peetandClaude Fable 5
e501ab145f
For directories whose bundled dependencies cannot be upgraded in place — first user: the Android SDK cmdline-tools jars (old protobuf/guava et al. inside sdkmanager) in the gitea-runner-android image. Callers must leave a comment in the workflow explaining each exclusion. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg Reviewed-on: #4 Co-authored-by: peet <peet@noctrl.eu>
70 lines
2.4 KiB
YAML
70 lines
2.4 KiB
YAML
name: Trivy Scan
|
|
description: >
|
|
Scan an image in registry.noctrl.eu for vulnerabilities and fail on findings.
|
|
Pulls the image directly from the registry — no podman storage involved.
|
|
Pin the calling job to an amd64 runner (never arm); vulnerability results are
|
|
package-based and arch-independent, so scanning a multi-arch ref once
|
|
(trivy picks the host platform's variant) covers all variants.
|
|
|
|
inputs:
|
|
image-name:
|
|
description: Repository/image name path, for example noctrl/gitea-runner
|
|
required: true
|
|
tag:
|
|
description: Tag to scan, for example sha-abc123 or sha-abc123-amd64
|
|
required: true
|
|
severity:
|
|
description: Comma-separated Trivy severities that fail the scan.
|
|
required: false
|
|
default: HIGH,CRITICAL
|
|
skip-dirs:
|
|
description: >
|
|
Comma-separated directories inside the image to exclude from the scan.
|
|
For vendored third-party toolchains whose bundled dependencies cannot
|
|
be upgraded in place (e.g. the Android SDK's cmdline-tools jars) —
|
|
always leave a comment in the workflow explaining why.
|
|
required: false
|
|
default: ""
|
|
registry-username:
|
|
description: Registry username for pulling the image.
|
|
required: true
|
|
registry-password:
|
|
description: Registry password for pulling the image.
|
|
required: true
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- id: scan
|
|
shell: bash
|
|
env:
|
|
TRIVY_USERNAME: ${{ inputs.registry-username }}
|
|
TRIVY_PASSWORD: ${{ inputs.registry-password }}
|
|
run: |
|
|
set -euo pipefail
|
|
|
|
if ! command -v trivy >/dev/null 2>&1; then
|
|
echo "ERROR: trivy not found on this runner (needs noctrl/gitea-runner >= v9)" >&2
|
|
exit 1
|
|
fi
|
|
|
|
image_ref="registry.noctrl.eu/${{ inputs.image-name }}:${{ inputs.tag }}"
|
|
|
|
extra_args=()
|
|
if [[ -n "${{ inputs.skip-dirs }}" ]]; then
|
|
extra_args+=(--skip-dirs "${{ inputs.skip-dirs }}")
|
|
echo "Excluding from scan: ${{ inputs.skip-dirs }}"
|
|
fi
|
|
|
|
# --ignore-unfixed: unfixed base-image CVEs are unactionable and would
|
|
# perma-block builds; the gate is on vulnerabilities with a fix.
|
|
echo "Scanning ${image_ref} (fail on: ${{ inputs.severity }}, fixed only)"
|
|
trivy image \
|
|
--scanners vuln \
|
|
--severity "${{ inputs.severity }}" \
|
|
--ignore-unfixed \
|
|
--exit-code 1 \
|
|
--no-progress \
|
|
"${extra_args[@]}" \
|
|
"${image_ref}"
|