also mirror checks

.github/workflows/build-images-from-branch.yml

@@ -127,13 +127,16 @@ jobs:
       matrix:
         service: ${{ fromJSON(needs.base.outputs.services) }}
     steps:
+      - uses: actions/checkout@v4
+
       - name: Run Trivy vulnerability scanner
         uses: aquasecurity/[email protected]
         with:
           image-ref: 'opencrvs/ocrvs-${{ matrix.service }}:${{ github.event.pull_request.base.ref }}'
           trivy-config: trivy.yaml
           format: 'sarif'
           output: './trivy-results-base.sarif'
+          exit-code: '0'
 
       - name: Run Trivy vulnerability scanner
         uses: aquasecurity/[email protected]
@@ -142,6 +145,7 @@ jobs:
           trivy-config: trivy.yaml
           format: 'sarif'
           output: './trivy-results-branch.sarif'
+          exit-code: '0'
 
       - name: Remove lines that are always expected to be different
         run: |

.github/workflows/mirror-trivy-db.yml

@@ -73,3 +73,6 @@ jobs:
 
       - name: Mirror trivy-java-db to GHCR
         run: ./mirror-image.sh docker://ghcr.io/aquasecurity/trivy-java-db:1 docker://ghcr.io/${{ github.repository_owner }}/trivy-java-db:1 ${{ env.RETRIES }}
+
+      - name: Mirror trivy-checks to GHCR
+        run: ./mirror-image.sh docker://ghcr.io/aquasecurity/trivy-checks:1 docker://ghcr.io/${{ github.repository_owner }}/trivy-checks:1 ${{ env.RETRIES }}

.github/workflows/security-scans.yml

@@ -48,32 +48,28 @@ jobs:
 
       - name: Run Trivy vulnerability scanner in fs mode
         uses: aquasecurity/[email protected]
-        env:
-          TRIVY_DB_REPOSITORY: 'ghcr.io/opencrvs/trivy-db'
-          TRIVY_JAVA_DB_REPOSITORY: 'ghcr.io/opencrvs/trivy-java-db'
         with:
           scan-type: 'fs'
           scan-ref: 'base'
-          trivy-config: ./base/trivy.yaml
+          trivy-config: ./branch/trivy.yaml
           format: 'sarif'
           output: './trivy-results-base.sarif'
+          exit-code: '0'
 
       - name: Run Trivy vulnerability scanner in fs mode
         uses: aquasecurity/[email protected]
-        env:
-          TRIVY_DB_REPOSITORY: 'ghcr.io/opencrvs/trivy-db'
-          TRIVY_JAVA_DB_REPOSITORY: 'ghcr.io/opencrvs/trivy-java-db'
         with:
           scan-type: 'fs'
           scan-ref: 'branch'
           trivy-config: ./branch/trivy.yaml
           format: 'sarif'
           output: './trivy-results-branch.sarif'
+          exit-code: '0'
 
       - name: Remove lines that are always expected to be different
         run: |
-          sed -i '/"uri": "file:\/\/\/github\/workspace\/base\//d' ${{ github.workspace }}/trivy-results-base.sarif
-          sed -i '/"uri": "file:\/\/\/github\/workspace\/branch\//d' ${{ github.workspace }}/trivy-results-branch.sarif
+          sed -i '/"uri": "file:\/\/\/home\/runner\/work\/opencrvs-core\/opencrvs-core\/base\/"/d' ./trivy-results-base.sarif
+          sed -i '/"uri": "file:\/\/\/home\/runner\/work\/opencrvs-core\/opencrvs-core\/branch\/"/d' ./trivy-results-branch.sarif
 
       - name: Diff Trivy results
         run: diff -u ./trivy-results-base.sarif ./trivy-results-branch.sarif

trivy.yaml

@@ -20,12 +20,16 @@ scan:
     - sequence-diagrams
     - usr/local/share/.cache/yarn/v6/
     - home/node/.cache/yarn/v6
-  skip-files:
-    - Dockerfile.dockerignore
-    - packages/*/Dockerfile.dockerignore
   scanners:
     - vuln
     - misconfig
 ignorefile: .trivyignore.yaml
 vulnerability:
   ignore-unfixed: true
+db:
+  repository: 'ghcr.io/opencrvs/trivy-db'
+java:
+  db:
+    repository: 'ghcr.io/opencrvs/trivy-java-db'
+policies-bundle:
+  repository: 'ghcr.io/opencrvs/trivy-checks'