|
|
|
|
@@ -1,143 +0,0 @@
|
|
|
|
|
name: Run TAS
|
|
|
|
|
|
|
|
|
|
on:
|
|
|
|
|
workflow_call:
|
|
|
|
|
inputs:
|
|
|
|
|
scan-config:
|
|
|
|
|
description: "Scan the configuration files"
|
|
|
|
|
required: false
|
|
|
|
|
default: false
|
|
|
|
|
type: boolean
|
|
|
|
|
image-scan-files:
|
|
|
|
|
description: "List of files to scan for images"
|
|
|
|
|
required: false
|
|
|
|
|
default: ""
|
|
|
|
|
type: string
|
|
|
|
|
pre-pull-images:
|
|
|
|
|
description: "Pre-pull the images"
|
|
|
|
|
required: false
|
|
|
|
|
default: false
|
|
|
|
|
type: boolean
|
|
|
|
|
trivy-server:
|
|
|
|
|
description: "Trivy server to use"
|
|
|
|
|
required: false
|
|
|
|
|
default: "https://trivy.gitea.t00n.de"
|
|
|
|
|
type: string
|
|
|
|
|
tas-base-url:
|
|
|
|
|
description: "TAS base URL"
|
|
|
|
|
required: false
|
|
|
|
|
default: "https://tas.gitea.t00n.de"
|
|
|
|
|
type: string
|
|
|
|
|
repository-name:
|
|
|
|
|
description: "Repository name"
|
|
|
|
|
required: true
|
|
|
|
|
type: string
|
|
|
|
|
branch-name:
|
|
|
|
|
description: "Branch name"
|
|
|
|
|
required: true
|
|
|
|
|
type: string
|
|
|
|
|
repository-owner:
|
|
|
|
|
description: "Repository owner"
|
|
|
|
|
required: true
|
|
|
|
|
type: string
|
|
|
|
|
|
|
|
|
|
jobs:
|
|
|
|
|
config-scan:
|
|
|
|
|
runs-on: ubuntu-latest
|
|
|
|
|
if: inputs.scan-config == true
|
|
|
|
|
steps:
|
|
|
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
|
|
|
- uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-trivy@1.4.0
|
|
|
|
|
- uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@1.4.0
|
|
|
|
|
- run: |
|
|
|
|
|
trivy config --cache-dir "$TRIVY_CACHE_DIR" --exit-code 0 --format sarif --output config-sarif.json .
|
|
|
|
|
env:
|
|
|
|
|
TRIVY_CACHE_DIR: ${{ runner.temp }}/trivy
|
|
|
|
|
- uses: https://github.com/christopherHX/gitea-upload-artifact@v4
|
|
|
|
|
with:
|
|
|
|
|
name: config-sarif
|
|
|
|
|
path: config-sarif.json
|
|
|
|
|
|
|
|
|
|
image-scan:
|
|
|
|
|
runs-on: ubuntu-latest
|
|
|
|
|
if: inputs.image-scan-files != ""
|
|
|
|
|
steps:
|
|
|
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
|
|
|
- uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-trivy@1.4.0
|
|
|
|
|
- uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/setup-db@1.4.0
|
|
|
|
|
- name: Get Images From Files
|
|
|
|
|
id: get-images
|
|
|
|
|
uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/get-images-from-files@1.4.0
|
|
|
|
|
with:
|
|
|
|
|
files: ${{ inputs.image-scan-files }}
|
|
|
|
|
- name: Pull images
|
|
|
|
|
if: inputs.pre-pull-images == true
|
|
|
|
|
run: |
|
|
|
|
|
set -e
|
|
|
|
|
images='${{ steps.get-images.outputs.images }}'
|
|
|
|
|
