-
Notifications
You must be signed in to change notification settings - Fork 14
83 lines (71 loc) · 2.63 KB
/
scan_vuln_deps.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
name: Scan vulnerable dependencies
on:
workflow_dispatch:
push:
branches:
- '**'
jobs:
scan-vuln-deps-in-repo:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v3
- name: Set myvars
id: myvars
run: |
branchname=$(echo ${GITHUB_REF#refs/heads/} | tr '/' '-' )
dateinsecs=$(date +%s)
githashshort=$(git rev-parse --short HEAD)
echo "BRANCH_NAME=$branchname" >> $GITHUB_OUTPUT
echo "GIT_HASH_SHORT=$githashshort" >> $GITHUB_OUTPUT
echo "DATE_IN_SECS=$dateinsecs" >> $GITHUB_OUTPUT
## The 'fs' scan mode requires *.lock files in order to scan for vulns
## and to collect license info of packages you should run npm install before.
- name: Setup NodeJS before scanning with Trivy
uses: actions/setup-node@v3
with:
node-version: 18.x
cache: 'yarn'
- name: Install deps before scanning with Trivy
run: yarn install
# run: yarn install --frozen-lockfile
# - name: Build subpackages
# run: yarn run build
- name: Scan in Repo (html)
uses: aquasecurity/trivy-action@master
if: success() || failure()
with:
scan-type: fs
scanners: vuln,secret,config
scan-ref: .
format: template
template: '@/contrib/html.tpl'
output: trivy-results-repo-${{ steps.myvars.outputs.GIT_HASH_SHORT }}.html
env:
TRIVY_USERNAME: ${{ github.repository_owner }}
TRIVY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
- name: Scan in Repo (sarif)
uses: aquasecurity/trivy-action@master
if: success() || failure()
with:
scan-type: fs
scanners: vuln,secret,config
scan-ref: .
format: sarif
output: trivy-results-repo-${{ steps.myvars.outputs.GIT_HASH_SHORT }}.sarif
env:
TRIVY_USERNAME: ${{ github.repository_owner }}
TRIVY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
- name: Publish Repo Scan Results as Artifact
uses: actions/upload-artifact@v3
if: success() || failure()
with:
name: trivy-results-repo-${{ steps.myvars.outputs.DATE_IN_SECS }}
path: trivy-results-repo-${{ steps.myvars.outputs.GIT_HASH_SHORT }}.*
- name: Load Repo Scan Results (sarif) to Github
uses: github/codeql-action/upload-sarif@v2
if: always()
#if: false ## false = bypass
with:
sarif_file: trivy-results-repo-${{ steps.myvars.outputs.GIT_HASH_SHORT }}.sarif
category: vulns-in-repo