/aquasecurity/trivy:0.34.0
+FROM ghcr.io/aquasecurity/trivy:0.38.1
 COPY entrypoint.sh /
 RUN apk --no-cache add bash curl npm
 RUN chmod +x /entrypoint.sh
--- a/README.md
+++ b/README.md
@@ -478,31 +478,31 @@ jobs:

 Following inputs can be used as `step.with` keys:

-| Name              | Type    | Default                            | Description                                                                                     |
-|-------------------|---------|------------------------------------|-------------------------------------------------------------------------------------------------|
-| `scan-type`       | String  | `image`                            | Scan type, e.g. `image` or `fs`                                                                 |
-| `input`           | String  |                                    | Tar reference, e.g. `alpine-latest.tar`                                                         |
-| `image-ref`       | String  |                                    | Image reference, e.g. `alpine:3.10.2`                                                           |
-| `scan-ref`        | String  | `/github/workspace/`               | Scan reference, e.g. `/github/workspace/` or `.`                                                |
-| `format`          | String  | `table`                            | Output format (`table`, `json`, `sarif`, `github`)                                              |
-| `template`        | String  |                                    | Output template (`@/contrib/gitlab.tpl`, `@/contrib/junit.tpl`)                                 |
-| `output`          | String  |                                    | Save results to a file                                                                          |
-| `exit-code`       | String  | `0`                                | Exit code when specified vulnerabilities are found                                              |
-| `ignore-unfixed`  | Boolean | false                              | Ignore unpatched/unfixed vulnerabilities                                                        |
-| `vuln-type`       | String  | `os,library`                       | Vulnerability types (os,library)                                                                |
-| `severity`        | String  | `UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL` | Severities of vulnerabilities to scanned for and displayed                                      |
-| `skip-dirs`       | String  |                                    | Comma separated list of directories where traversal is skipped                                  |
-| `skip-files`      | String  |                                    | Comma separated list of files where traversal is skipped                                        |
-| `cache-dir`       | String  |                                    | Cache directory                                                                                 |
-| `timeout`         | String  | `5m0s`                             | Scan timeout duration                                                                           |
-| `ignore-policy`   | String  |                                    | Filter vulnerabilities with OPA rego language                                                   |
-| `hide-progress`   | String  | `true`                             | Suppress progress bar                                                                           |
-| `list-all-pkgs`   | String  |                                    | Output all packages regardless of vulnerability                                                 |
-| `security-checks` | String  | `vuln,secret`                      | comma-separated list of what security issues to detect (`vuln`,`secret`,`config`)               |
-| `trivyignores`    | String  |                                    | comma-separated list of relative paths in repository to one or more `.trivyignore` files        |
-| `trivy-config`    | String  |                                    | Path to trivy.yaml config                                                                       |
-| `github-pat`      | String  |                                    | GitHub Personal Access Token (PAT) for sending SBOM scan results to GitHub Dependency Snapshots |
-| `limit-severities-for-sarif`      | Boolean  | false                                   | By default *SARIF* format enforces output of all vulnerabilities regardless of configured severities. To override this behavior set this parameter to **true** |
+| Name                         | Type    | Default                            | Description                                                                                     |
+|------------------------------|---------|------------------------------------|-------------------------------------------------------------------------------------------------|
+| `scan-type`                  | String  | `image`                            | Scan type, e.g. `image` or `fs`                                                                 |
+| `input`                      | String  |                                    | Tar reference, e.g. `alpine-latest.tar`                                                         |
+| `image-ref`                  | String  |                                    | Image reference, e.g. `alpine:3.10.2`                                                           |
+| `scan-ref`                   | String  | `/github/workspace/`               | Scan reference, e.g. `/github/workspace/` or `.`                                                |
+| `format`                     | String  | `table`                            | Output format (`table`, `json`, `sarif`, `github`)                                              |
+| `template`                   | String  |                                    | Output template (`@/contrib/gitlab.tpl`, `@/contrib/junit.tpl`)                                 |
+| `output`                     | String  |                                    | Save results to a file                                                                          |
+| `exit-code`                  | String  | `0`                                | Exit code when specified vulnerabilities are found                                              |
+| `ignore-unfixed`             | Boolean | false                              | Ignore unpatched/unfixed vulnerabilities                                                        |
+| `vuln-type`                  | String  | `os,library`                       | Vulnerability types (os,library)                                                                |
+| `severity`                   | String  | `UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL` | Severities of vulnerabilities to scanned for and displayed                                      |
+| `skip-dirs`                  | String  |                                    | Comma separated list of directories where traversal is skipped                                  |
+| `skip-files`                 | String  |                                    | Comma separated list of files where traversal is skipped                                        |
+| `cache-dir`                  | String  |                                    | Cache directory                                                                                 |
+| `timeout`                    | String  | `5m0s`                             | Scan timeout duration                                                                           |
+| `ignore-policy`              | String  |                                    | Filter vulnerabilities with OPA rego language                                                   |
+| `hide-progress`              | String  | `true`                             | Suppress progress bar                                                                           |
+| `list-all-pkgs`              | String  |                                    | Output all packages regardless of vulnerability                                                 |
+| `scanners`                   | String  | `vuln,secret`                      | comma-separated list of what security issues to detect (`vuln`,`secret`,`config`)               |
+| `trivyignores`               | String  |                                    | comma-separated list of relative paths in repository to one or more `.trivyignore` files        |
+| `trivy-config`               | String  |                                    | Path to trivy.yaml config                                                                       |
+| `github-pat`                 | String  |                                    | GitHub Personal Access Token (PAT) for sending SBOM scan results to GitHub Dependency Snapshots |
+| `limit-severities-for-sarif` | Boolean  | false                                   | By default *SARIF* format enforces output of all vulnerabilities regardless of configured severities. To override this behavior set this parameter to **true** |

 [release]: https://github.com/aquasecurity/trivy-action/releases/latest
 [release-img]: https://img.shields.io/github/release/aquasecurity/trivy-action.svg?logo=github
--- a/action.yaml
+++ b/action.yaml
@@ -71,7 +71,7 @@ inputs:
    description: 'output all packages regardless of vulnerability'
    required: false
    default: 'false'
-  security-checks:
+  scanners:
    description: 'comma-separated list of what security issues to detect'
    required: false
    default: ''
@@ -114,7 +114,7 @@ runs:
    - '-p ${{ inputs.hide-progress }}'
    - '-q ${{ inputs.skip-files }}'
    - '-r ${{ inputs.list-all-pkgs }}'
-    - '-s ${{ inputs.security-checks }}'
+    - '-s ${{ inputs.scanners }}'
    - '-t ${{ inputs.trivyignores }}'
    - '-u ${{ inputs.github-pat }}'
    - '-v ${{ inputs.trivy-config }}'
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -57,7 +57,7 @@ while getopts "a:b:c:d:e:f:g:h:i:j:k:l:m:n:o:p:q:r:s:t:u:v:z:" o; do
         export listAllPkgs=${OPTARG}
       ;;
       s)
-         export securityChecks=${OPTARG}
+         export scanners=${OPTARG}
       ;;
       t)
         export trivyIgnores=${OPTARG}
@@ -114,9 +114,9 @@ if [ $vulnType ] && [ "$scanType" != "config" ] && [ "$scanType" != "sbom" ];the
  ARGS="$ARGS --vuln-type $vulnType"
  SARIF_ARGS="$SARIF_ARGS --vuln-type $vulnType"
 fi
-if [ $securityChecks ];then
-  ARGS="$ARGS --security-checks $securityChecks"
-  SARIF_ARGS="$SARIF_ARGS --security-checks $securityChecks"
+if [ $scanners ];then
+  ARGS="$ARGS --scanners $scanners"
+  SARIF_ARGS="$SARIF_ARGS --scanners $scanners"
 fi
 if [ $severity ];then
  ARGS="$ARGS --severity $severity"
--- a/test/data/config-sarif.test
+++ b/test/data/config-sarif.test
@@ -35,9 +35,36 @@
                  "HIGH"
                ]
              }
+            },
+            {
+              "id": "DS026",
+              "name": "Misconfiguration",
+              "shortDescription": {
+                "text": "No HEALTHCHECK defined"
+              },
+              "fullDescription": {
+                "text": "You shoud add HEALTHCHECK instruction in your docker container images to perform the health check on running containers."