for img in $(echo "$images" | jq -r '.[]'); do
|
|
|
|
|
docker pull "$img"
|
|
|
|
|
done
|
|
|
|
|
- name: Scan images
|
|
|
|
|
id: scan
|
|
|
|
|
run: |
|
|
|
|
|
set -e
|
|
|
|
|
images='${{ steps.get-images.outputs.images }}'
|
|
|
|
|
count=$(echo "$images" | jq 'length')
|
|
|
|
|
if [ "$count" -eq 0 ]; then
|
|
|
|
|
echo "No images found"
|
|
|
|
|
exit 1
|
|
|
|
|
fi
|
|
|
|
|
i=0
|
|
|
|
|
for img in $(echo "$images" | jq -r '.[]'); do
|
|
|
|
|
trivy image --cache-dir "$TRIVY_CACHE_DIR" --server ${{ inputs.trivy-server }} --exit-code 0 --scanners vuln --format sarif --output "sarif-image-${i}.json" "$img"
|
|
|
|
|
i=$((i + 1))
|
|
|
|
|
done
|
|
|
|
|
{
|
|
|
|
|
echo "files<<EOF"
|
|
|
|
|
for j in $(seq 0 $((i - 1))); do echo " - sarif-image-${j}.json"; done
|
|
|
|
|
echo "EOF"
|
|
|
|
|
} >> $GITHUB_OUTPUT
|
|
|
|
|
echo "count=$i" >> $GITHUB_OUTPUT
|
|
|
|
|
env:
|
|
|
|
|
TRIVY_CACHE_DIR: ${{ runner.temp }}/trivy
|
|
|
|
|
- name: Merge image SARIF files
|
|
|
|
|
if: steps.scan.outputs.count != '0'
|
|
|
|
|
uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/merge-sarif-files@1.4.1-rc-e78ced192dbed9db9a04540a2a27c75924f1d5ea
|
|
|
|
|
with:
|
|
|
|
|
files: ${{ steps.scan.outputs.files }}
|
|
|
|
|
output-file: image-sarif.json
|
|
|
|
|
- uses: https://github.com/ChristopherHX/gitea-upload-artifact@v4
|
|
|
|
|
with:
|
|
|
|
|
name: image-sarif
|
|
|
|
|
path: image-sarif.json
|
|
|
|
|
|
|
|
|
|
merge-and-upload:
|
|
|
|
|
runs-on: ubuntu-latest
|
|
|
|
|
needs: [config-scan, image-scan]
|
|
|
|
|
if: inputs.scan-config == true || inputs.image-scan-files != ""
|
|
|
|
|
steps:
|
|
|
|
|
- name: Download config SARIF
|
|
|
|
|
uses: https://github.com/ChristopherHX/gitea-download-artifact@v4
|
|
|
|
|
with:
|
|
|
|
|
name: config-sarif
|
|
|
|
|
path: config-sarif-artifact
|
|
|
|
|
- name: Download image SARIF
|
|
|
|
|
uses: https://github.com/ChristopherHX/gitea-download-artifact@v4
|
|
|
|
|
with:
|
|
|
|
|
name: image-sarif
|
|
|
|
|
path: image-sarif-artifact
|
|
|
|
|
- name: Merge SARIF files
|
|
|
|
|
uses: https://gitea.t000-n.de/t.behrendt/trivy-actions/merge-sarif-files@1.4.1-rc-e78ced192dbed9db9a04540a2a27c75924f1d5ea
|
|
|
|
|
with:
|
|
|
|
|
files: |
|
|
|
|
|
- config-sarif-artifact/config-sarif.json
|
|
|
|
|
- image-sarif-artifact/image-sarif.json
|
|
|
|
|
output-file: sarif.json
|
|
|
|
|
- uses: https://gitea.t000-n.de/t.behrendt/tas-actions/tas-upload-sarif@0.0.2
|
|
|
|
|
with:
|
|
|
|
|
tas-base-url: ${{ inputs.tas-base-url }}
|
|
|
|
|
sarif-file: sarif.json
|
|
|
|
|
owner: ${{ inputs.repository-owner }}
|
|
|
|
|
repo: ${{ inputs.repository-name }}
|
|
|
|
|
branch: ${{ inputs.branch-name }}
|
