Added trivy to public-ci (intel#82)

Added Trivy to public-ci for scanning Docker image and repo --------- Signed-off-by: phansGithub <[email protected]>
redhat-et · Dec 4, 2023 · 810485a · 810485a
1 parent c979b7b
commit 810485a
Showing 1 changed file with 46 additions and 0 deletions.
diff --git a/.github/workflows/public-ci.yml b/.github/workflows/public-ci.yml
@@ -116,3 +116,49 @@ jobs:
 
     - name: unit-tests
       run: make test
+
+# Trivy Scan
+  trivy-scan:
+    runs-on: ubuntu-latest
+    permissions: write-all
+    steps: 
+
+    - name: Checkout code
+      uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+
+    - name: Run Trivy vulnerability scanner in repo mode
+      uses: aquasecurity/trivy-action@master
+      with:
+        scan-type: 'fs'
+        ignore-unfixed: true
+        format: 'sarif'
+        output: 'trivy-results.sarif'
+        severity: 'CRITICAL'
+
+    - name: Build image
+      run: make image
+
+    - name: Generate .tar image
+      run: docker save -o vul-image.tar localhost:5000/afxdp-device-plugin:latest
+
+
+    - name: Run Trivy on tarballed image 
+      uses: aquasecurity/trivy-action@master
+      with:
+        image-ref: /github/workspace/vul-image.tar
+        scan-type: 'fs'
+        ignore-unfixed: false
+        format: 'sarif'
+        output: 'trivy-image-results.sarif'
+        severity: 'CRITICAL'
+
+    - name: Upload Trivy scan results to GitHub Security tab
+      uses: github/codeql-action/upload-sarif@v2
+      with:
+        sarif_file: 'trivy-results.sarif'
+
+    - name: Print sarif file
+      run: cat < trivy-results.sarif
+
+    - name: Print image sarif file 
+      run: cat trivy-image-results.sarif