Skip to content

Commit a20de54

Browse files
knqyf263knqyf263
authored
feat: store artifacts in cache by default (#399)
* feat: migrate to a composite action Signed-off-by: knqyf263 <[email protected]> * Fix tests Signed-off-by: knqyf263 <[email protected]> * Delete an unused input Signed-off-by: knqyf263 <[email protected]> * test: expect status code 0 Signed-off-by: knqyf263 <[email protected]> * test: not use run https://bats-core.readthedocs.io/en/stable/writing-tests.html#when-not-to-use-run Signed-off-by: knqyf263 <[email protected]> * feat: add 'cache' input Signed-off-by: knqyf263 <[email protected]> * docs: update README Signed-off-by: knqyf263 <[email protected]> * feat: pin Trivy version Signed-off-by: knqyf263 <[email protected]> * fix: bump trivy version Signed-off-by: knqyf263 <[email protected]> * feat: use date for cache key Signed-off-by: knqyf263 <[email protected]> * chore: delete a comment Signed-off-by: knqyf263 <[email protected]> * docs: update README Signed-off-by: knqyf263 <[email protected]> * refactor: resolve conflicts and use envs Signed-off-by: knqyf263 <[email protected]> --------- Signed-off-by: knqyf263 <[email protected]>
1 parent 1b8b83d commit a20de54

File tree

7 files changed

+252
-308
lines changed

7 files changed

+252
-308
lines changed

‎.github/workflows/bump-trivy.yaml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,9 @@ jobs:
1717
- uses: actions/checkout@v4
1818
- name: Update Trivy versions
1919
run: |
20-
sed -r -i "s/ghcr.io\/aquasecurity\/trivy:[0-9]+\.[0-9]+\.[0-9]+/ghcr.io\/aquasecurity\/trivy:${{ inputs.trivy_version }}/" Dockerfile
2120
find test/data -type f -name '*.test' | xargs sed -r -i 's/"version": "[0-9]+\.[0-9]+\.[0-9]+"/"version": "${{ inputs.trivy_version }}"/'
21+
sed -r -i '/^\| `version`/ s/[0-9]+\.[0-9]+\.[0-9]+/${{ inputs.trivy_version }}/g' README.md
22+
sed -r -i 's/(default:[ ]*'"'"')v[0-9]+\.[0-9]+\.[0-9]+/\1v${{ inputs.trivy_version }}/' action.yaml
2223
2324
- name: Create PR
2425
id: create-pr

‎.github/workflows/test.yaml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,8 @@ jobs:
2424
trivy --version
2525
2626
- name: Test
27-
run: |
28-
chmod +x entrypoint.sh
29-
GITHUB_REPOSITORY_OWNER=aquasecurity\
30-
TRIVY_CACHE_DIR=.cache TRIVY_DISABLE_VEX_NOTICE=true TRIVY_DEBUG=true\
31-
bats --recursive --timing --verbose-run .
27+
run: bats --recursive --timing --verbose-run .
28+
env:
29+
TRIVY_CACHE_DIR: .cache
30+
TRIVY_DISABLE_VEX_NOTICE: true
31+
TRIVY_DEBUG: true

‎Dockerfile

Lines changed: 0 additions & 5 deletions
This file was deleted.

‎README.md

Lines changed: 99 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -10,12 +10,22 @@
1010

1111
## Table of Contents
1212

13-
- [Usage](#usage)
14-
- [Workflow](#workflow)
15-
- [Docker Image Scanning](#using-trivy-with-github-code-scanning)
16-
- [Git Repository Scanning](#using-trivy-to-scan-your-git-repo)
17-
- [Customizing](#customizing)
18-
- [Inputs](#inputs)
13+
* [Usage](#usage)
14+
* [Scan CI Pipeline](#scan-ci-pipeline)
15+
* [Scan CI Pipeline (w/ Trivy Config)](#scan-ci-pipeline-w-trivy-config)
16+
* [Cache](#cache)
17+
* [Scanning a Tarball](#scanning-a-tarball)
18+
* [Using Trivy with GitHub Code Scanning](#using-trivy-with-github-code-scanning)
19+
* [Using Trivy to scan your Git repo](#using-trivy-to-scan-your-git-repo)
20+
* [Using Trivy to scan your rootfs directories](#using-trivy-to-scan-your-rootfs-directories)
21+
* [Using Trivy to scan Infrastructure as Code](#using-trivy-to-scan-infrastructure-as-code)
22+
* [Using Trivy to generate SBOM](#using-trivy-to-generate-sbom)
23+
* [Using Trivy to scan your private registry](#using-trivy-to-scan-your-private-registry)
24+
* [Using Trivy if you don't have code scanning enabled](#using-trivy-if-you-dont-have-code-scanning-enabled)
25+
* [Customizing](#customizing)
26+
* [inputs](#inputs)
27+
* [Environment variables](#environment-variables)
28+
* [Trivy config file](#trivy-config-file)
1929

2030
## Usage
2131

@@ -36,8 +46,7 @@ jobs:
3646
- name: Checkout code
3747
uses: actions/checkout@v3
3848
- name: Build an image from Dockerfile
39-
run: |
40-
docker build -t docker.io/my-organization/my-app:${{ github.sha }} .
49+
run: docker build -t docker.io/my-organization/my-app:${{ github.sha }} .
4150
- name: Run Trivy vulnerability scanner
4251
uses: aquasecurity/[email protected]
4352
with:
@@ -95,6 +104,86 @@ Trivy uses [Viper](https://github.com/spf13/viper) which has a defined precedenc
95104
- Config file
96105
- Default
97106

107+
### Cache
108+
The action has a built-in functionality for caching and restoring [the vulnerability DB](https://github.com/aquasecurity/trivy-db), [the Java DB](https://github.com/aquasecurity/trivy-java-db) and [the checks bundle](https://github.com/aquasecurity/trivy-checks) if they are downloaded during the scan.
109+
The cache is stored in the `$GITHUB_WORKSPACE/.cache/trivy` directory by default.
110+
The cache is restored before the scan starts and saved after the scan finishes.
111+
112+
It uses [actions/cache](https://github.com/actions/cache) under the hood but requires less configuration settings.
113+
The cache input is optional, and caching is turned on by default.
114+
115+
#### Disabling caching
116+
If you want to disable caching, set the `cache` input to `false`, but we recommend keeping it enabled to avoid rate limiting issues.
117+
118+
```yaml
119+
- name: Run Trivy scanner without cache
120+
uses: aquasecurity/[email protected]
121+
with:
122+
scan-type: 'fs'
123+
scan-ref: '.'
124+
cache: 'false'
125+
```
126+
127+
#### Updating caches in the default branch
128+
Please note that there are [restrictions on cache access](https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/caching-dependencies-to-speed-up-workflows#restrictions-for-accessing-a-cache) between branches in GitHub Actions.
129+
By default, a workflow can access and restore a cache created in either the current branch or the default branch (usually `main` or `master`).
130+
If you need to share caches across branches, you may need to create a cache in the default branch and restore it in the current branch.
131+
132+
To optimize your workflow, you can set up a cron job to regularly update the cache in the default branch.
133+
This allows subsequent scans to use the cached DB without downloading it again.
134+
135+
```yaml
136+
# Note: This workflow only updates the cache. You should create a separate workflow for your actual Trivy scans.
137+
# In your scan workflow, set TRIVY_SKIP_DB_UPDATE=true and TRIVY_SKIP_JAVA_DB_UPDATE=true.
138+
name: Update Trivy Cache
139+
140+
on:
141+
schedule:
142+
- cron: '0 0 * * *' # Run daily at midnight UTC
143+
workflow_dispatch: # Allow manual triggering
144+
145+
jobs:
146+
update-trivy-db:
147+
runs-on: ubuntu-latest
148+
steps:
149+
- name: Get current date
150+
id: date
151+
run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
152+
153+
- name: Download and extract the vulnerability DB
154+
run: |
155+
mkdir -p $GITHUB_WORKSPACE/.cache/trivy/db
156+
oras pull ghcr.io/aquasecurity/trivy-db:2
157+
tar -xzf db.tar.gz -C $GITHUB_WORKSPACE/.cache/trivy/db
158+
rm db.tar.gz
159+
160+
- name: Download and extract the Java DB
161+
run: |
162+
mkdir -p $GITHUB_WORKSPACE/.cache/trivy/java-db
163+
oras pull ghcr.io/aquasecurity/trivy-java-db:1
164+
tar -xzf javadb.tar.gz -C $GITHUB_WORKSPACE/.cache/trivy/java-db
165+
rm javadb.tar.gz
166+
167+
- name: Cache DBs
168+
uses: actions/cache/save@v4
169+
with:
170+
path: ${{ github.workspace }}/.cache/trivy
171+
key: cache-trivy-${{ steps.date.outputs.date }}
172+
```
173+
174+
When running a scan, set the environment variables `TRIVY_SKIP_DB_UPDATE` and `TRIVY_SKIP_JAVA_DB_UPDATE` to skip the download process.
175+
176+
```yaml
177+
- name: Run Trivy scanner without downloading DBs
178+
uses: aquasecurity/[email protected]
179+
with:
180+
scan-type: 'image'
181+
scan-ref: 'myimage'
182+
env:
183+
TRIVY_SKIP_DB_UPDATE: true
184+
TRIVY_SKIP_JAVA_DB_UPDATE: true
185+
```
186+
98187
### Scanning a Tarball
99188
```yaml
100189
name: build
@@ -123,56 +212,6 @@ jobs:
123212
severity: 'CRITICAL,HIGH'
124213
```
125214

