Skip to content

Commit 59c978f

Browse files
AlexanderDokuchaevAlexanderDokuchaev
authored
[gha] trivy (#3316)
### Changes Add trivy check Custom template .github/scripts/trivy_html.tpl (like in jenkins), original is not show path to checked file ### Tests https://github.com/AlexanderDokuchaev/nncf/actions/runs/13554528994
1 parent 77d2556 commit 59c978f

File tree

2 files changed

+185
-0
lines changed

2 files changed

+185
-0
lines changed

‎.github/scripts/trivy_html.tpl

+148
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,148 @@
1+
<!DOCTYPE html>
2+
<html>
3+
<head>
4+
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
5+
{{- if . }}
6+
<style>
7+
* {
8+
font-family: Arial, Helvetica, sans-serif;
9+
}
10+
h1 {
11+
text-align: center;
12+
}
13+
.group-header th {
14+
font-size: 200%;
15+
}
16+
.sub-header th {
17+
font-size: 150%;
18+
}
19+
table, th, td {
20+
border: 1px solid black;
21+
border-collapse: collapse;
22+
white-space: nowrap;
23+
padding: .3em;
24+
}
25+
table {
26+
margin: 0 auto;
27+
}
28+
.severity {
29+
text-align: center;
30+
font-weight: bold;
31+
color: #fafafa;
32+
}
33+
.severity-LOW .severity { background-color: #5fbb31; }
34+
.severity-MEDIUM .severity { background-color: #e9c600; }
35+
.severity-HIGH .severity { background-color: #ff8800; }
36+
.severity-CRITICAL .severity { background-color: #e40000; }
37+
.severity-UNKNOWN .severity { background-color: #747474; }
38+
.severity-LOW { background-color: #5fbb3160; }
39+
.severity-MEDIUM { background-color: #e9c60060; }
40+
.severity-HIGH { background-color: #ff880060; }
41+
.severity-CRITICAL { background-color: #e4000060; }
42+
.severity-UNKNOWN { background-color: #74747460; }
43+
table tr td:first-of-type {
44+
font-weight: bold;
45+
}
46+
.links a,
47+
.links[data-more-links=on] a {
48+
display: block;
49+
}
50+
.links[data-more-links=off] a:nth-of-type(1n+5) {
51+
display: none;
52+
}
53+
a.toggle-more-links { cursor: pointer; }
54+
</style>
55+
<title>{{- escapeXML ( index . 0 ).Target }} - Trivy Report - {{ now }} </title>
56+
<script>
57+
window.onload = function() {
58+
document.querySelectorAll('td.links').forEach(function(linkCell) {
59+
var links = [].concat.apply([], linkCell.querySelectorAll('a'));
60+
[].sort.apply(links, function(a, b) {
61+
return a.href > b.href ? 1 : -1;
62+
});
63+
links.forEach(function(link, idx) {
64+
if (links.length > 3 && 3 === idx) {
65+
var toggleLink = document.createElement('a');
66+
toggleLink.innerText = "Toggle more links";
67+
toggleLink.href = "#toggleMore";
68+
toggleLink.setAttribute("class", "toggle-more-links");
69+
linkCell.appendChild(toggleLink);
70+
}
71+
linkCell.appendChild(link);
72+
});
73+
});
74+
document.querySelectorAll('a.toggle-more-links').forEach(function(toggleLink) {
75+
toggleLink.onclick = function() {
76+
var expanded = toggleLink.parentElement.getAttribute("data-more-links");
77+
toggleLink.parentElement.setAttribute("data-more-links", "on" === expanded ? "off" : "on");
78+
return false;
79+
};
80+
});
81+
};
82+
</script>
83+
</head>
84+
<body>
85+
<h1>Trivy Report: {{ now }}</h1>
86+
<table>
87+
{{- range . }}
88+
<tr class="group-header"><th colspan="6">{{ .Type | toString | escapeXML }}: {{ .Target | toString | escapeXML }}</th></tr>
89+
{{- if (eq (len .Vulnerabilities) 0) }}
90+
<tr><th colspan="6">No Vulnerabilities found</th></tr>
91+
{{- else }}
92+
<tr class="sub-header">
93+
<th>Package</th>
94+
<th>Vulnerability ID</th>
95+
<th>Severity</th>
96+
<th>Installed Version</th>
97+
<th>Fixed Version</th>
98+
<th>Links</th>
99+
</tr>
100+
{{- range .Vulnerabilities }}
101+
<tr class="severity-{{ escapeXML .Vulnerability.Severity }}">
102+
<td class="pkg-name">{{ escapeXML .PkgName }}</td>
103+
<td>{{ escapeXML .VulnerabilityID }}</td>
104+
<td class="severity">{{ escapeXML .Vulnerability.Severity }}</td>
105+
<td class="pkg-version">{{ escapeXML .InstalledVersion }}</td>
106+
<td>{{ escapeXML .FixedVersion }}</td>
107+
<td class="links" data-more-links="off">
108+
{{- range .Vulnerability.References }}
109+
<a href={{ escapeXML . | printf "%q" }}>{{ escapeXML . }}</a>
110+
{{- end }}
111+
</td>
112+
</tr>
113+
{{- end }}
114+
{{- end }}
115+
{{- if (eq (len .Misconfigurations ) 0) }}
116+
<tr><th colspan="6">No Misconfigurations found</th></tr>
117+
{{- else }}
118+
<tr class="sub-header">
119+
<th>Type</th>
120+
<th>Misconf ID</th>
121+
<th>Check</th>
122+
<th>Severity</th>
123+
<th>Message</th>
124+
</tr>
125+
{{- range .Misconfigurations }}
126+
<tr class="severity-{{ escapeXML .Severity }}">
127+
<td class="misconf-type">{{ escapeXML .Type }}</td>
128+
<td>{{ escapeXML .ID }}</td>
129+
<td class="misconf-check">{{ escapeXML .Title }}</td>
130+
<td class="severity">{{ escapeXML .Severity }}</td>
131+
<td class="link" data-more-links="off" style="white-space:normal;">
132+
{{ escapeXML .Message }}
133+
<br>
134+
<a href={{ escapeXML .PrimaryURL | printf "%q" }}>{{ escapeXML .PrimaryURL }}</a>
135+
</br>
136+
</td>
137+
</tr>
138+
{{- end }}
139+
{{- end }}
140+
{{- end }}
141+
</table>
142+
{{- else }}
143+
</head>
144+
<body>
145+
<h1>Trivy Returned Empty Report</h1>
146+
{{- end }}
147+
</body>
148+
</html>

