t.behrendt
954681c5af
CI / Test Merge SARIF Files (pull_request) Successful in 4s
CI / Test Setup DB (pull_request) Successful in 6s
CI / Test Get Images From Files (pull_request) Successful in 5s
CI / Test scan-image (pull_request) Failing after 6s
CI / Test scan-fs (pull_request) Failing after 1m14s
CI / Test scan-config (pull_request) Failing after 1m2s
61 lines
3.6 KiB
Markdown
61 lines
3.6 KiB
Markdown
# Trivy scan (misconfiguration)
|
||
|
||
Composite action that runs **`trivy config`** inside **Docker** with the same hardening style as [setup-db](../setup-db): read-only root filesystem, dropped capabilities, `no-new-privileges`, AppArmor `docker-default`, a private `tmpfs` on `/tmp`, and resource limits.
|
||
|
||
The directory you pass as **`scan-path`** is bind-mounted **read-only** at `/scan`. The vulnerability and policy cache from [setup-db](../setup-db) is mounted **read-only** at `/cache`. Your **`output-dir`** is mounted **read-write** at `/out`; the report is written as **`output-file`** inside that directory. The report format is always **SARIF** (`--format sarif`). Trivy is always run with **`--offline-scan`** (no API calls to resolve dependencies) and **`--exit-code 0`** (the step succeeds after writing the report even when findings are present).
|
||
|
||
**Misconfiguration scans do not need outbound network.** This action sets **`--network none`** so the container cannot reach the network. Rego check bundles are not fetched online (`--skip-check-update`); use a Trivy image that already includes the checks you need, or rely on the embedded defaults.
|
||
|
||
**Docker-in-Docker:** **`cache-dir`** and **`output-dir`** default under **`runner.temp`** so bind mounts work when the job runs in a container with DinD. **`scan-path`** must also be on the same shared volume the Docker daemon uses (often under your runner’s work/temp tree); see [setup-db](../setup-db) README.
|
||
|
||
## Prerequisites
|
||
|
||
- Docker on the runner.
|
||
- A populated Trivy cache at **`cache-dir`** (typically from the [setup-db](../setup-db) action).
|
||
|
||
## Usage
|
||
|
||
```yaml
|
||
- uses: actions/checkout@v4
|
||
- name: Setup Trivy DB cache
|
||
id: db
|
||
uses: ./setup-db
|
||
- name: Misconfiguration scan
|
||
id: scan
|
||
uses: ./scan-config
|
||
with:
|
||
scan-path: ${{ github.workspace }}
|
||
# On DinD, if bind mounts fail, use a path under ${{ runner.temp }} (or your runner’s shared work dir) instead.
|
||
cache-dir: ${{ steps.db.outputs.cache-dir }}
|
||
output-dir: ${{ runner.temp }}/trivy-reports
|
||
output-file: misconfig.sarif
|
||
- name: Upload report
|
||
uses: actions/upload-artifact@v4
|
||
with:
|
||
name: trivy-misconfig
|
||
path: ${{ steps.scan.outputs.output-path }}
|
||
```
|
||
|
||
## Inputs
|
||
|
||
| Input | Description | Required | Default |
|
||
| --------------- | --------------------------------------------------------------------------- | -------- | ------- |
|
||
| `scan-path` | Host directory to scan (mounted read-only at `/scan`) | Yes | — |
|
||
| `cache-dir` | Trivy cache directory (read-only at `/cache`; created if missing) | No | `${{ runner.temp }}/trivy` |
|
||
| `output-dir` | Report directory (read-write at `/out`; created if missing) | Yes | — |
|
||
| `output-file` | SARIF file name only (no `/`); created under `output-dir` | Yes | — |
|
||
| `trivy-version` | Trivy Docker image (digest pin recommended) | No | Same pin as `setup-db` / see `action.yaml` |
|
||
|
||
**`trivy-version` is optional.** Omit it to use the default image from `action.yaml`.
|
||
|
||
## Outputs
|
||
|
||
| Output | Description |
|
||
| -------------- | ------------------------------------ |
|
||
| `output-path` | Absolute path to the SARIF report on the host |
|
||
|
||
## Notes
|
||
|
||
- **`cache-dir`** and **`output-dir`** are created with `mkdir -p` if missing. **`scan-path`** must already exist and be bind-mountable (see DinD note above).
|
||
- The step still fails if Docker or the container exits non-zero before Trivy completes (e.g. mount or runtime errors).
|