Skip to content

Commit 44ee4a0

Browse files
Aisurasavanipoojan78
Aisura
and
savanipoojan78
committed
ci: re-enable trivy vulnerability scanning with SHA-based versioning
Restore the Trivy vulnerability scanning steps disabled in #20 and pin aquasecurity/trivy-action to a commit SHA instead of a tag. Co-authored-by: Poojan Savani <poojan@hasura.io>
1 parent 937f5d0 commit 44ee4a0

1 file changed

Lines changed: 66 additions & 66 deletions

File tree

‎.github/workflows/ndc-python-lambda-connector.yaml‎

Lines changed: 66 additions & 66 deletions
Original file line numberDiff line numberDiff line change
@@ -101,39 +101,39 @@ jobs:
101101
load: true
102102
tags: ${{ env.DOCKER_REGISTRY }}/${{ env.DOCKER_IMAGE_NAME }}:${{ github.sha }}
103103

104-
# - name: Run Trivy vulnerability scanner (json output)
105-
# uses: aquasecurity/trivy-action@v0.35.0
106-
# with:
107-
# image-ref: ${{ env.DOCKER_REGISTRY }}/${{ env.DOCKER_IMAGE_NAME }}:${{ github.sha }}
108-
# format: json
109-
# output: trivy-results.json
110-
# scanners: vuln
111-
#
112-
# - name: Upload Trivy scan results to Security Agent
113-
# uses: hasura/security-agent-tools/upload-file@v1
114-
# with:
115-
# file_path: trivy-results.json
116-
# security_agent_api_key: ${{ secrets.SECURITY_AGENT_API_KEY }}
117-
# tags: |
118-
# service=ndc-python-lambda
119-
# source_code_path=.
120-
# docker_file_path=Dockerfile
121-
# scanner=trivy
122-
# image_name=${{ env.DOCKER_REGISTRY }}/${{ env.DOCKER_IMAGE_NAME }}:${{ github.sha }}
123-
# product_domain=hasura-ddn-data-plane,promptql-data-plane
124-
# team=engine
125-
#
126-
# - name: Fail build on High/Critical Vulnerabilities
127-
# uses: aquasecurity/trivy-action@v0.35.0
128-
# with:
129-
# skip-setup-trivy: true
130-
# image-ref: ${{ env.DOCKER_REGISTRY }}/${{ env.DOCKER_IMAGE_NAME }}:${{ github.sha }}
131-
# format: table
132-
# severity: CRITICAL,HIGH
133-
# scanners: vuln
134-
# ignore-unfixed: true
135-
# exit-code: 1
136-
#
104+
- name: Run Trivy vulnerability scanner (json output)
105+
uses: aquasecurity/trivy-action@854c61d34a550a9fcbab3bc59e55b868c15d1962
106+
with:
107+
image-ref: ${{ env.DOCKER_REGISTRY }}/${{ env.DOCKER_IMAGE_NAME }}:${{ github.sha }}
108+
format: json
109+
output: trivy-results.json
110+
scanners: vuln
111+
112+
- name: Upload Trivy scan results to Security Agent
113+
uses: hasura/security-agent-tools/upload-file@v1
114+
with:
115+
file_path: trivy-results.json
116+
security_agent_api_key: ${{ secrets.SECURITY_AGENT_API_KEY }}
117+
tags: |
118+
service=ndc-python-lambda
119+
source_code_path=.
120+
docker_file_path=Dockerfile
121+
scanner=trivy
122+
image_name=${{ env.DOCKER_REGISTRY }}/${{ env.DOCKER_IMAGE_NAME }}:${{ github.sha }}
123+
product_domain=hasura-ddn-data-plane,promptql-data-plane
124+
team=engine
125+
126+
- name: Fail build on High/Critical Vulnerabilities
127+
uses: aquasecurity/trivy-action@854c61d34a550a9fcbab3bc59e55b868c15d1962
128+
with:
129+
skip-setup-trivy: true
130+
image-ref: ${{ env.DOCKER_REGISTRY }}/${{ env.DOCKER_IMAGE_NAME }}:${{ github.sha }}
131+
format: table
132+
severity: CRITICAL,HIGH
133+
scanners: vuln
134+
ignore-unfixed: true
135+
exit-code: 1
136+
137137
build-and-push-docker:
138138
name: Build and push Docker image
139139
needs: build-connector
@@ -176,39 +176,39 @@ jobs:
176176
IMAGE_TAG="${{ env.DOCKER_REGISTRY }}/${{ env.DOCKER_IMAGE_NAME }}:${GITHUB_REF#refs/tags/}"
177177
echo "image_tag=$IMAGE_TAG" >> $GITHUB_OUTPUT
178178
179-
# - name: Run Trivy vulnerability scanner (json output)
180-
# uses: aquasecurity/trivy-action@v0.35.0
181-
# with:
182-
# image-ref: ${{ steps.get-image-tag.outputs.image_tag }}
183-
# format: json
184-
# output: trivy-results.json
185-
# scanners: vuln
186-
#
187-
# - name: Upload Trivy scan results to Security Agent
188-
# uses: hasura/security-agent-tools/upload-file@v1
189-
# with:
190-
# file_path: trivy-results.json
191-
# security_agent_api_key: ${{ secrets.SECURITY_AGENT_API_KEY }}
192-
# tags: |
193-
# service=ndc-python-lambda
194-
# source_code_path=.
195-
# docker_file_path=Dockerfile
196-
# scanner=trivy
197-
# image_name=${{ steps.get-image-tag.outputs.image_tag }}
198-
# product_domain=hasura-ddn-data-plane,promptql-data-plane
199-
# team=engine
200-
#
201-
# - name: Fail build on High/Critical Vulnerabilities
202-
# uses: aquasecurity/trivy-action@v0.35.0
203-
# with:
204-
# skip-setup-trivy: true
205-
# image-ref: ${{ steps.get-image-tag.outputs.image_tag }}
206-
# format: table
207-
# severity: CRITICAL,HIGH
208-
# scanners: vuln
209-
# ignore-unfixed: true
210-
# exit-code: 1
211-
#
179+
- name: Run Trivy vulnerability scanner (json output)
180+
uses: aquasecurity/trivy-action@854c61d34a550a9fcbab3bc59e55b868c15d1962
181+
with:
182+
image-ref: ${{ steps.get-image-tag.outputs.image_tag }}
183+
format: json
184+
output: trivy-results.json
185+
scanners: vuln
186+
187+
- name: Upload Trivy scan results to Security Agent
188+
uses: hasura/security-agent-tools/upload-file@v1
189+
with:
190+
file_path: trivy-results.json
191+
security_agent_api_key: ${{ secrets.SECURITY_AGENT_API_KEY }}
192+
tags: |
193+
service=ndc-python-lambda
194+
source_code_path=.
195+
docker_file_path=Dockerfile
196+
scanner=trivy
197+
image_name=${{ steps.get-image-tag.outputs.image_tag }}
198+
product_domain=hasura-ddn-data-plane,promptql-data-plane
199+
team=engine
200+
201+
- name: Fail build on High/Critical Vulnerabilities
202+
uses: aquasecurity/trivy-action@854c61d34a550a9fcbab3bc59e55b868c15d1962
203+
with:
204+
skip-setup-trivy: true
205+
image-ref: ${{ steps.get-image-tag.outputs.image_tag }}
206+
format: table
207+
severity: CRITICAL,HIGH
208+
scanners: vuln
209+
ignore-unfixed: true
210+
exit-code: 1
211+
212212
release-connector:
213213
name: Release connector
214214
runs-on: ubuntu-latest

0 commit comments

Comments
 (0)