peetandClaude Fable 5
cc11e264c6
Feedback from the first rollout: a default-off gate is the wrong way around — the default must be active and enforced, with the opt-out as an explicit, documented per-invocation emergency flag (same posture as the image-scan gate). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg Reviewed-on: #5 Co-authored-by: peet <peet@noctrl.eu>
54 lines
1.7 KiB
YAML
54 lines
1.7 KiB
YAML
name: Trivy Filesystem Scan
|
|
description: >
|
|
Scan the checked-out workspace for vulnerable dependencies (lockfile-based:
|
|
gradle.lockfile, package-lock.json, etc.) with Trivy. For repos that build
|
|
artifacts rather than container images. Requires the trivy binary on the
|
|
runner (noctrl/gitea-runner >= v9) — pin the job to linux,build,amd64.
|
|
Gradle projects must have dependency locking enabled with committed
|
|
lockfiles, or trivy has nothing to read.
|
|
|
|
inputs:
|
|
path:
|
|
description: Directory to scan.
|
|
required: false
|
|
default: "."
|
|
severity:
|
|
description: Comma-separated Trivy severities to report.
|
|
required: false
|
|
default: HIGH,CRITICAL
|
|
enforce:
|
|
description: >
|
|
"true" (the default) fails the job on findings with an available fix.
|
|
Set "false" ONLY as a temporary emergency escape (e.g. an urgent fix
|
|
must ship while a finding is being addressed) — always with an inline
|
|
comment in the workflow explaining why.
|
|
required: false
|
|
default: "true"
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- id: scan
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
if ! command -v trivy >/dev/null 2>&1; then
|
|
echo "ERROR: trivy not found on this runner (needs noctrl/gitea-runner >= v9)" >&2
|
|
exit 1
|
|
fi
|
|
|
|
exit_code=0
|
|
if [[ "${{ inputs.enforce }}" == "true" ]]; then
|
|
exit_code=1
|
|
fi
|
|
|
|
echo "Scanning ${{ inputs.path }} (severities: ${{ inputs.severity }}, enforce: ${{ inputs.enforce }})"
|
|
trivy fs \
|
|
--scanners vuln \
|
|
--severity "${{ inputs.severity }}" \
|
|
--ignore-unfixed \
|
|
--exit-code "${exit_code}" \
|
|
--no-progress \
|
|
"${{ inputs.path }}"
|