Compare commits
18 Commits
954681c5af
..
main
| Author | SHA1 | Date | |
|---|---|---|---|
 renovate-bot
|
5254389c1a | ||
|
renovate-bot
|
9741562e47 | ||
|
renovate-bot
|
96f299fb53 | ||
|
renovate-bot
|
560c25fbab | ||
|
renovate-bot
|
218b0690a5 | ||
|
renovate-bot
|
9426fcf0d3 | ||
|
renovate-bot
|
592d4eb075 | ||
 t.behrendt
|
71d65cb196 | ||
|
t.behrendt
|
368e1be8dd | ||
|
renovate-bot
|
1e5381502a | ||
|
renovate-bot
|
432b4a651b | ||
|
t.behrendt
|
c157e7f9b7 | ||
|
renovate-bot
|
ef285207f1 | ||
|
renovate-bot
|
b21b9ac600 | ||
|
renovate-bot
|
9a14cb5ff3 | ||
|
renovate-bot
|
31859149c1 | ||
|
renovate-bot
|
3c4aeb81f4 | ||
|
t.behrendt
|
2616391b42 |
@@ -10,15 +10,15 @@ jobs:
|
||||
name: Release
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
||||
with:
|
||||
fetch-depth: 0
|
||||
- name: Increment tag
|
||||
id: tag
|
||||
uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@41b7e04221df8a033bec841d40a097b76e5f67ff # 0.1.29
|
||||
uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@3ab82e6aa1db388a34562f5ce6eedb598651d916 # 0.1.42
|
||||
with:
|
||||
token: ${{ secrets.GITEA_TOKEN }}
|
||||
- name: Push tag
|
||||
uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@3925c92fc33f3d2bc87d28d21ab691b7e6dd6cdf # 0.2.1
|
||||
uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@3f772d0a80a510b0f06762be110276c9c8a7b7b8 # 0.2.12
|
||||
with:
|
||||
tag: ${{ steps.tag.outputs.new-tag }}
|
||||
|
||||
+36
-103
@@ -4,124 +4,57 @@ on:
|
||||
pull_request:
|
||||
|
||||
jobs:
|
||||
test-setup-osv:
|
||||
strategy:
|
||||
matrix:
|
||||
arch: [amd64, arm64]
|
||||
name: Test Setup OSV Scanner ${{ matrix.arch }}
|
||||
runs-on:
|
||||
- ubuntu-latest
|
||||
- linux_${{ matrix.arch }}
|
||||
steps:
|
||||
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
||||
- name: Setup OSV Scanner
|
||||
uses: ./setup-osv
|
||||
with:
|
||||
version: v2.4.0
|
||||
amd64-digest: 15314940c10d26af9c6649f150b8a47c1262e8fc7e17b1d1029b0e479e8ed8a0
|
||||
arm64-digest: 44e580752910f0ff36ec99aff59af20f65df1e859aa31e5605a8f0d055b496e9
|
||||
- name: Run osv-scanner
|
||||
run: osv-scanner --version
|
||||
|
||||
test-setup-db:
|
||||
name: Test Setup DB
|
||||
runs-on:
|
||||
- ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
||||
- uses: ./setup-osv
|
||||
with:
|
||||
version: v2.4.0
|
||||
amd64-digest: 15314940c10d26af9c6649f150b8a47c1262e8fc7e17b1d1029b0e479e8ed8a0
|
||||
arm64-digest: 44e580752910f0ff36ec99aff59af20f65df1e859aa31e5605a8f0d055b496e9
|
||||
- name: Setup DB
|
||||
id: setup-db
|
||||
uses: ./setup-db
|
||||
- name: Verify vulnerability DB in cache
|
||||
run: |
|
||||
set -euo pipefail
|
||||
cache="${{ steps.setup-db.outputs.cache-dir }}"
|
||||
db="$cache/db/trivy.db"
|
||||
meta="$cache/db/metadata.json"
|
||||
test -f "$meta" || { echo "FAIL: $meta missing (DB not downloaded?)"; exit 1; }
|
||||
test -f "$db" || { echo "FAIL: $db missing (DB not downloaded?)"; exit 1; }
|
||||
size=$(stat -c%s "$db")
|
||||
min=$((3 * 1024 * 1024))
|
||||
if [ "$size" -lt "$min" ]; then
|
||||
echo "FAIL: trivy.db too small ($size bytes; expected at least $min bytes, i.e. a few MiB)"
|
||||
exit 1
|
||||
fi
|
||||
echo "OK: trivy.db is present ($size bytes) and metadata.json exists."
|
||||
|
||||
test-scan-config:
|
||||
name: Test scan-config
|
||||
runs-on:
|
||||
- ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
- name: Setup Trivy DB cache
|
||||
id: db
|
||||
uses: ./setup-db
|
||||
- name: Create ephemeral config fixture
|
||||
id: fixture
|
||||
run: |
|
||||
set -euo pipefail
|
||||
scan="${{ runner.temp }}/trivy-ci-scan-config"
|
||||
reports="${{ runner.temp }}/trivy-ci-reports-config"
|
||||
mkdir -p "$scan" "$reports"
|
||||
printf '%s\n' 'FROM alpine:3.20' > "$scan/Dockerfile"
|
||||
echo "scan-path=$scan" >> "$GITHUB_OUTPUT"
|
||||
echo "reports=$reports" >> "$GITHUB_OUTPUT"
|
||||
- name: Run scan-config
|
||||
id: scan
|
||||
uses: ./scan-config
|
||||
with:
|
||||
scan-path: ${{ steps.fixture.outputs.scan-path }}
|
||||
cache-dir: ${{ steps.db.outputs.cache-dir }}
|
||||
output-dir: ${{ steps.fixture.outputs.reports }}
|
||||
output-file: report.sarif
|
||||
- name: Check output file exists
|
||||
run: test -f "${{ steps.scan.outputs.output-path }}"
|
||||
|
||||
test-scan-fs:
|
||||
name: Test scan-fs
|
||||
runs-on:
