mirror of
https://github.com/appleboy/drone-ssh.git
synced 2026-06-04 18:24:01 +08:00
appleboy
7a94dda076
- Add explicit permissions for contents, packages, and security-events to the Docker GitHub Actions workflow - Integrate Trivy vulnerability scanning and results upload into the Docker workflow - Add a dedicated GitHub Actions workflow for Trivy security scanning of both repository files and Docker images, with scheduled, push, and pull request triggers - Ensure Trivy SARIF results are uploaded to the GitHub Security tab after scans Signed-off-by: appleboy <appleboy.tw@gmail.com>
86 lines
2.1 KiB
YAML
86 lines
2.1 KiB
YAML
name: Trivy Security Scan
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- master
|
|
pull_request:
|
|
branches:
|
|
- master
|
|
schedule:
|
|
# Run daily at 00:00 UTC
|
|
- cron: "0 0 * * *"
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
security-events: write
|
|
|
|
jobs:
|
|
trivy-repo-scan:
|
|
name: Trivy Repository Scan
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Run Trivy vulnerability scanner (repo)
|
|
uses: aquasecurity/trivy-action@master
|
|
with:
|
|
scan-type: "fs"
|
|
scan-ref: "."
|
|
format: "sarif"
|
|
output: "trivy-repo-results.sarif"
|
|
severity: "CRITICAL,HIGH"
|
|
|
|
- name: Upload Trivy scan results to GitHub Security tab
|
|
uses: github/codeql-action/upload-sarif@v3
|
|
if: always()
|
|
with:
|
|
sarif_file: "trivy-repo-results.sarif"
|
|
|
|
trivy-image-scan:
|
|
name: Trivy Image Scan
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Setup go
|
|
uses: actions/setup-go@v5
|
|
with:
|
|
go-version-file: go.mod
|
|
check-latest: true
|
|
|
|
- name: Build binary
|
|
run: |
|
|
make build_linux_amd64
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v3
|
|
|
|
- name: Build Docker image for scanning
|
|
uses: docker/build-push-action@v6
|
|
with:
|
|
context: .
|
|
file: docker/Dockerfile
|
|
platforms: linux/amd64
|
|
push: false
|
|
load: true
|
|
tags: drone-ssh:scan
|
|
|
|
- name: Run Trivy vulnerability scanner (image)
|
|
uses: aquasecurity/trivy-action@master
|
|
with:
|
|
image-ref: "drone-ssh:scan"
|
|
format: "sarif"
|
|
output: "trivy-image-results.sarif"
|
|
severity: "CRITICAL,HIGH"
|
|
|
|
- name: Upload Trivy image scan results to GitHub Security tab
|
|
uses: github/codeql-action/upload-sarif@v3
|
|
if: always()
|
|
with:
|
|
sarif_file: "trivy-image-results.sarif"
|
|
category: "trivy-image"
|