103 lines
3.2 KiB
YAML
103 lines
3.2 KiB
YAML
name: "Trivy Report"
|
|
description: "Generate a vulnerability report from a Trivy scan in a GitHub PR in form of comments"
|
|
author: "Timo Behrendt"
|
|
branding:
|
|
icon: "shield"
|
|
color: "blue"
|
|
|
|
inputs:
|
|
version:
|
|
description: "The version of the Trivy report to generate a report from"
|
|
required: false
|
|
default: "0.1.1"
|
|
architecture:
|
|
description: "The architecture of the Trivy report to generate a report from"
|
|
required: false
|
|
default: "amd64"
|
|
url:
|
|
description: "The URL of the Gitea instance"
|
|
required: false
|
|
default: "https://gitea.t000-n.de"
|
|
username:
|
|
description: "The username to use for authentication and will be the creator of the comments/issues"
|
|
required: true
|
|
token:
|
|
description: "The token to use for authentication"
|
|
required: true
|
|
owner:
|
|
description: "The owner of the repository"
|
|
required: true
|
|
repo:
|
|
description: "The repository name"
|
|
required: true
|
|
pr:
|
|
description: "The pull request number"
|
|
required: true
|
|
output:
|
|
description: "The output type. Currently only review is supported"
|
|
required: false
|
|
default: "review"
|
|
filter:
|
|
description: "The filter to use for the report. Can be either 'pr-changes' to only include new vulnerabilities that got introduced through the PR or 'all' to include all vulnerabilities"
|
|
required: false
|
|
default: "pr-changes"
|
|
report:
|
|
description: "The path to the report fiel generated by Trivy. Needs to be standard 'json' output of Trivy's vulnerability reportt"
|
|
required: false
|
|
default: "report.json"
|
|
|
|
runs:
|
|
using: "composite"
|
|
steps:
|
|
- name: Cache Trivy-Reporter binary
|
|
id: cache-trivy-reporter
|
|
uses: actions/cache@v4
|
|
with:
|
|
path: /usr/local/bin/trivy-reporter-linux-${{ inputs.architecture }}
|
|
key: trivy-reporter-${{ inputs.version }}-${{ inputs.architecture }}
|
|
restore-keys: |
|
|
trivy-reporter-${{ inputs.version }}-${{ inputs.architecture }}-
|
|
trivy-reporter-${{ inputs.version }}-
|
|
- name: Validate inputs
|
|
shell: bash
|
|
run: |
|
|
set -e
|
|
|
|
ARCH="${{ inputs.architecture }}"
|
|
|
|
# Validate architecture
|
|
case "$ARCH" in
|
|
amd64|arm64)
|
|
;;
|
|
*)
|
|
echo "Error: Unsupported architecture '$ARCH'. Supported: amd64, arm64"
|
|
exit 1
|
|
;;
|
|
esac
|
|
- name: Download and install Trivy-Reporter
|
|
if: steps.cache-trivy-reporter.outputs.cache-hit != 'true'
|
|
shell: bash
|
|
run: |
|
|
set -e
|
|
|
|
VERSION="${{ inputs.version }}"
|
|
ARCH="${{ inputs.architecture }}"
|
|
|
|
mkdir -p /usr/local/bin
|
|
|
|
curl -sL "https://gitea.t000-n.de/t.behrendt/trivy-reporter/releases/download/${VERSION}/trivy-reporter-linux-${ARCH}" -o /usr/local/bin/trivy-reporter-linux-${ARCH}
|
|
- name: Create Trivy Report
|
|
shell: bash
|
|
run: |
|
|
trivy-reporter-linux-${{ inputs.architecture }} \
|
|
-platform "gitea"
|
|
-url ${{ inputs.url }}
|
|
-username ${{ inputs.username }}
|
|
-token ${{ inputs.token }}
|
|
-owner ${{ inputs.owner }}
|
|
-repo ${{ inputs.repo }}
|
|
-pr ${{ inputs.pr }}
|
|
-output "${{ inputs.output }}"
|
|
-filter "${{ inputs.filter }}"
|
|
-report "${{ inputs.report }}"
|