|
||||
- ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
- name: Setup Trivy DB cache
|
||||
id: db
|
||||
uses: ./setup-db
|
||||
- name: Create ephemeral filesystem fixture
|
||||
id: fixture
|
||||
# Keep CI fast; full ecosystem download is covered by the action default.
|
||||
ecosystems: Go,npm,PyPI
|
||||
- name: Run osv-scanner offline
|
||||
run: |
|
||||
set -euo pipefail
|
||||
scan="${{ runner.temp }}/trivy-ci-scan-fs"
|
||||
reports="${{ runner.temp }}/trivy-ci-reports-fs"
|
||||
mkdir -p "$scan" "$reports"
|
||||
printf '%s\n' '{"private":true,"name":"trivy-ci-fixture"}' > "$scan/package.json"
|
||||
echo "scan-path=$scan" >> "$GITHUB_OUTPUT"
|
||||
echo "reports=$reports" >> "$GITHUB_OUTPUT"
|
||||
- name: Run scan-fs
|
||||
id: scan
|
||||
uses: ./scan-fs
|
||||
with:
|
||||
scan-path: ${{ steps.fixture.outputs.scan-path }}
|
||||
cache-dir: ${{ steps.db.outputs.cache-dir }}
|
||||
output-dir: ${{ steps.fixture.outputs.reports }}
|
||||
output-file: report.sarif
|
||||
- name: Check output file exists
|
||||
run: test -f "${{ steps.scan.outputs.output-path }}"
|
||||
|
||||
test-scan-image:
|
||||
name: Test scan-image
|
||||
runs-on:
|
||||
- ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
- name: Setup Trivy DB cache
|
||||
id: db
|
||||
uses: ./setup-db
|
||||
- name: Prepare report directory
|
||||
id: fixture
|
||||
run: |
|
||||
set -euo pipefail
|
||||
reports="${{ runner.temp }}/trivy-ci-reports-image"
|
||||
mkdir -p "$reports"
|
||||
echo "reports=$reports" >> "$GITHUB_OUTPUT"
|
||||
- name: Run scan-image
|
||||
id: scan
|
||||
uses: ./scan-image
|
||||
with:
|
||||
image: ghcr.io/aquasecurity/trivy:0.69.3@sha256:bcc376de8d77cfe086a917230e818dc9f8528e3c852f7b1aff648949b6258d1c
|
||||
cache-dir: ${{ steps.db.outputs.cache-dir }}
|
||||
output-dir: ${{ steps.fixture.outputs.reports }}
|
||||
output-file: report.sarif
|
||||
- name: Check output file exists
|
||||
run: test -f "${{ steps.scan.outputs.output-path }}"
|
||||
test -n "${OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY}"
|
||||
test "${OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY}" = "${{ steps.setup-db.outputs.cache-dir }}"
|
||||
test -f "${OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY}/osv-scanner/Go/all.zip"
|
||||
test -f "${OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY}/osv-scanner/npm/all.zip"
|
||||
test -f "${OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY}/osv-scanner/PyPI/all.zip"
|
||||
osv-scanner scan source --offline-vulnerabilities --allow-no-lockfiles .
|
||||
|
||||
test-get-images-from-files:
|
||||
name: Test Get Images From Files
|
||||
runs-on:
|
||||
- ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
||||
- id: giff
|
||||
uses: ./get-images-from-files
|
||||
with:
|
||||
@@ -172,7 +105,7 @@ jobs:
|
||||
runs-on:
|
||||
- ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
|
||||
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
||||
- name: Merge SARIF Files
|
||||
uses: ./merge-sarif-files
|
||||
with:
|
||||
|
||||
@@ -8,16 +8,16 @@ jobs:
|
||||
name: Prerelease
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
||||
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
||||
with:
|
||||
fetch-depth: 0
|
||||
- name: Increment tag
|
||||
id: tag
|
||||
uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@41b7e04221df8a033bec841d40a097b76e5f67ff # 0.1.29
|
||||
uses: https://gitea.t000-n.de/t.behrendt/conventional-semantic-git-tag-increment@3ab82e6aa1db388a34562f5ce6eedb598651d916 # 0.1.42
|
||||
with:
|
||||
token: ${{ secrets.GITEA_TOKEN }}
|
||||
prerelease: true
|
||||
- name: Push tag
|
||||
uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@3925c92fc33f3d2bc87d28d21ab691b7e6dd6cdf # 0.2.1
|
||||
uses: https://gitea.t000-n.de/t.behrendt/actions/release-git-tag@3f772d0a80a510b0f06762be110276c9c8a7b7b8 # 0.2.12
|
||||
with:
|
||||
tag: ${{ steps.tag.outputs.new-tag }}
|
||||
|
||||
@@ -1,3 +1,3 @@
|
||||
# Trivy Actions
|
||||
# OSV Scanner Actions
|
||||
|
||||
Gitea compatible actions related to Trivy or the Trivy ecosystem.
|
||||
Gitea compatible actions related to osv-scanner or the OSV ecosystem.
|
||||
|
||||
+1
-22
@@ -1,26 +1,5 @@
|
||||
{
|
||||
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
|
||||
"extends": [
|
||||
"local>t.behrendt/renovate-configs:common",
|
||||
"local>t.behrendt/renovate-configs:action"
|
||||
],
|
||||
"customManagers": [
|
||||
{
|
||||
"customType": "regex",
|
||||
"description": "Update Trivy docker image",
|
||||
"managerFilePatterns": [
|
||||
"/(^|/)(setup-db|scan-config|scan-fs|scan-image)/action\\.ya?ml$/"
|
||||
],
|
||||
"datasourceTemplate": "docker",
|
||||
"matchStrings": [
|
||||
"default:\\s*\"(?<depName>ghcr\\.io/aquasecurity/trivy):(?<currentValue>[\\d\\.]+)(?:@(?<currentDigest>sha256:[a-f0-9]+))?\""
|
||||
]
|
||||
}
|
||||
],
|
||||
"packageRules": [
|
||||
{
|
||||
"matchManagers": ["dockerfile", "kubernetes", "helmfile", "helm-values"],
|
||||
"extends": ["local>t.behrendt/renovate-configs:action"],
|
||||
"ignorePaths": ["get-images-from-files/test*"]
|
||||
}
|
||||
]
|
||||
}
|
||||
|
||||
@@ -1,60 +0,0 @@
|
||||
# Trivy scan (misconfiguration)
|
||||
|
||||
Composite action that runs **`trivy config`** inside **Docker** with the same hardening style as [setup-db](../setup-db): read-only root filesystem, dropped capabilities, `no-new-privileges`, AppArmor `docker-default`, a private `tmpfs` on `/tmp`, and resource limits.
|
||||
|
||||
The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/scan`. The vulnerability and policy cache from [setup-db](../setup-db) is mounted **read-only** at `/cache`. Your **`output-dir`** is mounted **read-write** at `/out`; the report is written as **`output-file`** inside that directory. The report format is always **SARIF** (`--format sarif`). Trivy is always run with **`--offline-scan`** (no API calls to resolve dependencies) and **`--exit-code 0`** (the step succeeds after writing the report even when findings are present).
|
||||
|
||||
**Misconfiguration scans do not need outbound network.** This action sets **`--network none`** so the container cannot reach the network. Rego check bundles are not fetched online (`--skip-check-update`); use a Trivy image that already includes the checks you need, or rely on the embedded defaults.
|
||||
|
||||
**Docker-in-Docker:** **`cache-dir`** and **`output-dir`** default under **`runner.temp`** so bind mounts work when the job runs in a container with DinD. **`scan-path`** must also be on the same shared volume the Docker daemon uses (often under your runner’s work/temp tree); see [setup-db](../setup-db) README.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Docker on the runner.
|
||||
- A populated Trivy cache at **`cache-dir`** (typically from the [setup-db](../setup-db) action).
|
||||
|
||||
## Usage
|
||||
|
||||
```yaml
|
||||
- uses: actions/checkout@v4
|
||||
- name: Setup Trivy DB cache
|
||||
id: db
|
||||
uses: ./setup-db
|
||||
- name: Misconfiguration scan
|
||||
id: scan
|
||||
uses: ./scan-config
|
||||
with:
|
||||
scan-path: ${{ github.workspace }}
|
||||
# On DinD, if bind mounts fail, use a path under ${{ runner.temp }} (or your runner’s shared work dir) instead.
|
||||
cache-dir: ${{ steps.db.outputs.cache-dir }}
|
||||
output-dir: ${{ runner.temp }}/trivy-reports
|
||||
output-file: misconfig.sarif
|
||||
- name: Upload report
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: trivy-misconfig
|
||||
path: ${{ steps.scan.outputs.output-path }}
|
||||
```
|
||||
|
||||
## Inputs
|
||||
|
||||
| Input | Description | Required | Default |
|
||||
| --------------- | --------------------------------------------------------------------------- | -------- | ------- |
|
||||
| `scan-path` | Host directory to scan (mounted read-only at `/scan`) | Yes | — |
|
||||
| `cache-dir` | Trivy cache directory (read-only at `/cache`; created if missing) | No | `${{ runner.temp }}/trivy` |
|
||||
| `output-dir` | Report directory (read-write at `/out`; created if missing) | Yes | — |
|
||||
| `output-file` | SARIF file name only (no `/`); created under `output-dir` | Yes | — |
|
||||
| `trivy-version` | Trivy Docker image (digest pin recommended) | No | Same pin as `setup-db` / see `action.yaml` |
|
||||
|
||||
**`trivy-version` is optional.** Omit it to use the default image from `action.yaml`.
|
||||
|
||||
## Outputs
|
||||
|
||||
| Output | Description |
|
||||
| -------------- | ------------------------------------ |
|
||||
| `output-path` | Absolute path to the SARIF report on the host |
|
||||
|
||||
## Notes
|
||||
|
||||
- **`cache-dir`** and **`output-dir`** are created with `mkdir -p` if missing. **`scan-path`** must already exist and be bind-mountable (see DinD note above).
|
||||
- The step still fails if Docker or the container exits non-zero before Trivy completes (e.g. mount or runtime errors).
|
||||
@@ -1,82 +0,0 @@
|
||||
name: "Trivy scan (misconfiguration)"
|
||||
description: "Run trivy config in a locked-down Docker container (misconfiguration / IaC); report is always SARIF"
|
||||
author: "Timo Behrendt <t.behrendt@t00n.de>"
|
||||
branding:
|
||||
icon: "shield"
|
||||
color: "blue"
|
||||
|
||||
inputs:
|
||||
scan-path:
|
||||
description: "Host path to the directory to scan (mounted read-only at /scan in the container)"
|
||||
required: true
|
||||
cache-dir:
|
||||
description: "Trivy cache directory (bind-mounted read-only at /cache; default under runner.temp for Docker-in-Docker)"
|
||||
required: false
|
||||
default: "${{ runner.temp }}/trivy"
|
||||
output-dir:
|
||||
description: "Report directory (bind-mounted read-write at /out; created if missing)"
|
||||
required: true
|
||||
output-file:
|
||||
description: "SARIF report file name only (no slashes); written under output-dir"
|
||||
required: true
|
||||
trivy-version:
|
||||
description: "Trivy Docker image reference (digest pin recommended)"
|
||||
required: false
|
||||
default: "ghcr.io/aquasecurity/trivy:0.69.3@sha256:bcc376de8d77cfe086a917230e818dc9f8528e3c852f7b1aff648949b6258d1c"
|
||||
|
||||
outputs:
|
||||
output-path:
|
||||
description: "Host path to the generated report file"
|
||||
value: ${{ steps.scan.outputs.output-path }}
|
||||
|
||||
runs:
|
||||
using: "composite"
|
||||
steps:
|
||||
- id: scan
|
||||
shell: bash
|
||||
env:
|
||||
SCAN_PATH_IN: ${{ inputs.scan-path }}
|
||||
CACHE_DIR_IN: ${{ inputs.cache-dir }}
|
||||
OUTPUT_DIR_IN: ${{ inputs.output-dir }}
|
||||
OUTPUT_FILE: ${{ inputs.output-file }}
|
||||
TRIVY_IMAGE: ${{ inputs.trivy-version }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
case "$OUTPUT_FILE" in */*|".."*) echo "FAIL: output-file must be a single file name (no path separators)"; exit 1 ;; esac
|
||||
mkdir -p "$CACHE_DIR_IN" "$OUTPUT_DIR_IN"
|
||||
scan_path=$(realpath "$SCAN_PATH_IN")
|
||||
cache_dir=$(realpath "$CACHE_DIR_IN")
|
||||
output_dir=$(realpath "$OUTPUT_DIR_IN")
|
||||
test -d "$scan_path" || { echo "FAIL: scan-path is not a directory: $scan_path"; exit 1; }
|
||||
test -d "$cache_dir" || { echo "FAIL: cache-dir is not a directory: $cache_dir"; exit 1; }
|
||||
test -d "$output_dir" || { echo "FAIL: output-dir is not a directory: $output_dir"; exit 1; }
|
||||
|
||||
docker run --rm \
|
||||
--name trivy-scan-config \
|
||||
--user "$(id -u):$(id -g)" \
|
||||
--read-only \
|
||||
--env-file /dev/null \
|
||||
--cap-drop ALL \
|
||||
--pids-limit 64 \
|
||||
--memory=512m \
|
||||
--memory-swap=512m \
|
||||
--cpus=1 \
|
||||
--ipc private \
|
||||
--cgroupns private \
|
||||
--security-opt no-new-privileges \
|
||||
--security-opt apparmor=docker-default \
|
||||
--tmpfs /tmp:rw,noexec,nosuid,nodev,size=1g \
|
||||
--network none \
|
||||
--mount type=bind,src="$scan_path",dst=/scan,ro \
|
||||
--mount type=bind,src="$cache_dir",dst=/cache,ro \
|
||||
--mount type=bind,src="$output_dir",dst=/out \
|
||||
"$TRIVY_IMAGE" \
|
||||
config /scan \
|
||||
--cache-dir /cache \
|
||||
--skip-check-update \
|
||||
--offline-scan \
|
||||
--format sarif \
|
||||
--exit-code 0 \
|
||||
-o "/out/$OUTPUT_FILE"
|
||||
|
||||
echo "output-path=$output_dir/$OUTPUT_FILE" >> "$GITHUB_OUTPUT"
|
||||
@@ -1,60 +0,0 @@
|
||||
# Trivy scan (filesystem)
|
||||
|
||||
Composite action that runs **`trivy filesystem`** inside **Docker** with the same hardening style as [setup-db](../setup-db): read-only root filesystem, dropped capabilities, `no-new-privileges`, AppArmor `docker-default`, a private `tmpfs` on `/tmp`, and resource limits.
