Skip to content

Commit 6a91d29

Browse files
jimmykarilyjimmykarily
authored
Keep only high and critical severity results (#3123)
Signed-off-by: Dimitris Karakasilis <[email protected]>
1 parent c75289a commit 6a91d29

File tree

4 files changed

+93
-22
lines changed

4 files changed

+93
-22
lines changed

‎.github/workflows/release-arm.yaml

+39-10
Original file line numberDiff line numberDiff line change
@@ -230,21 +230,36 @@ jobs:
230230
files: |
231231
build/*scan-reports.tar.gz
232232
- name: Prepare sarif files 🔧
233+
if: startsWith(github.ref, 'refs/tags/')
233234
run: |
234-
mkdir trivy-sarif grype-sarif
235-
sudo mv build/*trivy.sarif trivy-sarif/
236-
sudo mv build/*grype.sarif grype-sarif/
235+
mkdir trivy-results grype-results
236+
trivy=$(ls build/*trivy.sarif 2>/dev/null | head -n 1)
237+
grype=$(ls build/*grype.sarif 2>/dev/null | head -n 1)
238+
sudo mv $trivy trivy-results/result.sarif
239+
sudo mv $grype grype-results/result.sarif
240+
- uses: itxaka/sarif-filter@v1
241+
if: startsWith(github.ref, 'refs/tags/')
242+
with:
243+
input: trivy-results/result.sarif
244+
output: trivy-results/result.sarif
245+
severity: high
246+
- uses: itxaka/sarif-filter@v1
247+
if: startsWith(github.ref, 'refs/tags/')
248+
with:
249+
input: grype-results/result.sarif
250+
output: grype-results/result.sarif
251+
severity: high
237252
- name: Upload Trivy scan results to GitHub Security tab
238253
uses: github/codeql-action/upload-sarif@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3
239254
if: startsWith(github.ref, 'refs/tags/')
240255
with:
241-
sarif_file: 'trivy-sarif'
256+
sarif_file: 'trivy-results'
242257
category: ${{ matrix.flavor }}-${{ matrix.flavor_release }}-${{ matrix.variant }}-${{ matrix.arch }}-${{ matrix.model }}-trivy
243258
- name: Upload Grype scan results to GitHub Security tab
244259
uses: github/codeql-action/upload-sarif@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3
245260
if: startsWith(github.ref, 'refs/tags/')
246261
with:
247-
sarif_file: 'grype-sarif'
262+
sarif_file: 'grype-results'
248263
category: ${{ matrix.flavor }}-${{ matrix.flavor_release }}-${{ matrix.variant }}-${{ matrix.arch }}-${{ matrix.model }}-grype
249264
build-arm-standard:
250265
runs-on: ARM64
@@ -331,20 +346,34 @@ jobs:
331346
build/*scan-reports.tar.gz
332347
- name: Prepare sarif files 🔧
333348
run: |
334-
mkdir trivy-sarif grype-sarif
335-
sudo mv build/*trivy.sarif trivy-sarif/
336-
sudo mv build/*grype.sarif grype-sarif/
349+
mkdir trivy-results grype-results
350+
trivy=$(ls build/*trivy.sarif 2>/dev/null | head -n 1)
351+
grype=$(ls build/*grype.sarif 2>/dev/null | head -n 1)
352+
sudo mv $trivy trivy-results/result.sarif
353+
sudo mv $grype grype-results/result.sarif
354+
- uses: itxaka/sarif-filter@v1
355+
if: startsWith(github.ref, 'refs/tags/')
356+
with:
357+
input: trivy-results/result.sarif
358+
output: trivy-results/result.sarif
359+
severity: high
360+
- uses: itxaka/sarif-filter@v1
361+
if: startsWith(github.ref, 'refs/tags/')
362+
with:
363+
input: grype-results/result.sarif
364+
output: grype-results/result.sarif
365+
severity: high
337366
- name: Upload Trivy scan results to GitHub Security tab
338367
if: startsWith(github.ref, 'refs/tags/')
339368
uses: github/codeql-action/upload-sarif@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3
340369
with:
341-
sarif_file: 'trivy-sarif'
370+
sarif_file: 'trivy-results'
342371
category: ${{ matrix.flavor }}-${{ matrix.flavor_release }}-${{ matrix.variant }}-${{ matrix.arch }}-${{ matrix.model }}-trivy
343372
- name: Upload Grype scan results to GitHub Security tab
344373
if: startsWith(github.ref, 'refs/tags/')
345374
uses: github/codeql-action/upload-sarif@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3
346375
with:
347-
sarif_file: 'grype-sarif'
376+
sarif_file: 'grype-results'
348377
category: ${{ matrix.flavor }}-${{ matrix.flavor_release }}-${{ matrix.variant }}-${{ matrix.arch }}-${{ matrix.model }}-grype
349378
- name: Space stats
350379
if: always()

‎.github/workflows/release.yaml

+19-5
Original file line numberDiff line numberDiff line change
@@ -194,9 +194,11 @@ jobs:
194194
--output-signature="${filename}.sig" "${filename}"
195195
- name: Prepare files for release
196196
run: |
197-
mkdir trivy-sarif grype-sarif
198-
sudo mv release/*trivy.sarif trivy-sarif/
199-
sudo mv release/*grype.sarif grype-sarif/
197+
mkdir trivy-results grype-results
198+
trivy=$(ls build/*trivy.sarif 2>/dev/null | head -n 1)
199+
grype=$(ls build/*grype.sarif 2>/dev/null | head -n 1)
200+
sudo mv $trivy trivy-results/result.sarif
201+
sudo mv $grype grype-results/result.sarif
200202
mkdir reports
201203
mv release/*.json reports/
202204
cd reports
@@ -205,6 +207,18 @@ jobs:
205207
mv *.tar.gz ../release/
206208
cd ..
207209
rm release/IMAGE release/VERSION release/versions.yaml
210+
- uses: itxaka/sarif-filter@v1
211+
if: startsWith(github.ref, 'refs/tags/')
212+
with:
213+
input: trivy-results/result.sarif
214+
output: trivy-results/result.sarif
215+
severity: high
216+
- uses: itxaka/sarif-filter@v1
217+
if: startsWith(github.ref, 'refs/tags/')
218+
with:
219+
input: grype-results/result.sarif
220+
output: grype-results/result.sarif
221+
severity: high
208222
- name: Release
209223
uses: softprops/action-gh-release@01570a1f39cb168c169c802c3bceb9e93fb10974 # v2.1.0
210224
if: startsWith(github.ref, 'refs/tags/')
@@ -215,13 +229,13 @@ jobs:
215229
uses: github/codeql-action/upload-sarif@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3
216230
if: startsWith(github.ref, 'refs/tags/')
217231
with:
218-
sarif_file: 'trivy-sarif'
232+
sarif_file: 'trivy-results'
219233
category: ${{ matrix.flavor }}-${{ matrix.flavor_release }}-${{ matrix.variant }}-${{ matrix.arch }}-${{ matrix.model }}-trivy
220234
- name: Upload Grype scan results to GitHub Security tab
221235
uses: github/codeql-action/upload-sarif@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3
222236
if: startsWith(github.ref, 'refs/tags/')
223237
with:
224-
sarif_file: 'grype-sarif'
238+
sarif_file: 'grype-results'
225239
category: ${{ matrix.flavor }}-${{ matrix.flavor_release }}-${{ matrix.variant }}-${{ matrix.arch }}-${{ matrix.model }}-grype
226240
build-uki-container-image:
227241
runs-on: ubuntu-latest

‎.github/workflows/reusable-build-flavor.yaml

+16-2
Original file line numberDiff line numberDiff line change
@@ -139,8 +139,22 @@ jobs:
139139
sudo mv build/* .
140140
sudo rm -rf build
141141
mkdir trivy-results grype-results
142-
sudo mv *trivy.sarif trivy-results/
143-
sudo mv *grype.sarif grype-results/
142+
trivy=$(ls *trivy.sarif 2>/dev/null | head -n 1)
143+
grype=$(ls *grype.sarif 2>/dev/null | head -n 1)
144+
sudo mv $trivy trivy-results/result.sarif
145+
sudo mv $grype grype-results/result.sarif
146+
- uses: itxaka/sarif-filter@v1
147+
if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}
148+
with:
149+
input: trivy-results/result.sarif
150+
output: trivy-results/result.sarif
151+
severity: high
152+
- uses: itxaka/sarif-filter@v1
153+
if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}
154+
with:
155+
input: grype-results/result.sarif
156+
output: grype-results/result.sarif
157+
severity: high
144158
- name: Upload Trivy scan results to GitHub Security tab
145159
if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}
146160
uses: github/codeql-action/upload-sarif@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3

‎.github/workflows/reusable-docker-arm-build.yaml

+19-5
Original file line numberDiff line numberDiff line change
@@ -151,20 +151,34 @@ jobs:
151151
- name: Prepare sarif files 🔧
152152
if: startsWith(github.ref, 'refs/tags/v')
153153
run: |
154-
mkdir trivy-sarif grype-sarif
155-
sudo mv build/*trivy.sarif trivy-sarif/
156-
sudo mv build/*grype.sarif grype-sarif/
154+
mkdir trivy-results grype-results
155+
trivy=$(ls *trivy.sarif 2>/dev/null | head -n 1)
156+
grype=$(ls *grype.sarif 2>/dev/null | head -n 1)
157+
sudo mv $trivy trivy-results/result.sarif
158+
sudo mv $grype grype-results/result.sarif
159+
- uses: itxaka/sarif-filter@v1
160+
if: startsWith(github.ref, 'refs/tags/v')
161+
with:
162+
input: trivy-results/result.sarif
163+
output: trivy-results/result.sarif
164+
severity: high
165+
- uses: itxaka/sarif-filter@v1
166+
if: startsWith(github.ref, 'refs/tags/v')
167+
with:
168+
input: grype-results/result.sarif
169+
output: grype-results/result.sarif
170+
severity: high
157171
- name: Upload Trivy scan results to GitHub Security tab
158172
uses: github/codeql-action/upload-sarif@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3
159173
if: startsWith(github.ref, 'refs/tags/v')
160174
with:
161-
sarif_file: 'trivy-sarif'
175+
sarif_file: 'trivy-results'
162176
category: ${{ matrix.flavor }}-${{ matrix.flavor_release }}-${{ matrix.variant }}-${{ matrix.arch }}-${{ matrix.model }}-trivy
163177
- name: Upload Grype scan results to GitHub Security tab
164178
uses: github/codeql-action/upload-sarif@f09c1c0a94de965c15400f5634aa42fac8fb8f88 # v3
165179
if: startsWith(github.ref, 'refs/tags/v')
166180
with:
167-
sarif_file: 'grype-sarif'
181+
sarif_file: 'grype-results'
168182
category: ${{ matrix.flavor }}-${{ matrix.flavor_release }}-${{ matrix.variant }}-${{ matrix.arch }}-${{ matrix.model }}-grype
169183
- name: Upload results
170184
if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' && inputs.model != 'nvidia-jetson-agx-orin' }}

0 commit comments

Comments
 (0)