From 17bf633df9fd5d79aacbce50697b207e7eb0cf6c Mon Sep 17 00:00:00 2001 From: Michael Herdt Date: Tue, 28 Mar 2023 16:24:54 +0200 Subject: [PATCH] Scan only latest image. Do only scan library vulnerabilities. (#1339) --- .github/workflows/trivy-scan.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/trivy-scan.yml b/.github/workflows/trivy-scan.yml index 5dc50e3ca..cc64001a8 100644 --- a/.github/workflows/trivy-scan.yml +++ b/.github/workflows/trivy-scan.yml @@ -43,9 +43,9 @@ jobs: - name: Scan Docker images run: | mkdir -p scans/eclipse/hawkbit - for IMAGE in $(docker image ls --format "{{.Repository}}:{{.Tag}}" "hawkbit-*"); do + for IMAGE in $(docker image ls --format "{{.Repository}}:{{.Tag}}" "hawkbit-*:latest"); do echo "Scanning image ${IMAGE} ..." - ./trivy image "${IMAGE}" --ignore-unfixed --severity HIGH,CRITICAL --output "scans/eclipse/hawkbit/$IMAGE.sarif" --format sarif + ./trivy image "${IMAGE}" --ignore-unfixed --severity HIGH,CRITICAL --vuln-type library --output "scans/eclipse/hawkbit/$IMAGE.sarif" --format sarif done - name: Upload Docker image scan results to GitHub Security tab