Skip to content

Commit b79aa3c

Browse files
cbandycbandy
committed
Stop using the upstream Trivy action
It lacks sufficient settings to control its cache and setup steps. Download Trivy data in a separate job and limit its concurrency. Issue: PGO-1893
1 parent 2112c3c commit b79aa3c

File tree

2 files changed

+125
-57
lines changed

2 files changed

+125
-57
lines changed

‎.github/actions/trivy/action.yaml‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
name: Trivy
2+
description: Scan this project using Trivy
3+
4+
# The Trivy team maintains an action, but it has trouble caching its vulnerability data:
5+
# https://github.com/aquasecurity/trivy-action/issues/389
6+
#
7+
# The action below uses any recent cache matching `cache-prefix` and calculates a cache key
8+
# derived from the data Trivy downloads.
9+
10+
inputs:
11+
cache:
12+
default: restore,success,use
13+
description: >-
14+
What Trivy data to cache; one or more of restore, save, success, or use.
15+
16+
setup:
17+
default: v0.57.0,cache
18+
description: >-
19+
How to install Trivy; one or more of version, none, or cache.
20+
21+
cache-directory:
22+
default: ${{ github.workspace }}/.cache/trivy
23+
24+
cache-prefix:
25+
default: cache-trivy
26+
27+
scan-target:
28+
default: .
29+
30+
scan-type:
31+
default: filesystem
32+
33+
runs:
34+
using: composite
35+
steps:
36+
# Parse list inputs as separated by commas and spaces.
37+
# Select the maximum version-looking string from `inputs.setup`.
38+
- id: parsed
39+
shell: bash
40+
run: |
41+
# Validate inputs
42+
(
43+
<<< '${{ inputs.cache }}' jq -rRsS '"cache=\(split("[,\\s]+"; "") - [""])"'
44+
<<< '${{ inputs.setup }}' jq -rRsS '
45+
"setup=\(split("[,\\s]+"; "") - [""])",
46+
"version=\(split("[,\\s]+"; "") | max_by(split("[v.]"; "") | map(tonumber?)))"
47+
'
48+
) | tee --append $GITHUB_OUTPUT
49+
50+
# Install Trivy as requested.
51+
- if: ${{ ! contains(fromJSON(steps.parsed.outputs.setup), 'none') }}
52+
uses: aquasecurity/[email protected]
53+
with:
54+
cache: ${{ contains(fromJSON(steps.parsed.outputs.setup), 'cache') }}
55+
version: ${{ steps.parsed.outputs.version }}
56+
57+
# Restore a recent cache beginning with the prefix.
58+
- id: restore
59+
if: ${{ contains(fromJSON(steps.parsed.outputs.cache), 'restore') }}
60+
uses: actions/cache/restore@v4
61+
with:
62+
path: ${{ inputs.cache-directory }}
63+
key: ${{ inputs.cache-prefix }}-
64+
65+
- id: trivy
66+
shell: bash
67+
env:
68+
TRIVY_CACHE_DIR: >-
69+
${{ contains(fromJSON(steps.parsed.outputs.cache), 'use') && inputs.cache-directory || '' }}
70+
run: |
71+
# Run Trivy
72+
trivy '${{ inputs.scan-type }}' '${{ inputs.scan-target }}' || result=$?
73+
74+
checksum=$([[ -z "${TRIVY_CACHE_DIR}" ]] || cat "${TRIVY_CACHE_DIR}/"*/metadata.json | sha256sum)
75+
echo 'cache-key=${{ inputs.cache-prefix }}-'"${checksum%% *}" >> $GITHUB_OUTPUT
76+
77+
exit "${result-0}"
78+
79+
# Save updated data to the cache when requested.
80+
- if: >-
81+
${{
82+
steps.restore.outcome == 'success' &&
83+
steps.restore.outputs.cache-matched-key == steps.trivy.outputs.cache-key
84+
}}
85+
shell: bash
86+
run: |
87+
# Cache hit on ${{ steps.restore.outputs.cache-matched-key }}
88+
- if: >-
89+
${{
90+
steps.restore.outputs.cache-matched-key != steps.trivy.outputs.cache-key &&
91+
(
92+
(contains(fromJSON(steps.parsed.outputs.cache), 'save') && !cancelled()) ||
93+
(contains(fromJSON(steps.parsed.outputs.cache), 'success') && success())
94+
)
95+
}}
96+
uses: actions/cache/save@v4
97+
with:
98+
key: ${{ steps.trivy.outputs.cache-key }}
99+
path: ${{ inputs.cache-directory }}

‎.github/workflows/trivy.yaml‎

Lines changed: 26 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -12,55 +12,21 @@ env:
1212
# https://github.com/actions/setup-go/issues/457
1313
GOTOOLCHAIN: local
1414

