From 07dfd1f40ffa8c6bee9fe1e2d9ef45385536b31e Mon Sep 17 00:00:00 2001 From: amberjblue Date: Thu, 14 Aug 2025 09:07:06 -0400 Subject: [PATCH 1/4] Add security scan --- .github/workflows/security-scan.yaml | 48 ++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+) create mode 100644 .github/workflows/security-scan.yaml diff --git a/.github/workflows/security-scan.yaml b/.github/workflows/security-scan.yaml new file mode 100644 index 00000000..014561fa --- /dev/null +++ b/.github/workflows/security-scan.yaml @@ -0,0 +1,48 @@ +name: Security Scan + +on: + push: + branches: [main] + pull_request: + branches: [main] + workflow_dispatch: + +jobs: + trivy-scan: + name: Trivy + runs-on: ubuntu-latest + permissions: + contents: read + security-events: write + + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Run Trivy vulnerability scan + uses: aquasecurity/trivy-action@0.28.0 + with: + scan-type: fs + scan-ref: . + format: sarif + output: trivy-results.sarif + severity: CRITICAL,HIGH,MEDIUM,LOW + exit-code: 0 + ignore-unfixed: false + + - name: Check for critical and high vulnerabilities + uses: aquasecurity/trivy-action@0.28.0 + with: + scan-type: fs + scan-ref: . + format: table + severity: CRITICAL,HIGH + exit-code: 1 + ignore-unfixed: false + + - name: Upload SARIF to Security tab + if: always() + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: trivy-results.sarif + category: trivy-security-scan From 35c51c744ae347b0a9e2a8738d37a7743a942573 Mon Sep 17 00:00:00 2001 From: amberjblue Date: Thu, 14 Aug 2025 16:21:48 -0400 Subject: [PATCH 2/4] Fix serif upload --- .github/workflows/security-scan.yaml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/security-scan.yaml b/.github/workflows/security-scan.yaml index 014561fa..8c675f93 100644 --- a/.github/workflows/security-scan.yaml +++ b/.github/workflows/security-scan.yaml @@ -28,7 +28,6 @@ jobs: output: trivy-results.sarif severity: CRITICAL,HIGH,MEDIUM,LOW exit-code: 0 - ignore-unfixed: false - name: Check for critical and high vulnerabilities uses: aquasecurity/trivy-action@0.28.0 @@ -38,7 +37,6 @@ jobs: format: table severity: CRITICAL,HIGH exit-code: 1 - ignore-unfixed: false - name: Upload SARIF to Security tab if: always() @@ -46,3 +44,4 @@ jobs: with: sarif_file: trivy-results.sarif category: trivy-security-scan + continue-on-error: true From 367cd7e84515ae23efd36bb102de2ab142d06e1f Mon Sep 17 00:00:00 2001 From: amberjblue Date: Tue, 19 Aug 2025 10:28:37 -0400 Subject: [PATCH 3/4] Update security-scan.yaml --- .github/workflows/security-scan.yaml | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/.github/workflows/security-scan.yaml b/.github/workflows/security-scan.yaml index 8c675f93..c97024e8 100644 --- a/.github/workflows/security-scan.yaml +++ b/.github/workflows/security-scan.yaml @@ -20,7 +20,7 @@ jobs: uses: actions/checkout@v4 - name: Run Trivy vulnerability scan - uses: aquasecurity/trivy-action@0.28.0 + uses: aquasecurity/trivy-action@77137e9dc3ab1b329b7c8a38c2eb7475850a14e8 with: scan-type: fs scan-ref: . @@ -29,14 +29,14 @@ jobs: severity: CRITICAL,HIGH,MEDIUM,LOW exit-code: 0 - - name: Check for critical and high vulnerabilities - uses: aquasecurity/trivy-action@0.28.0 - with: - scan-type: fs - scan-ref: . - format: table - severity: CRITICAL,HIGH - exit-code: 1 + # - name: Check for critical and high vulnerabilities + # uses: aquasecurity/trivy-action@77137e9dc3ab1b329b7c8a38c2eb7475850a14e8 + # with: + # scan-type: fs + # scan-ref: . + # format: table + # severity: CRITICAL,HIGH + # exit-code: 1 - name: Upload SARIF to Security tab if: always() From ad38e0fe67b4c11377356fb676b753f3b2c173df Mon Sep 17 00:00:00 2001 From: amberjblue Date: Tue, 19 Aug 2025 10:32:51 -0400 Subject: [PATCH 4/4] Update security-scan.yaml --- .github/workflows/security-scan.yaml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/.github/workflows/security-scan.yaml b/.github/workflows/security-scan.yaml index c97024e8..011d2681 100644 --- a/.github/workflows/security-scan.yaml +++ b/.github/workflows/security-scan.yaml @@ -29,14 +29,14 @@ jobs: severity: CRITICAL,HIGH,MEDIUM,LOW exit-code: 0 - # - name: Check for critical and high vulnerabilities - # uses: aquasecurity/trivy-action@77137e9dc3ab1b329b7c8a38c2eb7475850a14e8 - # with: - # scan-type: fs - # scan-ref: . - # format: table - # severity: CRITICAL,HIGH - # exit-code: 1 + - name: Check for critical and high vulnerabilities + uses: aquasecurity/trivy-action@77137e9dc3ab1b329b7c8a38c2eb7475850a14e8 + with: + scan-type: fs + scan-ref: . + format: table + severity: CRITICAL,HIGH + exit-code: 1 - name: Upload SARIF to Security tab if: always()