|
||||
|
||||
The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/scan`. The Trivy cache from [setup-db](../setup-db) is mounted **read-only** at `/cache`. Your **`output-dir`** is mounted **read-write** at `/out`; the report is written as **`output-file`** inside that directory. The report format is always **SARIF** (`--format sarif`). Trivy is always run with **`--offline-scan`** (no API calls to identify dependencies) and **`--exit-code 0`** (the step succeeds after writing the report even when findings are present).
|
||||
|
||||
**Filesystem scans use `--network none`** so the scan container cannot reach the network. The vulnerability database must already be present under **`cache-dir`**; the action passes **`--skip-db-update`** and **`--skip-check-update`** so Trivy does not try to refresh data online.
|
||||
|
||||
**Docker-in-Docker:** Same bind-mount rules as [scan-config](../scan-config): prefer **`runner.temp`** (defaults) and a **`scan-path`** on the volume shared with DinD—see [setup-db](../setup-db) README.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Docker on the runner.
|
||||
- A populated Trivy cache at **`cache-dir`** (typically from the [setup-db](../setup-db) action).
|
||||
|
||||
## Usage
|
||||
|
||||
```yaml
|
||||
- uses: actions/checkout@v4
|
||||
- name: Setup Trivy DB cache
|
||||
id: db
|
||||
uses: ./setup-db
|
||||
- name: Filesystem scan
|
||||
id: scan
|
||||
uses: ./scan-fs
|
||||
with:
|
||||
scan-path: ${{ github.workspace }}
|
||||
cache-dir: ${{ steps.db.outputs.cache-dir }}
|
||||
output-dir: ${{ runner.temp }}/trivy-reports
|
||||
output-file: fs.sarif
|
||||
- name: Upload report
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: trivy-fs
|
||||
path: ${{ steps.scan.outputs.output-path }}
|
||||
```
|
||||
|
||||
## Inputs
|
||||
|
||||
| Input | Description | Required | Default |
|
||||
| --------------- | --------------------------------------------------------------------------- | -------- | ------- |
|
||||
| `scan-path` | Host directory to scan (mounted read-only at `/scan`) | Yes | — |
|
||||
| `cache-dir` | Trivy cache directory (read-only at `/cache`; created if missing) | No | `${{ runner.temp }}/trivy` |
|
||||
| `output-dir` | Report directory (read-write at `/out`; created if missing) | Yes | — |
|
||||
| `output-file` | SARIF file name only (no `/`); created under `output-dir` | Yes | — |
|
||||
| `trivy-version` | Trivy Docker image (digest pin recommended) | No | Same pin as `setup-db` / see `action.yaml` |
|
||||
|
||||
**`trivy-version` is optional.** Omit it to use the default image from `action.yaml`.
|
||||
|
||||
## Outputs
|
||||
|
||||
| Output | Description |
|
||||
| -------------- | ------------------------------------ |
|
||||
| `output-path` | Absolute path to the SARIF report on the host |
|
||||
|
||||
## Notes
|
||||
|
||||
- Paths should exist or be creatable: **`output-dir`** is created with `mkdir -p` if missing; **`scan-path`** and **`cache-dir`** must already exist.
|
||||
- Default Trivy filesystem scanners include **vuln** and **secret**; misconfig-related network fetches are avoided via **`--skip-check-update`**.
|
||||
- The step still fails if Docker or the container exits non-zero before Trivy completes (e.g. mount or runtime errors).
|
||||
@@ -1,83 +0,0 @@
|
||||
name: "Trivy scan (filesystem)"
|
||||
description: "Run trivy filesystem in a locked-down Docker container; report is always SARIF"
|
||||
author: "Timo Behrendt <t.behrendt@t00n.de>"
|
||||
branding:
|
||||
icon: "search"
|
||||
color: "blue"
|
||||
|
||||
inputs:
|
||||
scan-path:
|
||||
description: "Host path to the directory to scan (mounted read-only at /scan in the container)"
|
||||
required: true
|
||||
cache-dir:
|
||||
description: "Trivy cache directory (bind-mounted read-only at /cache; default under runner.temp for Docker-in-Docker)"
|
||||
required: false
|
||||
default: "${{ runner.temp }}/trivy"
|
||||
output-dir:
|
||||
description: "Report directory (bind-mounted read-write at /out; created if missing)"
|
||||
required: true
|
||||
output-file:
|
||||
description: "SARIF report file name only (no slashes); written under output-dir"
|
||||
required: true
|
||||
trivy-version:
|
||||
description: "Trivy Docker image reference (digest pin recommended)"
|
||||
required: false
|
||||
default: "ghcr.io/aquasecurity/trivy:0.69.3@sha256:bcc376de8d77cfe086a917230e818dc9f8528e3c852f7b1aff648949b6258d1c"
|
||||
|
||||
outputs:
|
||||
output-path:
|
||||
description: "Host path to the generated report file"
|
||||
value: ${{ steps.scan.outputs.output-path }}
|
||||
|
||||
runs:
|
||||
using: "composite"
|
||||
steps:
|
||||
- id: scan
|
||||
shell: bash
|
||||
env:
|
||||
SCAN_PATH_IN: ${{ inputs.scan-path }}
|
||||
CACHE_DIR_IN: ${{ inputs.cache-dir }}
|
||||
OUTPUT_DIR_IN: ${{ inputs.output-dir }}
|
||||
OUTPUT_FILE: ${{ inputs.output-file }}
|
||||
TRIVY_IMAGE: ${{ inputs.trivy-version }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
case "$OUTPUT_FILE" in */*|".."*) echo "FAIL: output-file must be a single file name (no path separators)"; exit 1 ;; esac
|
||||
mkdir -p "$CACHE_DIR_IN" "$OUTPUT_DIR_IN"
|
||||
scan_path=$(realpath "$SCAN_PATH_IN")
|
||||
cache_dir=$(realpath "$CACHE_DIR_IN")
|
||||
output_dir=$(realpath "$OUTPUT_DIR_IN")
|
||||
test -d "$scan_path" || { echo "FAIL: scan-path is not a directory: $scan_path"; exit 1; }
|
||||
test -d "$cache_dir" || { echo "FAIL: cache-dir is not a directory: $cache_dir"; exit 1; }
|
||||
test -d "$output_dir" || { echo "FAIL: output-dir is not a directory: $output_dir"; exit 1; }
|
||||
|
||||
docker run --rm \
|
||||
--name trivy-scan-fs \
|
||||
--user "$(id -u):$(id -g)" \
|
||||
--read-only \
|
||||
--env-file /dev/null \
|
||||
--cap-drop ALL \
|
||||
--pids-limit 64 \
|
||||
--memory=512m \
|
||||
--memory-swap=512m \
|
||||
--cpus=1 \
|
||||
--ipc private \
|
||||
--cgroupns private \
|
||||
--security-opt no-new-privileges \
|
||||
--security-opt apparmor=docker-default \
|
||||
--tmpfs /tmp:rw,noexec,nosuid,nodev,size=1g \
|
||||
--network none \
|
||||
--mount type=bind,src="$scan_path",dst=/scan,ro \
|
||||
--mount type=bind,src="$cache_dir",dst=/cache,ro \
|
||||
--mount type=bind,src="$output_dir",dst=/out \
|
||||
"$TRIVY_IMAGE" \
|
||||
filesystem /scan \
|
||||
--cache-dir /cache \
|
||||
--skip-db-update \
|
||||
--skip-check-update \
|
||||
--offline-scan \
|
||||
--format sarif \
|
||||
--exit-code 0 \
|
||||
-o "/out/$OUTPUT_FILE"
|
||||
|
||||
echo "output-path=$output_dir/$OUTPUT_FILE" >> "$GITHUB_OUTPUT"
|
||||
@@ -1,57 +0,0 @@
|
||||
# Trivy scan (image)
|
||||
|
||||
Composite action that runs **`trivy image`** inside **Docker** with the same hardening style as [setup-db](../setup-db): read-only root filesystem, dropped capabilities, `no-new-privileges`, AppArmor `docker-default`, a private `tmpfs` on `/tmp`, and resource limits.
|
||||
|
||||
You pass a pullable **`image`** reference (e.g. `alpine:3.20` or a digest). Trivy pulls and scans it inside the container. The Trivy cache from [setup-db](../setup-db) is mounted **read-only** at `/cache` (**`--skip-db-update`** avoids re-downloading the DB). Your **`output-dir`** is mounted **read-write** at `/out`; the report is written as **`output-file`** inside that directory. The report format is always **SARIF** (`--format sarif`). Trivy is always run with **`--offline-scan`** (no API calls to identify dependencies) and **`--exit-code 0`** (the step succeeds after writing the report even when findings are present). Image layers are still pulled over the network when needed.
|
||||
|
||||
**Image scans need network access** to pull the image (and possibly layers). This action does **not** set `--network none` (unlike [scan-config](../scan-config) and [scan-fs](../scan-fs)).
|
||||
|
||||
## Prerequisites
|
||||
|
||||
- Docker on the runner.
|
||||
- A populated Trivy cache at **`cache-dir`** (typically from the [setup-db](../setup-db) action).
|
||||
|
||||
## Usage
|
||||
|
||||
```yaml
|
||||
- name: Setup Trivy DB cache
|
||||
id: db
|
||||
uses: ./setup-db
|
||||
- name: Image scan
|
||||
id: scan
|
||||
uses: ./scan-image
|
||||
with:
|
||||
image: alpine:3.20
|
||||
cache-dir: ${{ steps.db.outputs.cache-dir }}
|
||||
output-dir: ${{ runner.temp }}/trivy-reports
|
||||
output-file: image.sarif
|
||||
- name: Upload report
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: trivy-image
|
||||
path: ${{ steps.scan.outputs.output-path }}
|
||||
```
|
||||
|
||||
## Inputs
|
||||
|
||||
| Input | Description | Required | Default |
|
||||
| --------------- | --------------------------------------------------------------------------- | -------- | ------- |
|
||||
| `image` | Image reference to scan (pulled inside the container) | Yes | — |
|
||||
| `cache-dir` | Trivy cache directory (mounted read-only at `/cache`) | No | `${{ runner.temp }}/trivy` |
|
||||
| `output-dir` | Host directory for the report (mounted read-write at `/out`) | Yes | — |
|
||||
| `output-file` | SARIF file name only (no `/`); created under `output-dir` | Yes | — |
|
||||
| `trivy-version` | Trivy Docker image (digest pin recommended) | No | Same pin as `setup-db` / see `action.yaml` |
|
||||
|
||||
**`trivy-version` is optional.** Omit it to use the default image from `action.yaml`.
|
||||
|
||||
## Outputs
|
||||
|
||||
| Output | Description |
|
||||
| -------------- | ------------------------------------ |
|
||||
| `output-path` | Absolute path to the SARIF report on the host |
|
||||
|
||||
## Notes
|
||||
|
||||
- **`output-dir`** is created with `mkdir -p` if missing; **`cache-dir`** must already exist.
|
||||
- Local-only images (e.g. built on the host) are not supported unless they are available to the **inner** Docker pull (this action does not mount `docker.sock`).
|
||||
- The step still fails if Docker or the container exits non-zero before Trivy completes (e.g. mount or runtime errors).
|
||||
@@ -1,78 +0,0 @@
|
||||
name: "Trivy scan (image)"
|
||||
description: "Run trivy image in a locked-down Docker container; report is always SARIF"
|
||||
author: "Timo Behrendt <t.behrendt@t00n.de>"
|
||||
branding:
|
||||
icon: "package"
|
||||
color: "blue"
|
||||
|
||||
inputs:
|
||||
image:
|
||||
description: "Container image reference to scan (pulled by Trivy inside the container; requires network)"
|
||||
required: true
|
||||
cache-dir:
|
||||
description: "Trivy cache directory (bind-mounted read-only at /cache; default under runner.temp for Docker-in-Docker)"
|
||||
required: false
|
||||
default: "${{ runner.temp }}/trivy"
|
||||
output-dir:
|
||||
description: "Report directory (bind-mounted read-write at /out; created if missing)"
|
||||
required: true
|
||||
output-file:
|
||||
description: "SARIF report file name only (no slashes); written under output-dir"
|
||||
required: true
|
||||
trivy-version:
|
||||
description: "Trivy Docker image reference (digest pin recommended)"
|
||||
required: false
|
||||
default: "ghcr.io/aquasecurity/trivy:0.69.3@sha256:bcc376de8d77cfe086a917230e818dc9f8528e3c852f7b1aff648949b6258d1c"
|
||||
|
||||
outputs:
|
||||
output-path:
|
||||
description: "Host path to the generated report file"
|
||||
value: ${{ steps.scan.outputs.output-path }}
|
||||
|
||||
runs:
|
||||
using: "composite"
|
||||
steps:
|
||||
- id: scan
|
||||
shell: bash
|
||||
env:
|
||||
IMAGE_REF: ${{ inputs.image }}
|
||||
CACHE_DIR_IN: ${{ inputs.cache-dir }}
|
||||
OUTPUT_DIR_IN: ${{ inputs.output-dir }}
|
||||
OUTPUT_FILE: ${{ inputs.output-file }}
|
||||
TRIVY_IMAGE: ${{ inputs.trivy-version }}
|
||||
run: |
|
||||
set -euo pipefail
|
||||
case "$OUTPUT_FILE" in */*|".."*) echo "FAIL: output-file must be a single file name (no path separators)"; exit 1 ;; esac
|
||||
mkdir -p "$CACHE_DIR_IN" "$OUTPUT_DIR_IN"
|
||||
cache_dir=$(realpath "$CACHE_DIR_IN")
|
||||
output_dir=$(realpath "$OUTPUT_DIR_IN")
|
||||
test -d "$cache_dir" || { echo "FAIL: cache-dir is not a directory: $cache_dir"; exit 1; }
|
||||
test -d "$output_dir" || { echo "FAIL: output-dir is not a directory: $output_dir"; exit 1; }
|
||||
|
||||
docker run --rm \
|
||||
--name trivy-scan-image \
|
||||
--user "$(id -u):$(id -g)" \
|
||||
--read-only \
|
||||
--env-file /dev/null \
|
||||
--cap-drop ALL \
|
||||
--pids-limit 64 \
|
||||
--memory=512m \
|
||||
--memory-swap=512m \
|
||||
--cpus=1 \
|
||||
--ipc private \
|
||||
--cgroupns private \
|
||||
--security-opt no-new-privileges \
|
||||
--security-opt apparmor=docker-default \
|
||||
--tmpfs /tmp:rw,noexec,nosuid,nodev,size=1g \
|
||||
--mount type=bind,src="$cache_dir",dst=/cache,ro \
|
||||
--mount type=bind,src="$output_dir",dst=/out \
|
||||
"$TRIVY_IMAGE" \
|
||||
image "$IMAGE_REF" \
|
||||
--cache-dir /cache \
|
||||
--skip-db-update \
|
||||
--offline-scan \
|
||||
--format sarif \
|
||||
--exit-code 0 \
|
||||
-o "/out/$OUTPUT_FILE"
|
||||
|
||||
echo "output-path=$output_dir/$OUTPUT_FILE" >> "$GITHUB_OUTPUT"
|
||||
+20
-15
@@ -1,12 +1,8 @@
|
||||
# Setup DB Action
|
||||
|
||||
A reusable Gitea Action that sets up the Trivy vulnerability database, restoring from cache if available.
|
||||
A reusable Gitea Action that sets up the osv-scanner offline vulnerability database, restoring from cache if available.
|
||||
|
||||
The action runs Trivy inside **Docker** with a restricted container configuration so the Trivy runtime is isolated from the host while the database is downloaded into your cache directory.
|
||||
|
||||
**Docker-in-Docker:** If the job runs **in a container** and talks to a **DinD sidecar**, bind-mount sources must live on the volume **both** the job and the Docker daemon see. On GitHub-hosted-style setups that is typically under **`RUNNER_TEMP`** (e.g. `/home/runner/_work/_temp`). The default **`cache-dir`** is **`${{ runner.temp }}/trivy`** for that reason—see [this overview of DinD bind mounts](https://dev.to/devactivity/navigating-github-actions-dind-bind-mounts-insights-from-recent-github-reports-for-cicd-1c8). Configure your Gitea runner the same way, or set **`cache-dir`** to a path your platform documents as shared with DinD.
|
||||
|
||||
**Note:** This action only prepares the vulnerability database. If you run Trivy on the runner host for scans (for example `trivy fs .`), install Trivy separately (e.g. with a `setup-trivy` action or your own step).
|
||||
**Note:** This action only sets up the database. osv-scanner itself must be installed separately (e.g., using the `setup-osv` action). Subsequent steps receive `OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY` via the environment.
|
||||
|
||||
## Usage
|
||||
|
||||
@@ -14,7 +10,7 @@ The action runs Trivy inside **Docker** with a restricted container configuratio
|
||||
|
||||
```yaml
|
||||
- name: Setup DB
|
||||
uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@0.0.1
|
||||
uses: https://gitea.t000-n.de/t.behrendt/osv-scanner-actions/setup-db@0.0.1
|
||||
```
|
||||
|
||||
### Complete Example
|
||||
@@ -30,19 +26,28 @@ jobs:
|
||||
- linux_amd64
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- name: Setup Trivy
|
||||
uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-trivy@0.0.1
|
||||
- name: Setup OSV Scanner
|
||||
uses: https://gitea.t000-n.de/t.behrendt/osv-scanner-actions/setup-osv@0.0.1
|
||||
with:
|
||||
version: "v2.4.0"
|
||||
amd64-digest: "15314940c10d26af9c6649f150b8a47c1262e8fc7e17b1d1029b0e479e8ed8a0"
|
||||
arm64-digest: "44e580752910f0ff36ec99aff59af20f65df1e859aa31e5605a8f0d055b496e9"
|
||||
- name: Setup DB
|
||||
uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@0.0.1
|
||||
id: setup-db
|
||||
uses: https://gitea.t000-n.de/t.behrendt/osv-scanner-actions/setup-db@0.0.1
|
||||
- name: Scan for vulnerabilities
|
||||
run: trivy fs .
|
||||
run: osv-scanner scan source --offline-vulnerabilities -r .
|
||||
```
|
||||
|
||||
## Inputs
|
||||
|
||||
| Input | Description | Required | Default |
|
||||
| ---------------- | --------------------------------------------------------------------------- | -------- | ------- |
|
||||
| `cache-dir` | Trivy cache directory (created if missing; bind-mounted for DB download) | No | `${{ runner.temp }}/trivy` |
|
||||
| `trivy-version` | Docker image reference for Trivy (digest pin recommended) | No | Pinned `ghcr.io/aquasecurity/trivy` image in `action.yaml` |
|
||||
| ------------- | --------------------------------------------------------------------------- | -------- | -------------------------------- |
|
||||
| `cache-dir` | Path used as `OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY` | No | `${{ runner.temp }}/osv-scanner` |
|
||||
| `ecosystems` | Comma-separated OSV ecosystems to download; empty downloads all ecosystems | No | _(all)_ |
|
||||
|
||||
**`trivy-version` is optional.** If you omit it, the action uses the default image (version and digest) from `action.yaml`. Set it only when you need a different Trivy image or your own digest pin.
