Timo Behrendt
4b9138d8f8
All checks were successful
CD / Release (push) Successful in 22s
Reviewed-on: t.behrendt/trivy-workflows#2 Co-authored-by: Timo Behrendt <t.behrendt@t00n.de> Co-committed-by: Timo Behrendt <t.behrendt@t00n.de>
94 lines
3.8 KiB
Markdown
94 lines
3.8 KiB
Markdown
# Trivy Workflows
|
|
|
|
## Run Trivy Scan (reusable workflow)
|
|
|
|
Reusable workflow that optionally runs Trivy config and/or image scan, merges the SARIF results, and exposes the merged file as an artifact. It does **not** upload to TAS; callers download the artifact and use it (e.g. with `tas-upload-sarif`).
|
|
|
|
**Workflow file:** [../.gitea/workflows/run-trivy-scan.yaml](../.gitea/workflows/run-trivy-scan.yaml)
|
|
|
|
## Usage
|
|
|
|
### Call from another workflow (same repo)
|
|
|
|
```yaml
|
|
jobs:
|
|
trivy:
|
|
uses: ./.gitea/workflows/run-trivy-scan.yaml
|
|
with:
|
|
scan-config: true
|
|
scan-images: true
|
|
image-scan-files: |
|
|
- k8s/31_deployment_redis.yaml
|
|
- k8s/32_deployment_gitea.yaml
|
|
- dockers/runner/compose.yaml
|
|
trivy-server-url: ${{ vars.TRIVY_SERVER_URL }}
|
|
use-sarif:
|
|
needs: trivy
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Download merged SARIF
|
|
uses: https://github.com/ChristopherHX/gitea-download-artifact@v4
|
|
with:
|
|
name: ${{ needs.trivy.outputs.merged-sarif-artifact }}
|
|
path: sarif
|
|
# Path to file: sarif/${{ needs.trivy.outputs.merged-sarif-path }}
|
|
# - uses: .../tas-upload-sarif@...
|
|
# with:
|
|
# sarif-file: sarif/${{ needs.trivy.outputs.merged-sarif-path }}
|
|
```
|
|
|
|
### Call from another repository
|
|
|
|
Use the **full workflow path** including `.gitea/workflows/` and the filename. Gitea does not accept a bare repo path like `.../trivy-actions/run-trivy-scan@ref`.
|
|
|
|
**With absolute URL:**
|
|
```yaml
|
|
jobs:
|
|
trivy:
|
|
uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/.gitea/workflows/run-trivy-scan.yaml@1.4.5
|
|
with:
|
|
ref: 1.4.5 # use same ref as in 'uses' so actions load from trivy-actions
|
|
scan-config: true
|
|
scan-images: true
|
|
image-scan-files: |
|
|
- k8s/31_deployment_redis.yaml
|
|
trivy-server-url: ${{ vars.TRIVY_SERVER_URL }}
|
|
```
|
|
|
|
**With owner/repo path** (same server as the caller):
|
|
```yaml
|
|
jobs:
|
|
trivy:
|
|
uses: t.behrendt/trivy-actions/.gitea/workflows/run-trivy-scan.yaml@1.4.5
|
|
with:
|
|
ref: 1.4.5 # use same ref as in 'uses'
|
|
scan-config: true
|
|
scan-images: true
|
|
image-scan-files: |
|
|
- k8s/31_deployment_redis.yaml
|
|
```
|
|
|
|
When calling from another repo, pass **`ref`** with the same ref as in the workflow path (e.g. `@1.4.5` or commit SHA). The workflow checks out trivy-actions at that ref into `trivy-actions/` and then uses the actions from that checkout (e.g. `./trivy-actions/setup-trivy`).
|
|
|
|
### Inputs
|
|
|
|
| Input | Type | Default | Description |
|
|
| ------------------- | ------- | ------- | ----------- |
|
|
| `scan-config` | boolean | false | Run Trivy config scan on the repository root. |
|
|
| `scan-images` | boolean | false | Run Trivy image scan on images from `image-scan-files`. |
|
|
| `image-scan-files` | string | "" | YAML list of files to extract container images from. |
|
|
| `trivy-server-url` | string | "" | Optional Trivy server URL for image scan. |
|
|
| `ref` | string | "main" | Git ref to checkout (branch, tag, or SHA); use the same ref as in the workflow path when calling from another repo. |
|
|
| `repository-url` | string | "https://gitea.t000-n.de/t.behrendt/trivy-actions.git" | Clone URL for trivy-actions; for private repos use a URL with token or SSH. |
|
|
|
|
At least one of `scan-config` or `scan-images` must be true. If `scan-images` is true, set `image-scan-files`.
|
|
|
|
### Outputs
|
|
|
|
| Output | Description |
|
|
| ------------------------ | ----------- |
|
|
| `merged-sarif-artifact` | Artifact name to pass to `download-artifact` (e.g. `merged-sarif`). |
|
|
| `merged-sarif-path` | Path to the file inside that artifact (e.g. `merged-sarif.json`). |
|
|
|
|
After downloading the artifact, the merged SARIF file is at `<download-path>/${{ needs.<job>.outputs.merged-sarif-path }}`.
|