update trivy (#19) #17
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # This workflow: | |
| # * Builds, tests, and scans all images | |
| # * (optionally) pushes the images to ACR | |
| # | |
| # | |
| # This workflow triggers on: | |
| # * a push to master | |
| # * any create/synchronize to a PR (eg: any time you push an update to a PR). | |
| # | |
| # Image build/test/scan will run on any of the above events. | |
| # Image push will run only if: | |
| # * this is a push to master | |
| # * if the PR triggering this event has the label 'auto-deploy' | |
| # | |
| # To configure this workflow: | |
| # | |
| # 1. Set up the following secrets in your workspace: | |
| # a. REGISTRY_USERNAME with ACR username | |
| # b. REGISTRY_PASSWORD with ACR Password | |
| # c. AZURE_CREDENTIALS with the output of `az ad sp create-for-rbac --sdk-auth` | |
| # d. DEV_REGISTRY_USERNAME with the DEV ACR username | |
| # e. DEV_REGISTRY_PASSWORD with the DEV ACR Password | |
| # | |
| # 2. Change the values for the REGISTRY_NAME | |
| name: build_and_push | |
| on: | |
| push: | |
| branches: | |
| - 'master' | |
| jobs: | |
| # Any checks that run pre-build | |
| pre-build-checks: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@master | |
| build-push: | |
| env: | |
| REGISTRY_NAME: k8scc01covidacr | |
| LOCAL_REPO: localhost:5000 | |
| TRIVY_VERSION: "v0.57.0" | |
| TRIVY_DATABASES: '"ghcr.io/aquasecurity/trivy-db:2","public.ecr.aws/aquasecurity/trivy-db"' | |
| TRIVY_JAVA_DATABASES: '"ghcr.io/aquasecurity/trivy-java-db:1","public.ecr.aws/aquasecurity/trivy-java-db"' | |
| TRIVY_MAX_RETRIES: 5 | |
| TRIVY_RETRY_DELAY: 20 | |
| needs: pre-build-checks | |
| runs-on: ubuntu-latest | |
| services: | |
| registry: | |
| image: registry:2 | |
| ports: | |
| - 5000:5000 | |
| steps: | |
| - uses: actions/checkout@master | |
| # Connect to Azure Container registry (ACR) | |
| - uses: azure/docker-login@v1 | |
| with: | |
| login-server: ${{ env.REGISTRY_NAME }}.azurecr.io | |
| username: ${{ secrets.REGISTRY_USERNAME }} | |
| password: ${{ secrets.REGISTRY_PASSWORD }} | |
| - name: Build image | |
| id: build-image | |
| run: | | |
| docker build -f Dockerfile -t localhost:5000/filer-sidecar:latest . | |
| docker push localhost:5000/filer-sidecar:latest | |
| docker image prune | |
| # Scan image for vulnerabilities | |
| - name: Aqua Security Trivy image scan | |
| run: | | |
| printf ${{ secrets.CVE_ALLOWLIST }} > .trivyignore | |
| curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin ${{ env.TRIVY_VERSION }} | |
| set +e # Lets trivy return an error without it being fatal | |
| for ((i=0; i<${{ env.TRIVY_MAX_RETRIES }}; i++)); do | |
| echo "Attempt $((i + 1)) of ${{ env.TRIVY_MAX_RETRIES }}..." | |
| trivy image \ | |
| --db-repository ${{ env.TRIVY_DATABASES }} \ | |
| --java-db-repository ${{ env.TRIVY_JAVA_DATABASES }} \ | |
| localhost:5000/filer-sidecar:latest \ | |
| --exit-code 10 --timeout=20m --scanners vuln --severity CRITICAL \ | |
| --skip-dirs /usr/local/SASHome | |
| EXIT_CODE=$? | |
| if [[ $EXIT_CODE -eq 0 ]]; then | |
| echo "Trivy scan completed successfully." | |
| exit 0 | |
| elif [[ $EXIT_CODE -eq 10 ]]; then | |
| echo "Trivy scan completed successfully. Some vulnerabilities were found." | |
| exit 0 | |
| elif [[ $i -lt $(( ${{ env.TRIVY_MAX_RETRIES }} - 1)) ]]; then | |
| echo "Encountered unexpected error. Retrying in ${{ env.TRIVY_RETRY_DELAY }} seconds..." | |
| sleep ${{ env.TRIVY_RETRY_DELAY }} | |
| else | |
| echo "Unexpected error persists after ${{ env.TRIVY_MAX_RETRIES }} attempts. Exiting." | |
| exit 1 | |
| fi | |
| done | |
| - name: Push image to registry | |
| run: | | |
| docker pull localhost:5000/filer-sidecar:latest | |
| docker tag localhost:5000/filer-sidecar:latest ${{ env.REGISTRY_NAME }}.azurecr.io/filer-sidecar:${{ github.sha }} | |
| docker push ${{ env.REGISTRY_NAME }}.azurecr.io/filer-sidecar:${{ github.sha }} |