+              },
+              "defaultConfiguration": {
+                "level": "note"
+              },
+              "helpUri": "https://avd.aquasec.com/misconfig/ds026",
+              "help": {
+                "text": "Misconfiguration DS026\nType: Dockerfile Security Check\nSeverity: LOW\nCheck: No HEALTHCHECK defined\nMessage: Add HEALTHCHECK instruction in your Dockerfile\nLink: [DS026](https://avd.aquasec.com/misconfig/ds026)\nYou shoud add HEALTHCHECK instruction in your docker container images to perform the health check on running containers.",
+                "markdown": "**Misconfiguration DS026**\n| Type | Severity | Check | Message | Link |\n| --- | --- | --- | --- | --- |\n|Dockerfile Security Check|LOW|No HEALTHCHECK defined|Add HEALTHCHECK instruction in your Dockerfile|[DS026](https://avd.aquasec.com/misconfig/ds026)|\n\nYou shoud add HEALTHCHECK instruction in your docker container images to perform the health check on running containers."
+              },
+              "properties": {
+                "precision": "very-high",
+                "security-severity": "2.0",
+                "tags": [
+                  "misconfiguration",
+                  "security",
+                  "LOW"
+                ]
+              }
            }
          ],
-          "version": "0.34.0"
+          "version": "0.38.1"
        }
      },
      "results": [
@@ -67,6 +94,33 @@
              }
            }
          ]
+        },
+        {
+          "ruleId": "DS026",
+          "ruleIndex": 1,
+          "level": "note",
+          "message": {
+            "text": "Artifact: Dockerfile\nType: dockerfile\nVulnerability DS026\nSeverity: LOW\nMessage: Add HEALTHCHECK instruction in your Dockerfile\nLink: [DS026](https://avd.aquasec.com/misconfig/ds026)"
+          },
+          "locations": [
+            {
+              "physicalLocation": {
+                "artifactLocation": {
+                  "uri": "Dockerfile",
+                  "uriBaseId": "ROOTPATH"
+                },
+                "region": {
+                  "startLine": 1,
+                  "startColumn": 1,
+                  "endLine": 1,
+                  "endColumn": 1
+                }
+              },
+              "message": {
+                "text": "Dockerfile"
+              }
+            }
+          ]
        }
      ],
      "columnKind": "utf16CodeUnits",
--- a/test/data/config.test
+++ b/test/data/config.test
@@ -20,8 +20,8 @@
      "Class": "config",
      "Type": "dockerfile",
      "MisconfSummary": {
-        "Successes": 21,
-        "Failures": 1,
+        "Successes": 22,
+        "Failures": 2,
        "Exceptions": 0
      },
      "Misconfigurations": [
@@ -50,6 +50,32 @@
              "Lines": null
            }
          }
+        },
+        {
+          "Type": "Dockerfile Security Check",
+          "ID": "DS026",
+          "AVDID": "AVD-DS-0026",
+          "Title": "No HEALTHCHECK defined",
+          "Description": "You shoud add HEALTHCHECK instruction in your docker container images to perform the health check on running containers.",
+          "Message": "Add HEALTHCHECK instruction in your Dockerfile",
+          "Namespace": "builtin.dockerfile.DS026",
+          "Query": "data.builtin.dockerfile.DS026.deny",
+          "Resolution": "Add HEALTHCHECK instruction in Dockerfile",
+          "Severity": "LOW",
+          "PrimaryURL": "https://avd.aquasec.com/misconfig/ds026",
+          "References": [
+            "https://blog.aquasec.com/docker-security-best-practices",
+            "https://avd.aquasec.com/misconfig/ds026"
+          ],
+          "Status": "FAIL",
