From a4ca7501309212344a33ab66da7fa981e185f416 Mon Sep 17 00:00:00 2001 From: amberjblue Date: Thu, 14 Aug 2025 09:17:23 -0400 Subject: [PATCH 1/4] Add trivy fs scan --- .github/workflows/security-scan.yaml | 48 ++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+) create mode 100644 .github/workflows/security-scan.yaml diff --git a/.github/workflows/security-scan.yaml b/.github/workflows/security-scan.yaml new file mode 100644 index 0000000..7876bfa --- /dev/null +++ b/.github/workflows/security-scan.yaml @@ -0,0 +1,48 @@ +name: Security Scan + +on: + push: + branches: [main] + pull_request: + branches: [main] + workflow_dispatch: + +jobs: + trivy-fs: + name: Trivy + runs-on: ubuntu-latest + permissions: + contents: read + security-events: write + + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Run Trivy vulnerability scan + uses: aquasecurity/trivy-action@0.28.0 + with: + scan-type: fs + scan-ref: . + format: sarif + output: trivy-results.sarif + severity: CRITICAL,HIGH,MEDIUM,LOW + exit-code: 0 + ignore-unfixed: false + + - name: Check for critical and high vulnerabilities + uses: aquasecurity/trivy-action@0.28.0 + with: + scan-type: fs + scan-ref: . + format: table + severity: CRITICAL,HIGH + exit-code: 1 + ignore-unfixed: false + + - name: Upload SARIF to Security tab + if: always() + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: trivy-results.sarif + category: trivy-fs-security-scan From 9b72a17021f212cd1eef888d5051ca6ce3d09fca Mon Sep 17 00:00:00 2001 From: amberjblue Date: Thu, 14 Aug 2025 09:19:45 -0400 Subject: [PATCH 2/4] Update job name --- .github/workflows/security-scan.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/security-scan.yaml b/.github/workflows/security-scan.yaml index 7876bfa..b2ed792 100644 --- a/.github/workflows/security-scan.yaml +++ b/.github/workflows/security-scan.yaml @@ -9,7 +9,7 @@ on: jobs: trivy-fs: - name: Trivy + name: Trivy FS runs-on: ubuntu-latest permissions: contents: read From f0daf91b66c1a5f3b3a210b68a77553e76d67211 Mon Sep 17 00:00:00 2001 From: amberjblue Date: Tue, 19 Aug 2025 10:23:15 -0400 Subject: [PATCH 3/4] Update security-scan.yaml --- .github/workflows/security-scan.yaml | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/security-scan.yaml b/.github/workflows/security-scan.yaml index b2ed792..3aabe57 100644 --- a/.github/workflows/security-scan.yaml +++ b/.github/workflows/security-scan.yaml @@ -20,7 +20,7 @@ jobs: uses: actions/checkout@v4 - name: Run Trivy vulnerability scan - uses: aquasecurity/trivy-action@0.28.0 + uses: aquasecurity/trivy-action@77137e9dc3ab1b329b7c8a38c2eb7475850a14e8 with: scan-type: fs scan-ref: . @@ -30,15 +30,15 @@ jobs: exit-code: 0 ignore-unfixed: false - - name: Check for critical and high vulnerabilities - uses: aquasecurity/trivy-action@0.28.0 - with: - scan-type: fs - scan-ref: . - format: table - severity: CRITICAL,HIGH - exit-code: 1 - ignore-unfixed: false + # - name: Check for critical and high vulnerabilities + # uses: aquasecurity/trivy-action@77137e9dc3ab1b329b7c8a38c2eb7475850a14e8 + # with: + # scan-type: fs + # scan-ref: . + # format: table + # severity: CRITICAL,HIGH + # exit-code: 1 + # ignore-unfixed: false - name: Upload SARIF to Security tab if: always() From 34468aecb79ff737256723b5b2d71ada268d1e80 Mon Sep 17 00:00:00 2001 From: amberjblue Date: Tue, 19 Aug 2025 10:26:05 -0400 Subject: [PATCH 4/4] Update security-scan.yaml --- .github/workflows/security-scan.yaml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/security-scan.yaml b/.github/workflows/security-scan.yaml index 3aabe57..7bfdeae 100644 --- a/.github/workflows/security-scan.yaml +++ b/.github/workflows/security-scan.yaml @@ -30,15 +30,15 @@ jobs: exit-code: 0 ignore-unfixed: false - # - name: Check for critical and high vulnerabilities - # uses: aquasecurity/trivy-action@77137e9dc3ab1b329b7c8a38c2eb7475850a14e8 - # with: - # scan-type: fs - # scan-ref: . - # format: table - # severity: CRITICAL,HIGH - # exit-code: 1 - # ignore-unfixed: false + - name: Check for critical and high vulnerabilities + uses: aquasecurity/trivy-action@77137e9dc3ab1b329b7c8a38c2eb7475850a14e8 + with: + scan-type: fs + scan-ref: . + format: table + severity: CRITICAL,HIGH + exit-code: 1 + ignore-unfixed: false - name: Upload SARIF to Security tab if: always()