From 520cd20ba7789ba1e3355879341d0b7ba74d49ad Mon Sep 17 00:00:00 2001 From: Inkvi Date: Thu, 30 May 2024 14:18:07 -0700 Subject: [PATCH] Add vulnerability scanning --- .github/workflows/docker-publish.yml | 10 ++++++++++ .github/workflows/vuln-scan.yml | 25 +++++++++++++++++++++++++ 2 files changed, 35 insertions(+) create mode 100644 .github/workflows/vuln-scan.yml diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index af7c73f..ecbaaf3 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -57,3 +57,13 @@ jobs: labels: ${{ steps.meta.outputs.labels }} cache-from: type=registry,ref=${{ env.IMAGE_NAME }}:buildcache cache-to: type=registry,ref=${{ env.IMAGE_NAME }}:buildcache,mode=max + + - name: Run Trivy vulnerability scanner + uses: aquasecurity/trivy-action@0.21.0 + with: + image-ref: ${{ steps.meta.outputs.tags }} + format: 'table' + exit-code: '1' + ignore-unfixed: true + vuln-type: 'os,library' + severity: 'CRITICAL,HIGH' diff --git a/.github/workflows/vuln-scan.yml b/.github/workflows/vuln-scan.yml new file mode 100644 index 0000000..8fa8202 --- /dev/null +++ b/.github/workflows/vuln-scan.yml @@ -0,0 +1,25 @@ +name: build +on: + workflow_dispatch: + pull_request: +jobs: + signer: + name: Build and Scan Signer + runs-on: ubuntu-22.04 + steps: + - name: Checkout code + uses: actions/checkout@v3 + + - name: Build an image + run: | + docker build -t signer . + + - name: Peptide vulnerability scan + uses: aquasecurity/trivy-action@0.21.0 + with: + image-ref: 'signer' + format: 'table' + exit-code: '1' + ignore-unfixed: true + vuln-type: 'os,library' + severity: 'CRITICAL,HIGH' \ No newline at end of file