+          "Layer": {},
+          "CauseMetadata": {
+            "Provider": "Dockerfile",
+            "Service": "general",
+            "Code": {
+              "Lines": null
+            }
+          }
        }
      ]
    }
--- a/test/data/fs-scheck.test
+++ b/test/data/fs-scheck.test
@@ -20,8 +20,8 @@
      "Class": "config",
      "Type": "dockerfile",
      "MisconfSummary": {
-        "Successes": 21,
-        "Failures": 1,
+        "Successes": 22,
+        "Failures": 2,
        "Exceptions": 0
      },
      "Misconfigurations": [
@@ -50,6 +50,32 @@
              "Lines": null
            }
          }
+        },
+        {
+          "Type": "Dockerfile Security Check",
+          "ID": "DS026",
+          "AVDID": "AVD-DS-0026",
+          "Title": "No HEALTHCHECK defined",
+          "Description": "You shoud add HEALTHCHECK instruction in your docker container images to perform the health check on running containers.",
+          "Message": "Add HEALTHCHECK instruction in your Dockerfile",
+          "Namespace": "builtin.dockerfile.DS026",
+          "Query": "data.builtin.dockerfile.DS026.deny",
+          "Resolution": "Add HEALTHCHECK instruction in Dockerfile",
+          "Severity": "LOW",
+          "PrimaryURL": "https://avd.aquasec.com/misconfig/ds026",
+          "References": [
+            "https://blog.aquasec.com/docker-security-best-practices",
+            "https://avd.aquasec.com/misconfig/ds026"
+          ],
+          "Status": "FAIL",
+          "Layer": {},
+          "CauseMetadata": {
+            "Provider": "Dockerfile",
+            "Service": "general",
+            "Code": {
+              "Lines": null
+            }
+          }
        }
      ]
    }
--- a/test/data/image-sarif.test
+++ b/test/data/image-sarif.test
@@ -37,7 +37,7 @@
              }
            }
          ],
-          "version": "0.34.0"
+          "version": "0.38.1"
        }
      },
      "results": [
--- a/test/test.bats
+++ b/test/test.bats
@@ -4,7 +4,7 @@ bats_load_library bats-assert
 bats_load_library bats-file

@test "trivy repo with securityCheck secret only" {
-  # trivy repo --format json --output repo.test --security-checks=secret https://github.com/krol3/demo-trivy/
+  # trivy repo --format json --output repo.test --scanners=secret https://github.com/krol3/demo-trivy/
  run ./entrypoint.sh '-b json' '-h repo.test' '-s secret' '-a repo' '-j https://github.com/krol3/demo-trivy/'
  run diff repo.test ./test/data/repo.test
  echo "$output"
@@ -52,7 +52,7 @@ bats_load_library bats-file
 }

@test "trivy fs with securityChecks option" {
-  # trivy fs --format json --security-checks=vuln,config --output fs-scheck.test .
+  # trivy fs --format json --scanners=vuln,config --output fs-scheck.test .
  run ./entrypoint.sh '-a fs' '-b json' '-j .' '-s vuln,config,secret' '-h fs-scheck.test'
  run diff fs-scheck.test ./test/data/fs-scheck.test
  echo "$output"
--- a/workflow.yml
+++ b/workflow.yml
@@ -7,7 +7,7 @@ on:
 jobs:
  build:
    name: Build
-    runs-on: ubuntu-18.04
+    runs-on: ubuntu-20.04
    steps:
      - name: Checkout code
        uses: actions/checkout@v2
Author	SHA1	Message	Date
Viktor Sadovnikov	1f0aa582c8	Rename security-checks to scanners (#211 ) * Renaming securityChecks to runners * Renaming securityChecks to runners * Renaming securityChecks to runners * Correcting README	2023-03-06 21:00:01 -08:00
DmitriyLewen	43849adf01	bump trivy to v0.38.1 (#215 )	2023-03-06 20:58:30 -08:00
Falk Puschner	8bd2f9fbda	⬆️ bump trivy action (#203 )	2023-02-10 16:20:50 +09:00
simar7	cff3e9a7f6	feat(trivy): Bump Trivy to v0.37.1 (#199 ) Signed-off-by: Simar <simar@linux.com>	2023-02-01 16:40:29 -08:00