add: trivy pr reporter

2025-10-13 20:54:56 +02:00
parent 4d7f65bf41
commit 904e77d7e3
2 changed files with 102 additions and 0 deletions
@@ -0,0 +1,102 @@
+name: "Trivy Report"
+description: "Generate a vulnerability report from a Trivy scan in a GitHub PR in form of comments"
+author: "Timo Behrendt"
+branding:
+  icon: "shield"
+  color: "blue"
+
+inputs:
+  version:
+    description: "The version of the Trivy report to generate a report from"
+    required: false
+    default: "0.1.1"
+  architecture:
+    description: "The architecture of the Trivy report to generate a report from"
+    required: false
+    default: "amd64"
+  url:
+    description: "The URL of the Gitea instance"
+    required: false
+    default: "https://gitea.t000-n.de"
+  username:
+    description: "The username to use for authentication and will be the creator of the comments/issues"
+    required: true
+  token:
+    description: "The token to use for authentication"
+    required: true
+  owner:
+    description: "The owner of the repository"
+    required: true
+  repo:
+    description: "The repository name"
+    required: true
+  pr:
+    description: "The pull request number"
+    required: true
+  output:
+    description: "The output type. Currently only review is supported"
+    required: false
+    default: "review"
+  filter:
+    description: "The filter to use for the report. Can be either 'pr-changes' to only include new vulnerabilities that got introduced through the PR or 'all' to include all vulnerabilities"
+    required: false
+    default: "pr-changes"
+  report:
+    description: "The path to the report fiel generated by Trivy. Needs to be standard 'json' output of Trivy's vulnerability reportt"
+    required: false
+    default: "report.json"
+
+runs:
+  using: "composite"
+  steps:
+    - name: Cache Trivy-Reporter binary
+      id: cache-trivy-reporter
+      uses: actions/cache@v4
+      with:
+        path: /usr/local/bin/trivy-reporter-linux-${{ inputs.architecture }}
+        key: trivy-reporter-${{ inputs.version }}-${{ inputs.architecture }}
+        restore-keys: |
+          trivy-reporter-${{ inputs.version }}-${{ inputs.architecture }}-
+          trivy-reporter-${{ inputs.version }}-
+    - name: Validate inputs
+      shell: bash
+      run: |
+        set -e
+
+        ARCH="${{ inputs.architecture }}"
+
+        # Validate architecture
+        case "$ARCH" in
+          amd64|arm64)
+            ;;
+          *)
+            echo "Error: Unsupported architecture '$ARCH'. Supported: amd64, arm64"
+            exit 1
+            ;;
+        esac
+    - name: Download and install Trivy-Reporter
+      if: steps.cache-trivy-reporter.outputs.cache-hit != 'true'
+      shell: bash
+      run: |
+        set -e
+
+        VERSION="${{ inputs.version }}"
+        ARCH="${{ inputs.architecture }}"
+
+        mkdir -p /usr/local/bin
+
+        curl -sL "https://gitea.t000-n.de/t.behrendt/trivy-reporter/releases/download/${VERSION}/trivy-reporter-linux-${ARCH}" -o /usr/local/bin/trivy-reporter-linux-${ARCH}
+    - name: Create Trivy Report
+      shell: bash
+      run: |
+        trivy-reporter-linux-${{ inputs.architecture }} \
+          -platform "gitea"
+          -url ${{ inputs.url }}
+          -username ${{ inputs.username }}
+          -token ${{ inputs.token }}
+          -owner ${{ inputs.owner }}
+          -repo ${{ inputs.repo }}
+          -pr ${{ inputs.pr }}
+          -output "${{ inputs.output }}"
+          -filter "${{ inputs.filter }}"
+          -report "${{ inputs.report }}"