126-
### Using cache for Trivy databases
127-
Recently, there has been an increase in cases of receiving the `TOOMANYREQUESTS` error when downloading the Trivy databases (`trivy-db`, `trivy-java-db` and `trivy-checks`).
128-
129-
If you’re performing multiple scans, it makes sense to use [action/cache](https://github.com/actions/cache) to cache one or more databases.
130-
131-
The example below saves the `trivy-db` for each day in the cache:
132-
133-
```yaml
134-
name: build
135-
on:
136-
push:
137-
branches:
138-
- main
139-
pull_request:
140-
141-
jobs:
142-
build:
143-
name: Build
144-
runs-on: ubuntu-20.04
145-
steps:
146-
- name: Checkout code
147-
uses: actions/checkout@v4
148-
149-
## To avoid the trivy-db becoming outdated, we save the cache for one day
150-
- name: Get data
151-
id: date
152-
run: echo "date=$(date +%Y-%m-%d)" >> $GITHUB_OUTPUT
153-
154-
- name: Restore trivy cache
155-
uses: actions/cache@v4
156-
with:
157-
path: cache/db
158-
key: trivy-cache-${{ steps.date.outputs.date }}
159-
restore-keys:
160-
trivy-cache-
161-
162-
- name: Run Trivy vulnerability scanner in fs mode
163-
uses: aquasecurity/[email protected]
164-
with:
165-
scan-type: 'fs'
166-
scan-ref: '.'
167-
cache-dir: "./cache"
168-
169-
## Trivy-db uses `0600` permissions.
170-
## But `action/cache` use `runner` user by default
171-
## So we need to change the permissions before caching the database.
172-
- name: change permissions for trivy.db
173-
run: sudo chmod 0644 ./cache/db/trivy.db
174-
```
175-
176215
### Using Trivy with GitHub Code Scanning
177216
If you have [GitHub code scanning](https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/about-code-scanning) available you can use Trivy as a scanning tool as follows:
178217
```yaml
@@ -630,7 +669,7 @@ Following inputs can be used as `step.with` keys:
630669
| `severity` | String | `UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL` | Severities of vulnerabilities to scanned for and displayed |
631670
| `skip-dirs` | String | | Comma separated list of directories where traversal is skipped |
632671
| `skip-files` | String | | Comma separated list of files where traversal is skipped |
633-
| `cache-dir` | String | | Cache directory |
672+
| `cache-dir` | String | `$GITHUB_WORKSPACE/.cache/trivy` | Cache directory |
634673
| `timeout` | String | `5m0s` | Scan timeout duration |
635674
| `ignore-policy` | String | | Filter vulnerabilities with OPA rego language |
636675
| `hide-progress` | String | `false` | Suppress progress bar and log output |
@@ -641,6 +680,7 @@ Following inputs can be used as `step.with` keys:
641680
| `github-pat` | String | | Authentication token to enable sending SBOM scan results to GitHub Dependency Graph. Can be either a GitHub Personal Access Token (PAT) or GITHUB_TOKEN |
642681
| `limit-severities-for-sarif` | Boolean | false | By default *SARIF* format enforces output of all vulnerabilities regardless of configured severities. To override this behavior set this parameter to **true** |
643682
| `docker-host` | String | | By default it is set to `unix://var/run/docker.sock`, but can be updated to help with containerized infrastructure values |
683+
| `version` | String | `v0.56.1` | Trivy version to use, e.g. `latest` or `v0.56.1` |
644684

645685
### Environment variables
646686
You can use [Trivy environment variables][trivy-env] to set the necessary options (including flags that are not supported by [Inputs](#inputs), such as `--secret-config`).

‎action.yaml

Lines changed: 71 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
name: 'Aqua Security Trivy'
22
description: 'Scans container images for vulnerabilities with Trivy'
33
author: 'Aqua Security'
4+
45
inputs:
56
scan-type:
67
description: 'Scan type to use for scanning vulnerability'
@@ -24,7 +25,7 @@ inputs:
2425
description: 'ignore unfixed vulnerabilities'
2526
required: false
2627
default: 'false'
27-
vuln-type:
28+
vuln-type: # TODO: rename to pkg-types
2829
description: 'comma-separated list of vulnerability types (os,library)'
2930
required: false
3031
default: 'os,library'
@@ -55,7 +56,7 @@ inputs:
5556
cache-dir:
5657
description: 'specify where the cache is stored'
5758
required: false
58-
default: ''
59+
default: '${{ github.workspace }}/.cache/trivy'
5960
timeout:
6061
description: 'timeout (default 5m0s)'
6162
required: false
@@ -79,9 +80,6 @@ inputs:
7980
description: 'comma-separated list of relative paths in repository to one or more .trivyignore files'
8081
required: false
8182
default: ''
82-
artifact-type:
83-
description: 'input artifact type (image, fs, repo, archive) for SBOM generation'
84-
required: false
8583
github-pat:
8684
description: 'GitHub Personal Access Token (PAT) for submitting SBOM to GitHub Dependency Snapshot API'
8785
required: false
@@ -97,33 +95,73 @@ inputs:
9795
docker-host:
9896
description: 'unix domain socket path to use for docker scanning, ex. unix:///var/run/docker.sock'
9997
required: false
98+
version:
99+
description: 'Trivy version to use'
100+
required: false
101+
default: 'v0.56.1'
102+
cache:
103+
description: 'Used to specify whether caching is needed. Set to false, if you would like to disable caching.'
104+
required: false
105+
default: 'true'
100106

101107
runs:
102-
using: 'docker'
103-
image: "Dockerfile"
104-
args:
105-
- '-a ${{ inputs.scan-type }}'
106-
- '-b ${{ inputs.format }}'
107-
- '-c ${{ inputs.template }}'
108-
- '-d ${{ inputs.exit-code }}'
109-
- '-e ${{ inputs.ignore-unfixed }}'
110-
- '-f ${{ inputs.vuln-type }}'
111-
- '-g ${{ inputs.severity }}'
112-
- '-h ${{ inputs.output }}'
113-
- '-i ${{ inputs.image-ref }}'
114-
- '-j ${{ inputs.scan-ref }}'
115-
- '-k ${{ inputs.skip-dirs }}'
116-
- '-l ${{ inputs.input }}'
117-
- '-m ${{ inputs.cache-dir }}'
118-
- '-n ${{ inputs.timeout }}'
119-
- '-o ${{ inputs.ignore-policy }}'
120-
- '-p ${{ inputs.hide-progress }}'
121-
- '-q ${{ inputs.skip-files }}'
122-
- '-r ${{ inputs.list-all-pkgs }}'
123-
- '-s ${{ inputs.scanners }}'
124-
- '-t ${{ inputs.trivyignores }}'
125-
- '-u ${{ inputs.github-pat }}'
126-
- '-v ${{ inputs.trivy-config }}'
127-
- '-x ${{ inputs.tf-vars }}'
128-
- '-z ${{ inputs.limit-severities-for-sarif }}'
129-
- '-y ${{ inputs.docker-host }}'
108+
using: 'composite'
109+
steps:
110+
- name: Install Trivy
111+
shell: bash
112+
run: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sudo sh -s -- -b /usr/local/bin ${{ inputs.version }}
113+
114+
- name: Get current date
115+
id: date
116+
shell: bash
117+
run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
118+
119+
- name: Restore DB from cache
120+
if: ${{ inputs.cache == 'true' }}
121+
uses: actions/cache@v4
122+
with:
123+
path: ${{ inputs.cache-dir }}
124+
key: cache-trivy-${{ steps.date.outputs.date }}
125+
restore-keys: cache-trivy-
126+
127+
- name: Set GitHub Path
128+
run: echo "$GITHUB_ACTION_PATH" >> $GITHUB_PATH
129+
shell: bash
130+
env:
131+
GITHUB_ACTION_PATH: ${{ github.action_path }}
132+
133+
- name: Run Trivy
134+
shell: bash
135+
run: entrypoint.sh
136+
env:
137+
# For shell script
138+
# > If the action is written using a composite, then it will not automatically get INPUT_<VARIABLE_NAME>
139+
# cf. https://docs.github.com/en/actions/sharing-automations/creating-actions/metadata-syntax-for-github-actions#example-specifying-inputs
140+
INPUT_SCAN_TYPE: ${{ inputs.scan-type }}
141+
INPUT_IMAGE_REF: ${{ inputs.image-ref }}
142+
INPUT_SCAN_REF: ${{ inputs.scan-ref }}
143+
INPUT_TRIVYIGNORES: ${{ inputs.trivyignores }}
144+
INPUT_GITHUB_PAT: ${{ inputs.github-pat }}
145+
INPUT_LIMIT_SEVERITIES_FOR_SARIF: ${{ inputs.limit-severities-for-sarif }}
146+
147+
# For Trivy
148+
# cf. https://aquasecurity.github.io/trivy/latest/docs/configuration/#environment-variables
149+
TRIVY_INPUT: ${{ inputs.input }}
150+
TRIVY_EXIT_CODE: ${{ inputs.exit-code }}
151+
TRIVY_IGNORE_UNFIXED: ${{ inputs.ignore-unfixed }}
152+
TRIVY_PKG_TYPES: ${{ inputs.vuln-type }}
153+
TRIVY_SEVERITY: ${{ inputs.severity }}
154+
TRIVY_FORMAT: ${{ inputs.format }}
155+
TRIVY_TEMPLATE: ${{ inputs.template }}
156+
TRIVY_OUTPUT: ${{ inputs.output }}
157+
TRIVY_SKIP_DIRS: ${{ inputs.skip-dirs }}
158+
TRIVY_SKIP_FILES: ${{ inputs.skip-files }}
159+
TRIVY_CACHE_DIR: ${{ inputs.cache-dir }}
160+
TRIVY_TIMEOUT: ${{ inputs.timeout }}
161+
TRIVY_IGNORE_POLICY: ${{ inputs.ignore-policy }}
162+
TRIVY_QUIET: ${{ inputs.hide-progress }}
163+
TRIVY_LIST_ALL_PKGS: ${{ inputs.list-all-pkgs }}
164+
TRIVY_SCANNERS: ${{ inputs.scanners }}
165+
TRIVY_CONFIG: ${{ inputs.trivy-config }}
166+
TRIVY_TF_VARS: ${{ inputs.tf-vars }}
167+
TRIVY_DOCKER_HOST: ${{ inputs.docker-host }}

0 commit comments

Comments
 (0)