|
|
|
|
@@ -42,8 +42,8 @@ jobs:
|
|
|
|
|
runs-on: ubuntu-latest
|
|
|
|
|
steps:
|
|
|
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
|
|
|
- uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-trivy@83a7cef9f19e3a5a30311839f99f83690a490cf8 # 1.4.5
|
|
|
|
|
- uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@83a7cef9f19e3a5a30311839f99f83690a490cf8 # 1.4.5
|
|
|
|
|
- uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-trivy@a6508d695d7bb6137f14372392d5c312c98225cf # 1.4.7
|
|
|
|
|
- uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@a6508d695d7bb6137f14372392d5c312c98225cf # 1.4.7
|
|
|
|
|
- run: |
|
|
|
|
|
trivy config --cache-dir "$TRIVY_CACHE_DIR" --exit-code 0 --format sarif --output config-sarif.json .
|
|
|
|
|
env:
|
|
|
|
|
@@ -58,11 +58,11 @@ jobs:
|
|
|
|
|
runs-on: ubuntu-latest
|
|
|
|
|
steps:
|
|
|
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
|
|
|
- uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-trivy@83a7cef9f19e3a5a30311839f99f83690a490cf8 # 1.4.5
|
|
|
|
|
- uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@83a7cef9f19e3a5a30311839f99f83690a490cf8 # 1.4.5
|
|
|
|
|
- uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-trivy@a6508d695d7bb6137f14372392d5c312c98225cf # 1.4.7
|
|
|
|
|
- uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@a6508d695d7bb6137f14372392d5c312c98225cf # 1.4.7
|
|
|
|
|
- name: Get images from files
|
|
|
|
|
id: get-images
|
|
|
|
|
uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/get-images-from-files@83a7cef9f19e3a5a30311839f99f83690a490cf8 # 1.4.5
|
|
|
|
|
uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/get-images-from-files@a6508d695d7bb6137f14372392d5c312c98225cf # 1.4.7
|
|
|
|
|
with:
|
|
|
|
|
files: ${{ inputs.image-scan-files }}
|
|
|
|
|
- name: Pull images
|
|
|
|
|
@@ -102,7 +102,7 @@ jobs:
|
|
|
|
|
TRIVY_CACHE_DIR: ${{ runner.temp }}/trivy
|
|
|
|
|
- name: Merge image SARIF files
|
|
|
|
|
if: steps.get-images.outputs.images != '[]' && steps.scan.outputs.count != '0'
|
|
|
|
|
uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/merge-sarif-files@83a7cef9f19e3a5a30311839f99f83690a490cf8 # 1.4.5
|
|
|
|
|
uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/merge-sarif-files@1.4.7
|
|
|
|
|
with:
|
|
|
|
|
files: ${{ steps.scan.outputs.files }}
|
|
|
|
|
output-file: image-sarif.json
|
|
|
|
|
@@ -120,8 +120,8 @@ jobs:
|
|
|
|
|
runs-on: ubuntu-latest
|
|
|
|
|
steps:
|
|
|
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
|
|
|
- uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-trivy@83a7cef9f19e3a5a30311839f99f83690a490cf8 # 1.4.5
|
|
|
|
|
- uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@83a7cef9f19e3a5a30311839f99f83690a490cf8 # 1.4.5
|
|
|
|
|
- uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-trivy@a6508d695d7bb6137f14372392d5c312c98225cf # 1.4.7
|
|
|
|
|
- uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@a6508d695d7bb6137f14372392d5c312c98225cf # 1.4.7
|
|
|
|
|
- run: |
|
|
|
|
|
server="${{ inputs.trivy-server-url }}"
|
|
|
|
|
args=(fs --cache-dir "$TRIVY_CACHE_DIR" --exit-code 0 --format sarif --output fs-sarif.json --scanners vuln .)
|
|
|
|
|
@@ -177,7 +177,7 @@ jobs:
|
|
|
|
|
echo "EOF" >> "$GITHUB_OUTPUT"
|
|
|
|
|
- name: Merge SARIF files
|
|
|
|
|
id: merge-step
|
|
|
|
|
uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/merge-sarif-files@83a7cef9f19e3a5a30311839f99f83690a490cf8 # 1.4.5
|
|
|
|
|
uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/merge-sarif-files@a6508d695d7bb6137f14372392d5c312c98225cf # 1.4.7
|
|
|
|
|
with:
|
|
|
|
|
files: ${{ steps.file-list.outputs.files }}
|
|
|
|
|
output-file: merged-sarif.json
|
|
|
|
|
|