From 4ee00435b934a3e4f5cc57c345ceeffbe57cb5bf Mon Sep 17 00:00:00 2001 From: Enrico Deusebio Date: Tue, 1 Oct 2024 11:38:25 +0200 Subject: [PATCH 1/6] [DPE-5586] SBOM Generation --- .github/workflows/trivy.yaml | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) diff --git a/.github/workflows/trivy.yaml b/.github/workflows/trivy.yaml index 4c9a41a..85a56cd 100644 --- a/.github/workflows/trivy.yaml +++ b/.github/workflows/trivy.yaml @@ -8,12 +8,12 @@ jobs: build: uses: ./.github/workflows/build.yaml scan: - name: Trivy scan + name: Trivy scan and SBOM generation needs: build runs-on: ubuntu-20.04 steps: - name: Checkout code - uses: actions/checkout@v3 + uses: actions/checkout@v4 - name: Install dependencies run: | sudo snap install rockcraft --classic --edge @@ -39,3 +39,22 @@ jobs: if: always() with: sarif_file: 'trivy-results.sarif' + + - name: Run Trivy in GitHub SBOM mode and submit results to Dependency Graph + uses: aquasecurity/trivy-action@0.20.0 + with: + scan-type: 'image' + format: 'spdx-json' + output: 'dependency-results.sbom.json' + image-ref: 'trivy/charmed-zookeeper:test' + github-pat: ${{ secrets.GITHUB_TOKEN }} + severity: "MEDIUM,HIGH,CRITICAL" + scanners: "vuln" + + - name: Upload trivy report as a Github artifact + uses: actions/upload-artifact@v4 + with: + name: trivy-sbom-report + path: '${{ github.workspace }}/dependency-results.sbom.json' + retention-days: 90 + From 56dd450b805b578a7a0a90b49566b421ca306355 Mon Sep 17 00:00:00 2001 From: Enrico Deusebio Date: Tue, 1 Oct 2024 12:21:07 +0200 Subject: [PATCH 2/6] wip --- .github/workflows/trivy.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/trivy.yaml b/.github/workflows/trivy.yaml index 85a56cd..4badd24 100644 --- a/.github/workflows/trivy.yaml +++ b/.github/workflows/trivy.yaml @@ -41,7 +41,7 @@ jobs: sarif_file: 'trivy-results.sarif' - name: Run Trivy in GitHub SBOM mode and submit results to Dependency Graph - uses: aquasecurity/trivy-action@0.20.0 + uses: aquasecurity/trivy-action@master with: scan-type: 'image' format: 'spdx-json' From 6727ca48150d581c111d8c272379928075f0a27a Mon Sep 17 00:00:00 2001 From: Enrico Deusebio Date: Tue, 1 Oct 2024 14:33:28 +0200 Subject: [PATCH 3/6] test --- .github/workflows/trivy.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/trivy.yaml b/.github/workflows/trivy.yaml index 4badd24..644ba42 100644 --- a/.github/workflows/trivy.yaml +++ b/.github/workflows/trivy.yaml @@ -8,12 +8,12 @@ jobs: build: uses: ./.github/workflows/build.yaml scan: - name: Trivy scan and SBOM generation + name: Trivy scan needs: build runs-on: ubuntu-20.04 steps: - name: Checkout code - uses: actions/checkout@v4 + uses: actions/checkout@v3 - name: Install dependencies run: | sudo snap install rockcraft --classic --edge From 4e962d8aad1c12dca1ef0c2c4e1f397c2adf6de2 Mon Sep 17 00:00:00 2001 From: Enrico Deusebio Date: Tue, 1 Oct 2024 14:45:15 +0200 Subject: [PATCH 4/6] small update for the name --- .github/workflows/trivy.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/trivy.yaml b/.github/workflows/trivy.yaml index 644ba42..56f980c 100644 --- a/.github/workflows/trivy.yaml +++ b/.github/workflows/trivy.yaml @@ -8,7 +8,7 @@ jobs: build: uses: ./.github/workflows/build.yaml scan: - name: Trivy scan + name: Trivy scan and SBOM generation needs: build runs-on: ubuntu-20.04 steps: From 4cc311bea234ecd7fbe312a2ba54a6012ac0dc6d Mon Sep 17 00:00:00 2001 From: Enrico Deusebio Date: Tue, 1 Oct 2024 15:27:20 +0200 Subject: [PATCH 5/6] check --- .github/workflows/trivy.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/trivy.yaml b/.github/workflows/trivy.yaml index 56f980c..ab537ac 100644 --- a/.github/workflows/trivy.yaml +++ b/.github/workflows/trivy.yaml @@ -8,9 +8,9 @@ jobs: build: uses: ./.github/workflows/build.yaml scan: - name: Trivy scan and SBOM generation + name: Trivy scan needs: build - runs-on: ubuntu-20.04 + runs-on: ubuntu-22.04 steps: - name: Checkout code uses: actions/checkout@v3 From c229a7cd6714bb7e0d77f4b1ba706d2a46f85166 Mon Sep 17 00:00:00 2001 From: Enrico Deusebio Date: Tue, 1 Oct 2024 22:18:41 +0200 Subject: [PATCH 6/6] small renaming --- .github/workflows/trivy.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/trivy.yaml b/.github/workflows/trivy.yaml index ab537ac..e17abec 100644 --- a/.github/workflows/trivy.yaml +++ b/.github/workflows/trivy.yaml @@ -8,7 +8,7 @@ jobs: build: uses: ./.github/workflows/build.yaml scan: - name: Trivy scan + name: Trivy scan and SBOM generation needs: build runs-on: ubuntu-22.04 steps: