diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index c075799f..2017264a 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -24,23 +24,6 @@ jobs: - name: unused-package check run: make unused-package-check - security: - container: - image: litmuschaos/snyk:1.0 - volumes: - - /home/runner/work/_actions/:/home/runner/work/_actions/ - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v2 - - uses: snyk/actions/setup@master - - run: snyk auth ${SNYK_TOKEN} - - uses: actions/setup-go@v1 - with: - go-version: '1.17' - - name: Snyk monitor - run: snyk test - - trivy: needs: pre-checks runs-on: ubuntu-latest diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml new file mode 100644 index 00000000..4e363efb --- /dev/null +++ b/.github/workflows/security-scan.yml @@ -0,0 +1,32 @@ +--- +name: Security Scan +on: + workflow_dispatch: + +jobs: + snyk: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@master + - name: Run Snyk to check for vulnerabilities + uses: snyk/actions/golang@master + env: + SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }} + + trivy: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@master + - name: Build an image from Dockerfile + run: | + docker build -f build/Dockerfile -t docker.io/litmuschaos/chaos-scheduler:${{ github.sha }} . --build-arg TARGETARCH=amd64 + + - name: Run Trivy vulnerability scanner + uses: aquasecurity/trivy-action@master + with: + image-ref: 'docker.io/litmuschaos/chaos-scheduler:${{ github.sha }}' + format: 'table' + exit-code: '1' + ignore-unfixed: true + vuln-type: 'os,library' + severity: 'CRITICAL,HIGH'