t.behrendt/sec-actions
0
0
Fork 0
Code Issues 2 Pull Requests Actions Activity

feat: add safely wrapped scan-* workflows
CI / Test Merge SARIF Files (pull_request) Successful in 4s
Details
CI / Test scan-config (pull_request) Failing after 7s
Details
CI / Test scan-image (pull_request) Failing after 6s
Details
CI / Test Setup DB (pull_request) Successful in 12s
Details
CI / Test Get Images From Files (pull_request) Successful in 14s
Details
CI / Test scan-fs (pull_request) Failing after 1m2s
Details

Browse Source
This commit is contained in:
Timo Behrendt
2026-04-10 19:05:43 +02:00
parent 3d3c7b3265
commit 6e5f62d4dd
8 changed files with 502 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/ci.yaml
+87
View File
@@ -29,6 +29,93 @@ jobs:
fi
echo "OK: trivy.db is present ($size bytes) and metadata.json exists."
test-scan-config:
name: Test scan-config
runs-on:
- ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Setup Trivy DB cache
id: db
uses: ./setup-db
- name: Create ephemeral config fixture
id: fixture
run: |
set -euo pipefail
scan="${{ runner.temp }}/trivy-ci-scan-config"
reports="${{ runner.temp }}/trivy-ci-reports-config"
mkdir -p "$scan" "$reports"
printf '%s\n' 'FROM alpine:3.20' > "$scan/Dockerfile"
echo "scan-path=$scan" >> "$GITHUB_OUTPUT"
echo "reports=$reports" >> "$GITHUB_OUTPUT"
- name: Run scan-config
id: scan
uses: ./scan-config
with:
scan-path: ${{ steps.fixture.outputs.scan-path }}
cache-dir: ${{ steps.db.outputs.cache-dir }}
output-dir: ${{ steps.fixture.outputs.reports }}
output-file: report.sarif
- name: Check output file exists
run: test -f "${{ steps.scan.outputs.output-path }}"
test-scan-fs:
name: Test scan-fs
runs-on:
- ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Setup Trivy DB cache
id: db
uses: ./setup-db
- name: Create ephemeral filesystem fixture
id: fixture
run: |
set -euo pipefail
scan="${{ runner.temp }}/trivy-ci-scan-fs"
reports="${{ runner.temp }}/trivy-ci-reports-fs"
mkdir -p "$scan" "$reports"
printf '%s\n' '{"private":true,"name":"trivy-ci-fixture"}' > "$scan/package.json"
echo "scan-path=$scan" >> "$GITHUB_OUTPUT"
echo "reports=$reports" >> "$GITHUB_OUTPUT"
- name: Run scan-fs
id: scan
uses: ./scan-fs
with:
scan-path: ${{ steps.fixture.outputs.scan-path }}
cache-dir: ${{ steps.db.outputs.cache-dir }}
output-dir: ${{ steps.fixture.outputs.reports }}
output-file: report.sarif
- name: Check output file exists
run: test -f "${{ steps.scan.outputs.output-path }}"
test-scan-image:
name: Test scan-image
runs-on:
- ubuntu-latest
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- name: Setup Trivy DB cache
id: db
uses: ./setup-db
- name: Prepare report directory
id: fixture
run: |
set -euo pipefail
reports="${{ runner.temp }}/trivy-ci-reports-image"
mkdir -p "$reports"
echo "reports=$reports" >> "$GITHUB_OUTPUT"
- name: Run scan-image
id: scan
uses: ./scan-image
with:
image: ghcr.io/aquasecurity/trivy:0.69.3@sha256:bcc376de8d77cfe086a917230e818dc9f8528e3c852f7b1aff648949b6258d1c
cache-dir: ${{ steps.db.outputs.cache-dir }}
output-dir: ${{ steps.fixture.outputs.reports }}
output-file: report.sarif
- name: Check output file exists
run: test -f "${{ steps.scan.outputs.output-path }}"
test-get-images-from-files:
name: Test Get Images From Files
runs-on: