|
| 1 | +--- |
| 2 | + |
| 3 | +# Workflow to scan Docker images vulnerabilities by Grape and Trivy |
| 4 | +# To make it work create a configuration file .qubership/3rd-party-sec-scan-config.yaml |
| 5 | +# Example configuration file can be found there: config/examples/3rd-party-sec-scan-config.yaml |
| 6 | +name: Security Scan Docker images |
| 7 | +run-name: > |
| 8 | + Security Scan |
| 9 | +on: |
| 10 | + workflow_dispatch: |
| 11 | + inputs: |
| 12 | + only-high-critical: |
| 13 | + description: "Scope only HIGH + CRITICAL" |
| 14 | + required: false |
| 15 | + default: true |
| 16 | + type: boolean |
| 17 | + trivy-scan: |
| 18 | + description: "Trivy scan" |
| 19 | + required: false |
| 20 | + default: true |
| 21 | + type: boolean |
| 22 | + grype-scan: |
| 23 | + description: "Grype scan" |
| 24 | + required: false |
| 25 | + default: true |
| 26 | + type: boolean |
| 27 | + continue-on-error: |
| 28 | + description: "Continue on error" |
| 29 | + required: false |
| 30 | + default: true |
| 31 | + type: boolean |
| 32 | + only-fixed: |
| 33 | + description: "Ignore unfixed vulnerabilities" |
| 34 | + required: false |
| 35 | + default: true |
| 36 | + type: boolean |
| 37 | + schedule: |
| 38 | + - cron: "0 3 * * 0" # every Sunday at 03:00 UTC |
| 39 | +permissions: |
| 40 | + contents: read |
| 41 | + |
| 42 | +env: |
| 43 | + CONFIG_FILE: .qubership/3rd-party-sec-scan-config.yaml |
| 44 | + REPORT_BRANCH: reports |
| 45 | +jobs: |
| 46 | + load-config: |
| 47 | + runs-on: ubuntu-latest |
| 48 | + outputs: |
| 49 | + packages: ${{ steps.config.outputs.packages }} |
| 50 | + steps: |
| 51 | + - name: Checkout |
| 52 | + uses: actions/checkout@v5 |
| 53 | + - name: Read config |
| 54 | + id: config |
| 55 | + run: | |
| 56 | + echo "only-high-critical: ${{ inputs.only-high-critical }}" |
| 57 | + echo "trivy-scan: ${{ inputs.trivy-scan }}" |
| 58 | + echo "grype-scan: ${{ inputs.grype-scan }}" |
| 59 | + echo "continue-on-error: ${{ inputs.continue-on-error }}" |
| 60 | + echo "only-fixed: ${{ inputs.only-fixed }}" |
| 61 | + echo "1. ===================================================================================" |
| 62 | + yq -oj '.' $CONFIG_FILE |
| 63 | + echo "2. ===================================================================================" |
| 64 | + yq -oj '.' $CONFIG_FILE | jq -c 'to_entries | map({repo: .key, image: .value[]}) | {packages: .}' |
| 65 | + echo "3. ===================================================================================" |
| 66 | +
|
| 67 | + packages=$(yq -oj '.' $CONFIG_FILE | jq -c 'to_entries | map({repo: .key, image: .value[]})') |
| 68 | + echo "packages=$packages" >> $GITHUB_OUTPUT |
| 69 | +
|
| 70 | + security-scan-matrix: |
| 71 | + needs: load-config |
| 72 | + permissions: |
| 73 | + security-events: write |
| 74 | + contents: read |
| 75 | + packages: read |
| 76 | + strategy: |
| 77 | + fail-fast: false |
| 78 | + matrix: |
| 79 | + package: "${{ fromJson(needs.load-config.outputs.packages) }}" |
| 80 | + name: "${{ matrix.package.image }}" |
| 81 | + uses: netcracker/qubership-workflow-hub/.github/workflows/re-security-scan.yml@v2.0.10 |
| 82 | + with: |
| 83 | + target: 'docker' |
| 84 | + image: ${{ matrix.package.image }} |
| 85 | + only-high-critical: ${{ (github.event_name == 'schedule' && true) || inputs.only-high-critical }} |
| 86 | + trivy-scan: ${{ (github.event_name == 'schedule' && true) || inputs.trivy-scan }} |
| 87 | + grype-scan: ${{ (github.event_name == 'schedule' && true) || inputs.grype-scan }} |
| 88 | + continue-on-error: ${{ (github.event_name == 'schedule' && true) || inputs.continue-on-error }} |
| 89 | + only-fixed: ${{ (github.event_name == 'schedule' && true) || inputs.only-fixed }} |
| 90 | + upload-sarif-to-security: false |
| 91 | + |
| 92 | + create-report: |
| 93 | + needs: [security-scan-matrix] |
| 94 | + if: always() |
| 95 | + runs-on: ubuntu-latest |
| 96 | + permissions: |
| 97 | + contents: write |
| 98 | + steps: |
| 99 | + - name: Checkout |
| 100 | + uses: actions/checkout@v5 |
| 101 | + with: |
| 102 | + path: repo |
| 103 | + persist-credentials: true |
| 104 | + fetch-depth: 0 |
| 105 | + |
| 106 | + - name: Ensure branch exists |
| 107 | + working-directory: repo |
| 108 | + run: | |
| 109 | + if git ls-remote --exit-code --heads origin "${{ env.REPORT_BRANCH }}" >/dev/null 2>&1; then |
| 110 | + git fetch origin "${{ env.REPORT_BRANCH }}" |
| 111 | + git checkout "${{ env.REPORT_BRANCH }}" |
| 112 | + else |
| 113 | + git checkout -b "${{ env.REPORT_BRANCH }}" |
| 114 | + git push -u origin "${{ env.REPORT_BRANCH }}" |
| 115 | + fi |
| 116 | +
|
| 117 | + - name: Download artifacts |
| 118 | + uses: actions/download-artifact@v7 |
| 119 | + with: |
| 120 | + pattern: '*.sarif' |
| 121 | + path: ./sarif |
| 122 | + merge-multiple: true |
| 123 | + |
| 124 | + - name: Generate report |
| 125 | + env: |
| 126 | + ACTOR: ${{ github.actor }} |
| 127 | + run: | |
| 128 | + ### Generating CSV report |
| 129 | + mkdir -p repo |
| 130 | + cur_date=$(date +%Y-%m-%d) |
| 131 | + cur_time=$(date +%H-%M-%S) |
| 132 | + cur_date_time=${cur_date}_${cur_time} |
| 133 | + report_file_name=report-${cur_date_time}.csv |
| 134 | + report_dir=repo/reports/${cur_date} |
| 135 | + mkdir -p $report_dir |
| 136 | + report_file_path=${report_dir}/${report_file_name} |
| 137 | + echo "Report file path: ${report_file_path}" |
| 138 | + for component in $(yq e 'keys[]' repo/${CONFIG_FILE}); do |
| 139 | + echo "Processing $component's images..." |
| 140 | + images=$(yq e ".${component}[]" repo/${CONFIG_FILE}) |
| 141 | + for image in $images; do |
| 142 | + echo "Image: $image" |
| 143 | + SHORT_NAME=${image##*/} |
| 144 | + SAFE_NAME=${SHORT_NAME//:/_} |
| 145 | + SAFE_NAME=${SAFE_NAME//\//_} |
| 146 | + SAFE_NAME=${SAFE_NAME//-/_} |
| 147 | + echo "Safe name: $SAFE_NAME" |
| 148 | + ls -la ./sarif |
| 149 | + echo "[DEBUG]: find ./sarif -name grype-${SAFE_NAME}*.csv -o -name trivy-${SAFE_NAME}*.csv" |
| 150 | +
|
| 151 | + for f in $(find ./sarif -name grype-${SAFE_NAME}*.csv -o -name trivy-${SAFE_NAME}*.csv); do |
| 152 | + echo "File: $f" |
| 153 | + echo "\"Componenet\",$(head -n 1 "$f")" > "${f}__new" |
| 154 | + tail -n +2 "$f" | sed "s/^/\"${component}\",/" >> "${f}__new" |
| 155 | + done |
| 156 | + done |
| 157 | + done |
| 158 | + :> ${report_file_path} |
| 159 | + i=0 |
| 160 | + for f in $(find ./sarif -name *.csv__new | sort); do |
| 161 | + if [ $i -eq 0 ]; then |
| 162 | + cat $f >> ${report_file_path} |
| 163 | + else |
| 164 | + tail -n +2 $f >> ${report_file_path} |
| 165 | + fi |
| 166 | + i=$((i + 1)) |
| 167 | + done |
| 168 | +
|
| 169 | + - name: Commit and Push Report |
| 170 | + env: |
| 171 | + ACTOR: ${{ github.actor }} |
| 172 | + run: | |
| 173 | + cd repo |
| 174 | + git config --global user.name "$ACTOR" |
| 175 | + git config --global user.email "$ACTOR@users.noreply.github.com" |
| 176 | + git add . |
| 177 | + git commit -m "CSV report ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" || echo "No changes" |
| 178 | + git push origin "${REPORT_BRANCH}" |
0 commit comments