Skip to content

Commit

Permalink
Cache TrivyDB for 24hrs
Browse files Browse the repository at this point in the history
* Combined both docker workflows into one because they do the same thing
  • Loading branch information
DrizzlyOwl committed Dec 2, 2024
1 parent 5430458 commit 693f3f1
Show file tree
Hide file tree
Showing 2 changed files with 20 additions and 28 deletions.
25 changes: 0 additions & 25 deletions .github/workflows/docker-build.yml

This file was deleted.

23 changes: 20 additions & 3 deletions .github/workflows/docker-test.yml
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
name: Docker test
name: Run Docker tests

on:
pull_request:
push:
branches: main

Expand All @@ -12,6 +13,8 @@ jobs:
steps:
- name: Checkout code
uses: actions/checkout@v4
with:
fetch-depth: 0

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
Expand All @@ -23,9 +26,20 @@ jobs:
secrets: github_token=${{ secrets.GITHUB_TOKEN }}
load: true
cache-from: type=gha
cache-to: type=gha
push: false

- name: Get TrivyDB data ## To avoid the trivy-db becoming outdated, we save the cache for one day
id: date
run: echo "date=$(date +%Y-%m-%d)" >> $GITHUB_OUTPUT

- name: Restore TrivyDB cache
uses: actions/cache@v4
with:
path: cache/db
key: trivy-cache-${{ steps.date.outputs.date }}
restore-keys:
trivy-cache-

- name: Export docker image as tar
run: docker save -o ${{ github.ref_name }}.tar ${{ steps.build.outputs.imageid }}

Expand All @@ -39,9 +53,12 @@ jobs:
ignore-unfixed: true
severity: 'CRITICAL,HIGH'
github-pat: ${{ secrets.GITHUB_TOKEN }}
cache-dir: "./cache"

- name: Change permissions for trivy.db
run: sudo chmod 0644 ./cache/db/trivy.db

- name: Upload scan results to GitHub Security
uses: github/codeql-action/upload-sarif@v2
if: always()
with:
sarif_file: 'trivy-results.sarif'

0 comments on commit 693f3f1

Please sign in to comment.