15-
# Manage the Trivy data directory until upstream can do it reliably
16-
# https://github.com/aquasecurity/trivy-action/issues/389
17-
#
18-
# NOTE: This must match the default "cache-dir" upstream:
19-
# https://github.com/aquasecurity/trivy-action/blob/-/action.yaml
20-
TRIVY_CACHE_DIR: ${{ github.workspace }}/.cache/trivy
21-
2215
jobs:
2316
cache:
17+
# Run only one of these jobs at a time across the entire project.
18+
concurrency: { group: trivy-cache }
19+
2420
runs-on: ubuntu-latest
2521
steps:
26-
- uses: aquasecurity/[email protected]
27-
with:
28-
cache: true
29-
version: v0.57.0
30-
31-
# The "aquasecurity/trivy-action" looks for data in the GitHub action
32-
# cache under a key with today's date.
33-
# - https://github.com/actions/cache/blob/-/restore#readme
34-
# - https://github.com/aquasecurity/trivy-action/blob/-/action.yaml
35-
- id: values
36-
run: |
37-
(
38-
date +'date=%Y-%m-%d'
39-
echo "glob=${TRIVY_CACHE_DIR}/*/metadata.json"
40-
) |
41-
tee --append $GITHUB_OUTPUT
42-
- id: restore
43-
uses: actions/cache/restore@v4
44-
with:
45-
key: cache-trivy-${{ steps.values.outputs.date }}
46-
path: ${{ env.TRIVY_CACHE_DIR }}
47-
restore-keys: cache-trivy-
48-
49-
# Validate or update the Trivy data cache.
50-
- id: validate
22+
- uses: actions/checkout@v4
23+
- name: Download Trivy
24+
uses: ./.github/actions/trivy
5125
env:
52-
METADATA_HASH: ${{ hashFiles(steps.values.outputs.glob) }}
53-
run: |
54-
<<< "before=${METADATA_HASH}" tee --append $GITHUB_OUTPUT
55-
trivy filesystem --download-db-only --scanners license,secret,vuln --quiet
56-
57-
# Save any successful changes back to the GitHub action cache.
58-
# - https://github.com/actions/cache/blob/-/save#readme
59-
- if: ${{ hashFiles(steps.values.outputs.glob) != steps.validate.outputs.before }}
60-
uses: actions/cache/save@v4
61-
with:
62-
key: ${{ steps.restore.outputs.cache-primary-key }}
63-
path: ${{ env.TRIVY_CACHE_DIR }}
26+
TRIVY_DEBUG: true
27+
TRIVY_DOWNLOAD_DB_ONLY: true
28+
TRIVY_NO_PROGRESS: true
29+
TRIVY_SCANNERS: license,secret,vuln
6430

6531
licenses:
6632
needs: [cache]
@@ -75,13 +41,13 @@ jobs:
7541

7642
# Report success only when detected licenses are listed in [/trivy.yaml].
7743
- name: Scan licenses
78-
uses: aquasecurity/[email protected]
44+
uses: ./.github/actions/trivy
7945
env:
8046
TRIVY_DEBUG: true
47+
TRIVY_EXIT_CODE: 1
48+
TRIVY_SCANNERS: license
8149
with:
82-
scan-type: filesystem
83-
scanners: license
84-
exit-code: 1
50+
cache: restore,use
8551

8652
vulnerabilities:
8753
if: ${{ github.repository == 'CrunchyData/postgres-operator' }}
@@ -97,21 +63,24 @@ jobs:
9763
# human consumption. This step fails only when Trivy is unable to scan.
9864
# A later step uploads results to GitHub as a pull request check.
9965
- name: Log detected vulnerabilities
100-
uses: aquasecurity/[email protected]
66+
uses: ./.github/actions/trivy
67+
env:
68+
TRIVY_SCANNERS: secret,vuln
10169
with:
102-
scan-type: filesystem
103-
scanners: secret,vuln
70+
cache: restore,use
10471

10572
# Produce a SARIF report of actionable results. This step fails only when
10673
# Trivy is unable to scan.
10774
- name: Report actionable vulnerabilities
108-
uses: aquasecurity/[email protected]
75+
uses: ./.github/actions/trivy
76+
env:
77+
TRIVY_IGNORE_UNFIXED: true
78+
TRIVY_FORMAT: 'sarif'
79+
TRIVY_OUTPUT: 'trivy-results.sarif'
80+
TRIVY_SCANNERS: secret,vuln
10981
with:
110-
scan-type: filesystem
111-
ignore-unfixed: true
112-
format: 'sarif'
113-
output: 'trivy-results.sarif'
114-
scanners: secret,vuln
82+
cache: use
83+
setup: none
11584

11685
# Submit the SARIF report to GitHub code scanning. Pull requests checks
11786
# succeed or fail according to branch protection rules.

0 commit comments

Comments
 (0)