‎.github/workflows/sdl.yml

+37
Original file line numberDiff line numberDiff line change
@@ -70,3 +70,40 @@ jobs:
7070
with:
7171
name: codeql-scan-results
7272
path: "./codeql*.pdf"
73+
74+
trivy:
75+
name: Trivy
76+
runs-on: ubuntu-latest
77+
timeout-minutes: 10
78+
# Skip trivy for PRs to avoid blocking merge PRs by found vulnerabilities in requirements
79+
if: ${{ github.event_name != 'pull_request' }}
80+
steps:
81+
- name: Checkout repository
82+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
83+
- name: Run trivy
84+
uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # v0.29.0
85+
with:
86+
scan-type: "fs"
87+
scan-ref: .
88+
severity: "CRITICAL,HIGH"
89+
scanners: "misconfig,license,vuln"
90+
format: template
91+
template: "@.github/scripts/trivy_html.tpl"
92+
output: trivy_report.html
93+
cache: false
94+
hide-progress: true
95+
exit-code: 1
96+
- name: Rename Report
97+
if: ${{ !cancelled() }}
98+
shell: bash
99+
run: |
100+
DATE=$(date +"%Y-%m-%d")
101+
REF_NAME="${{ github.ref_name }}"
102+
mv "trivy_report.html" "trivy_report_${DATE}_${REF_NAME//\//-}_${{ github.sha }}.html"
103+
- name: Upload Scan Results
104+
if: ${{ !cancelled() }}
105+
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 #v4.6.0
106+
with:
107+
name: trivy-report
108+
path: "./trivy_report*.html"
109+
retention-days: 30

0 commit comments

Comments
 (0)