Skip to content

[DPE-5585] SBOM Generation #53

[DPE-5585] SBOM Generation

[DPE-5585] SBOM Generation #53

Workflow file for this run

name: Trivy Security Scanner
on:
push:
branches:
- 3-22.04
pull_request:
jobs:
build:
uses: ./.github/workflows/build.yaml
scan:
name: Trivy scan and SBOM generation
needs: build
runs-on: ubuntu-20.04
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Install rockcraft (for skopeo)
run: |
sudo snap install rockcraft --classic --edge
- name: Download artifact
uses: actions/download-artifact@v3
with:
name: charmed-kafka
- name: Import locally
run: |
sudo rockcraft.skopeo --insecure-policy copy \
oci-archive:${{ needs.build.outputs.rock }} \
docker-daemon:trivy/charmed-kafka:test
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@master
with:
image-ref: 'trivy/charmed-kafka:test'
format: 'sarif'
output: 'trivy-results.sarif'
severity: 'MEDIUM,HIGH,CRITICAL'
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v2
if: always()
with:
sarif_file: 'trivy-results.sarif'
- name: Run Trivy in GitHub SBOM mode and submit results to Dependency Graph
uses: aquasecurity/[email protected]
with:
scan-type: 'image'
format: 'spdx-json'
output: 'dependency-results.sbom.json'
image-ref: 'trivy/charmed-kafka:test'
github-pat: ${{ secrets.GITHUB_TOKEN }}
severity: "MEDIUM,HIGH,CRITICAL"
scanners: "vuln"
- name: Upload trivy report as a Github artifact
uses: actions/upload-artifact@v4
with:
name: trivy-sbom-report
path: '${{ github.workspace }}/dependency-results.sbom.json'
retention-days: 90