Trivy #20
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Trivy | |
| # Scans the Docker image we publish to Docker Hub for OS-level CVEs (alpine | |
| # packages) and Go-binary CVEs. Different surface from govulncheck — that | |
| # one looks at source + go.mod, this one looks at the actual published | |
| # artifact. | |
| # | |
| # We scan both on PR (to catch a fresh CVE in a base image bump before | |
| # merge) and on schedule (to catch a newly-disclosed CVE in an unchanged | |
| # image). | |
| on: | |
| push: | |
| branches: [master] | |
| paths: | |
| - 'Dockerfile' | |
| - 'Makefile' | |
| - '.github/workflows/trivy.yml' | |
| pull_request: | |
| branches: [master] | |
| paths: | |
| - 'Dockerfile' | |
| - 'Makefile' | |
| - '.github/workflows/trivy.yml' | |
| schedule: | |
| - cron: '0 13 * * 5' | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| security-events: write | |
| jobs: | |
| image-scan: | |
| name: Image scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v6 | |
| - uses: actions/setup-go@v6 | |
| with: | |
| go-version: stable | |
| check-latest: true | |
| cache: true | |
| - name: Build linux binary (matches the production Dockerfile copy step) | |
| run: make build_linux | |
| - name: Build local Docker image for scanning | |
| run: docker build -t altair-trivy-scan:local -f ./Dockerfile . | |
| - name: Scan image for HIGH and CRITICAL vulnerabilities | |
| uses: aquasecurity/trivy-action@v0.36.0 | |
| with: | |
| image-ref: altair-trivy-scan:local | |
| format: sarif | |
| output: trivy-results.sarif | |
| severity: HIGH,CRITICAL | |
| # Don't fail the build immediately on every CVE — populate the | |
| # Security tab and let humans triage. Flip ignore-unfixed to | |
| # false and exit-code to 1 once you want hard-fail semantics. | |
| ignore-unfixed: true | |
| exit-code: '0' | |
| - name: Upload Trivy results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@v3 | |
| if: always() | |
| with: | |
| sarif_file: trivy-results.sarif | |
| category: trivy-image |