|
||||
## Outputs
|
||||
|
||||
| Output | Description |
|
||||
| ----------- | ------------------------------------------------ |
|
||||
| `cache-dir` | Path to the osv-scanner local DB cache directory |
|
||||
|
||||
+68
-33
@@ -1,23 +1,23 @@
|
||||
name: "Setup Trivy DB"
|
||||
description: "Setup the trivy database, restoring from cache if available"
|
||||
author: "Timo Behrendt <t.behrendt@t00n.de"
|
||||
name: "Setup OSV Scanner DB"
|
||||
description: "Setup the osv-scanner offline vulnerability database, restoring from cache if available"
|
||||
author: "Timo Behrendt <t.behrendt@t00n.de>"
|
||||
branding:
|
||||
icon: "database"
|
||||
color: "blue"
|
||||
|
||||
inputs:
|
||||
cache-dir:
|
||||
description: "Trivy cache directory on the job filesystem (default under runner.temp—shared with Docker-in-Docker sidecars; bind-mounted into the Trivy container)"
|
||||
description: "Path used as OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY (default: ${{runner.temp}}/osv-scanner)"
|
||||
required: false
|
||||
default: "${{ runner.temp }}/trivy"
|
||||
trivy-version:
|
||||
description: "Trivy docker image version to use (full image reference including digest is recommended)"
|
||||
default: "${{ runner.temp }}/osv-scanner"
|
||||
ecosystems:
|
||||
description: "Comma-separated list of OSV ecosystems to download. Empty downloads all ecosystems."
|
||||
required: false
|
||||
default: "ghcr.io/aquasecurity/trivy:0.69.3@sha256:bcc376de8d77cfe086a917230e818dc9f8528e3c852f7b1aff648949b6258d1c"
|
||||
default: ""
|
||||
|
||||
outputs:
|
||||
cache-dir:
|
||||
description: "Path to the Trivy cache directory"
|
||||
description: "Path to the osv-scanner local DB cache directory"
|
||||
value: ${{ inputs.cache-dir }}
|
||||
|
||||
runs:
|
||||
@@ -27,33 +27,68 @@ runs:
|
||||
shell: bash
|
||||
run: |
|
||||
echo "current-date=$(date +%Y-%m-%d)" >> $GITHUB_OUTPUT
|
||||
- name: Ensure Trivy cache directory exists
|
||||
shell: bash
|
||||
run: mkdir -p "${{ inputs.cache-dir }}"
|
||||
- id: restore-db
|
||||
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
|
||||
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
|
||||
with:
|
||||
path: ${{ inputs.cache-dir }}
|
||||
key: trivy-db-${{ steps.current-date.outputs.current-date }}
|
||||
key: osv-scanner-db-${{ steps.current-date.outputs.current-date }}
|
||||
restore-keys: |
|
||||
trivy-db-${{ steps.current-date.outputs.current-date }}
|
||||
- if: steps.restore-db.outputs.cache-hit != 'true'
|
||||
osv-scanner-db-${{ steps.current-date.outputs.current-date }}
|
||||
- name: Download offline databases
|
||||
if: steps.restore-db.outputs.cache-hit != 'true'
|
||||
shell: bash
|
||||
run: |
|
||||
docker run --rm \
|
||||
--name trivy-db-download \
|
||||
--user "$(id -u):$(id -g)" \
|
||||
--read-only \
|
||||
--env-file /dev/null \
|
||||
--cap-drop ALL \
|
||||
--pids-limit 64 \
|
||||
--memory=512m \
|
||||
--memory-swap=512m \
|
||||
--cpus=1 \
|
||||
--ipc private \
|
||||
--cgroupns private \
|
||||
--security-opt no-new-privileges \
|
||||
--security-opt apparmor=docker-default \
|
||||
--tmpfs /tmp:rw,noexec,nosuid,nodev,size=1g \
|
||||
--mount type=bind,src=${{ inputs.cache-dir }},dst=/cache \
|
||||
${{ inputs.trivy-version }} fs --download-db-only --cache-dir /cache --offline-scan --exit-code 0
|
||||
set -euo pipefail
|
||||
|
||||
CACHE_DIR="${{ inputs.cache-dir }}"
|
||||
DB_DIR="${CACHE_DIR}/osv-scanner"
|
||||
mkdir -p "${DB_DIR}"
|
||||
|
||||
ECOSYSTEMS_INPUT="${{ inputs.ecosystems }}"
|
||||
if [ -n "${ECOSYSTEMS_INPUT}" ]; then
|
||||
# shellcheck disable=SC2001
|
||||
ECOSYSTEMS=$(echo "${ECOSYSTEMS_INPUT}" | tr ',' '\n' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//' | grep -v '^$' || true)
|
||||
else
|
||||
ECOSYSTEMS=$(curl -fsSL https://osv-vulnerabilities.storage.googleapis.com/ecosystems.txt | grep -v '^$' | grep -v '^\[EMPTY\]$' || true)
|
||||
fi
|
||||
|
||||
if [ -z "${ECOSYSTEMS}" ]; then
|
||||
echo "No ecosystems to download" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
download_one() {
|
||||
local ecosystem="$1"
|
||||
local encoded
|
||||
encoded=$(printf '%s' "${ecosystem}" | jq -sRr @uri)
|
||||
local dest="${DB_DIR}/${ecosystem}"
|
||||
mkdir -p "${dest}"
|
||||
echo "Downloading ${ecosystem}..."
|
||||
curl -fsSL "https://osv-vulnerabilities.storage.googleapis.com/${encoded}/all.zip" -o "${dest}/all.zip"
|
||||
}
|
||||
|
||||
max_jobs=8
|
||||
pids=()
|
||||
while IFS= read -r ecosystem; do
|
||||
[ -z "${ecosystem}" ] && continue
|
||||
while [ "$(jobs -rp | wc -l)" -ge "${max_jobs}" ]; do
|
||||
sleep 0.2
|
||||
done
|
||||
download_one "${ecosystem}" &
|
||||
pids+=("$!")
|
||||
done <<< "${ECOSYSTEMS}"
|
||||
|
||||
fail=0
|
||||
for pid in "${pids[@]}"; do
|
||||
wait "${pid}" || fail=1
|
||||
done
|
||||
if [ "${fail}" -ne 0 ]; then
|
||||
echo "One or more ecosystem database downloads failed" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Downloaded $(find "${DB_DIR}" -name all.zip | wc -l) ecosystem database(s) to ${DB_DIR}"
|
||||
- name: Export DB cache directory
|
||||
shell: bash
|
||||
run: |
|
||||
echo "OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY=${{ inputs.cache-dir }}" >> "$GITHUB_ENV"
|
||||
|
||||
@@ -0,0 +1,51 @@
|
||||
# Setup OSV Scanner Action
|
||||
|
||||
A reusable Gitea Action that downloads and sets up the osv-scanner binary for vulnerability scanning.
|
||||
|
||||
The downloaded binary is verified against a pinned SHA-256 digest for the runner architecture.
|
||||
|
||||
## Usage
|
||||
|
||||
### Basic Usage
|
||||
|
||||
```yaml
|
||||
- name: Setup OSV Scanner
|
||||
uses: your-username/osv-scanner-actions@main/setup-osv
|
||||
with:
|
||||
version: "v2.4.0"
|
||||
amd64-digest: "15314940c10d26af9c6649f150b8a47c1262e8fc7e17b1d1029b0e479e8ed8a0"
|
||||
arm64-digest: "44e580752910f0ff36ec99aff59af20f65df1e859aa31e5605a8f0d055b496e9"
|
||||
```
|
||||
|
||||
Digests are published in each release's `osv-scanner_SHA256SUMS` file (e.g. for `osv-scanner_linux_amd64` / `osv-scanner_linux_arm64`). You may pass either bare hex or `sha256:<hex>`.
