t.behrendt
81eda53a59
CD / Release (push) Successful in 4s
As part of our safety initiative, I'm refactoring setup-db to run trivy inside a Docker container with minimal privileges, reducing leakage of secrets, files, etc. to a minimum in case the dependency gets compromised. Additionally, we are always pinning the trivy docker image to a fixed digest. Renovate has been configured to keep the Trivy image version up-to-date. Reviewed-on: #54 Reviewed-by: branch-buddy <branch-buddy@t00n.de> Co-authored-by: Timo Behrendt <t.behrendt@t00n.de> Co-committed-by: Timo Behrendt <t.behrendt@t00n.de>
57 lines
1.9 KiB
YAML
57 lines
1.9 KiB
YAML
name: "Setup Trivy DB"
|
|
description: "Setup the trivy database, restoring from cache if available"
|
|
author: "Timo Behrendt <t.behrendt@t00n.de"
|
|
branding:
|
|
icon: "database"
|
|
color: "blue"
|
|
|
|
inputs:
|
|
cache-dir:
|
|
description: "Path to the Trivy cache directory (default: ${{runner.temp}}/trivy)"
|
|
required: false
|
|
default: "${{ runner.temp }}/trivy"
|
|
trivy-version:
|
|
description: "Trivy docker image version to use (full image reference including digest is recommended)"
|
|
required: false
|
|
default: "ghcr.io/aquasecurity/trivy:0.69.3@sha256:bcc376de8d77cfe086a917230e818dc9f8528e3c852f7b1aff648949b6258d1c"
|
|
|
|
outputs:
|
|
cache-dir:
|
|
description: "Path to the Trivy cache directory"
|
|
value: ${{ inputs.cache-dir }}
|
|
|
|
runs:
|
|
using: "composite"
|
|
steps:
|
|
- id: current-date
|
|
shell: bash
|
|
run: |
|
|
echo "current-date=$(date +%Y-%m-%d)" >> $GITHUB_OUTPUT
|
|
- id: restore-db
|
|
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5
|
|
with:
|
|
path: ${{ inputs.cache-dir }}
|
|
key: trivy-db-${{ steps.current-date.outputs.current-date }}
|
|
restore-keys: |
|
|
trivy-db-${{ steps.current-date.outputs.current-date }}
|
|
- if: steps.restore-db.outputs.cache-hit != 'true'
|
|
shell: bash
|
|
run: |
|
|
docker run --rm \
|
|
--name trivy-db-download \
|
|
--user "$(id -u):$(id -g)" \
|
|
--read-only \
|
|
--env-file /dev/null \
|
|
--cap-drop ALL \
|
|
--pids-limit 64 \
|
|
--memory=512m \
|
|
--memory-swap=512m \
|
|
--cpus=1 \
|
|
--ipc private \
|
|
--cgroupns private \
|
|
--security-opt no-new-privileges \
|
|
--security-opt apparmor=docker-default \
|
|
--tmpfs /tmp:rw,noexec,nosuid,nodev,size=1g \
|
|
--mount type=bind,src=${{ inputs.cache-dir }},dst=/cache \
|
|
${{ inputs.trivy-version }} fs --download-db-only --cache-dir /cache
|