|
||||
|
||||
### Complete Example
|
||||
|
||||
```yaml
|
||||
name: Security Scan
|
||||
on: [push, pull_request]
|
||||
|
||||
jobs:
|
||||
security:
|
||||
runs-on:
|
||||
- ubuntu-latest
|
||||
- linux_amd64
|
||||
steps:
|
||||
- uses: actions/checkout@v4
|
||||
- name: Setup OSV Scanner
|
||||
uses: your-username/osv-scanner-actions@main/setup-osv
|
||||
with:
|
||||
version: "v2.4.0"
|
||||
amd64-digest: "15314940c10d26af9c6649f150b8a47c1262e8fc7e17b1d1029b0e479e8ed8a0"
|
||||
arm64-digest: "44e580752910f0ff36ec99aff59af20f65df1e859aa31e5605a8f0d055b496e9"
|
||||
- name: Scan for vulnerabilities
|
||||
run: osv-scanner scan source -r .
|
||||
```
|
||||
|
||||
## Inputs
|
||||
|
||||
| Input | Description | Required | Default |
|
||||
| -------------- | -------------------------------------------------------------------- | -------- | ------- |
|
||||
| `version` | Explicit osv-scanner release tag (e.g. `v2.4.0`). `latest` is rejected | Yes | — |
|
||||
| `amd64-digest` | SHA-256 of `osv-scanner_linux_amd64` (hex or `sha256:<hex>`) | Yes | — |
|
||||
| `arm64-digest` | SHA-256 of `osv-scanner_linux_arm64` (hex or `sha256:<hex>`) | Yes | — |
|
||||
@@ -0,0 +1,104 @@
|
||||
name: "Setup OSV Scanner"
|
||||
description: "Download and setup osv-scanner binary for vulnerability scanning"
|
||||
author: "Gitea Actions"
|
||||
branding:
|
||||
icon: "shield"
|
||||
color: "blue"
|
||||
|
||||
inputs:
|
||||
version:
|
||||
description: "osv-scanner version to download (e.g., v2.4.0). Must be an explicit release tag; 'latest' is not allowed."
|
||||
required: true
|
||||
amd64-digest:
|
||||
description: "SHA-256 digest of the linux amd64 binary (hex or sha256:<hex>)"
|
||||
required: true
|
||||
arm64-digest:
|
||||
description: "SHA-256 digest of the linux arm64 binary (hex or sha256:<hex>)"
|
||||
required: true
|
||||
|
||||
runs:
|
||||
using: "composite"
|
||||
steps:
|
||||
- name: Resolve architecture and digest
|
||||
shell: bash
|
||||
id: arch
|
||||
run: |
|
||||
set -euo pipefail
|
||||
|
||||
VERSION="${{ inputs.version }}"
|
||||
if [ -z "${VERSION}" ] || [ "${VERSION}" = "latest" ]; then
|
||||
echo "version must be an explicit release tag (e.g. v2.4.0); 'latest' is not allowed" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
case "$(uname -m)" in
|
||||
x86_64)
|
||||
ARCH="amd64"
|
||||
DIGEST="${{ inputs.amd64-digest }}"
|
||||
;;
|
||||
aarch64)
|
||||
ARCH="arm64"
|
||||
DIGEST="${{ inputs.arm64-digest }}"
|
||||
;;
|
||||
*)
|
||||
echo "Unsupported architecture: $(uname -m)" >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
|
||||
if [ -z "${DIGEST}" ]; then
|
||||
echo "Missing digest for architecture ${ARCH}" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Normalize sha256:<hex> / SHA256:<hex> to bare hex
|
||||
DIGEST="${DIGEST#sha256:}"
|
||||
DIGEST="${DIGEST#SHA256:}"
|
||||
|
||||
if ! [[ "${DIGEST}" =~ ^[a-fA-F0-9]{64}$ ]]; then
|
||||
echo "Invalid ${ARCH} digest (expected 64-char hex or sha256:<hex>): ${DIGEST}" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "ARCH=${ARCH}" >> "$GITHUB_OUTPUT"
|
||||
echo "DIGEST=${DIGEST}" >> "$GITHUB_OUTPUT"
|
||||
echo "VERSION=${VERSION}" >> "$GITHUB_OUTPUT"
|
||||
- name: Cache osv-scanner binary
|
||||
id: cache-osv
|
||||
uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
|
||||
with:
|
||||
path: /usr/local/bin/osv-scanner
|
||||
key: osv-scanner-${{ steps.arch.outputs.version }}-${{ steps.arch.outputs.arch }}-${{ steps.arch.outputs.digest }}
|
||||
restore-keys: |
|
||||
osv-scanner-${{ steps.arch.outputs.version }}-${{ steps.arch.outputs.arch }}-${{ steps.arch.outputs.digest }}
|
||||
- name: Download and install osv-scanner
|
||||
if: steps.cache-osv.outputs.cache-hit != 'true'
|
||||
shell: bash
|
||||
run: |
|
||||
set -euo pipefail
|
||||
|
||||
VERSION="${{ steps.arch.outputs.version }}"
|
||||
ARCH="${{ steps.arch.outputs.arch }}"
|
||||
EXPECTED_DIGEST="${{ steps.arch.outputs.digest }}"
|
||||
DEST="/usr/local/bin/osv-scanner"
|
||||
|
||||
mkdir -p /usr/local/bin
|
||||
|
||||
curl -fsSL "https://github.com/google/osv-scanner/releases/download/${VERSION}/osv-scanner_linux_${ARCH}" -o "${DEST}"
|
||||
|
||||
ACTUAL_DIGEST=$(sha256sum "${DEST}" | awk '{print $1}')
|
||||
if [ "${ACTUAL_DIGEST}" != "${EXPECTED_DIGEST}" ]; then
|
||||
echo "Digest mismatch for osv-scanner ${VERSION} (linux_${ARCH})" >&2
|
||||
echo " expected: ${EXPECTED_DIGEST}" >&2
|
||||
echo " actual: ${ACTUAL_DIGEST}" >&2
|
||||
rm -f "${DEST}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
chmod +x "${DEST}"
|
||||
echo "Verified osv-scanner ${VERSION} (linux_${ARCH}) digest ${ACTUAL_DIGEST}"
|
||||
|
||||
- name: Add osv-scanner to PATH
|
||||
shell: bash
|
||||
run: |
|
||||
echo "/usr/local/bin" >> "$GITHUB_PATH"
|
||||
Reference in New Issue
Block a user