82 lines
3.3 KiB
YAML
82 lines
3.3 KiB
YAML
name: Vulnerability Scan
|
|
|
|
on:
|
|
# enable running the workflow manually
|
|
workflow_dispatch:
|
|
schedule:
|
|
# run every night at 4:00 AM (UTC)
|
|
- cron: '0 4 * * *'
|
|
|
|
jobs:
|
|
trivy-scan:
|
|
# only on original eclipse-hawkbit/hawkbit repo or when manually triggered
|
|
if: github.repository == 'eclipse-hawkbit/hawkbit' || github.event_name == 'workflow_dispatch'
|
|
runs-on: ubuntu-latest
|
|
|
|
permissions:
|
|
contents: read
|
|
# needed for trivy scans upload
|
|
security-events: write
|
|
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Set up JDK
|
|
uses: actions/setup-java@v4
|
|
with:
|
|
distribution: "temurin"
|
|
java-version: 21
|
|
cache: "maven"
|
|
|
|
- name: Create hawkBit container images
|
|
run: |
|
|
mvn clean install -DskipTests && \
|
|
cd docker/build && \
|
|
chmod +x build_dev.sh && \
|
|
./build_dev.sh && \
|
|
cd ../../..
|
|
|
|
- name: Determine most recent Trivy version
|
|
run: |
|
|
echo "TRIVY_VERSION=$(wget -qO - 'https://api.github.com/repos/aquasecurity/trivy/releases/latest' | \
|
|
grep '\"tag_name\":' | sed -E 's/.*\"v([^\"]+)\".*/\1/')" >> $GITHUB_ENV
|
|
|
|
- name: Install Trivy
|
|
run: |
|
|
wget --no-verbose https://github.com/aquasecurity/trivy/releases/download/v${{ env.TRIVY_VERSION }}/trivy_${{ env.TRIVY_VERSION }}_Linux-64bit.tar.gz -O - | tar -zxvf -
|
|
|
|
- name: Scan Docker images
|
|
run: |
|
|
mkdir -p scans/eclipse-hawkbit/hawkbit
|
|
for IMAGE in $(docker image ls --format "{{.Repository}}:{{.Tag}}" "hawkbit/hawkbit-*:latest"); do
|
|
echo "Scanning image ${IMAGE} ..."
|
|
./trivy image "${IMAGE}" --ignore-unfixed --ignorefile .github/workflows/.trivyignore --severity HIGH,CRITICAL --vuln-type library --output "scans/eclipse-hawkbit/$IMAGE.sarif" --format sarif
|
|
done
|
|
|
|
- name: Upload Docker image scan results to GitHub Security tab hawkbit-ddi-server
|
|
uses: github/codeql-action/upload-sarif@v3
|
|
with:
|
|
sarif_file: 'scans/eclipse-hawkbit/hawkbit/hawkbit-ddi-server:latest.sarif'
|
|
category: "Container Images (hawkbit-ddi-server)"
|
|
- name: Upload Docker image scan results to GitHub Security tab hawkbit-dmf-server
|
|
uses: github/codeql-action/upload-sarif@v3
|
|
with:
|
|
sarif_file: 'scans/eclipse-hawkbit/hawkbit/hawkbit-dmf-server:latest.sarif'
|
|
category: "Container Images (hawkbit-dmf-server)"
|
|
- name: Upload Docker image scan results to GitHub Security tab hawkbit-mgmt-server
|
|
uses: github/codeql-action/upload-sarif@v3
|
|
with:
|
|
sarif_file: 'scans/eclipse-hawkbit/hawkbit/hawkbit-mgmt-server:latest.sarif'
|
|
category: "Container Images (hawkbit-mgmt-server)"
|
|
- name: Upload Docker image scan results to GitHub Security tab hawkbit-simple-ui
|
|
uses: github/codeql-action/upload-sarif@v3
|
|
with:
|
|
sarif_file: 'scans/eclipse-hawkbit/hawkbit/hawkbit-simple-ui:latest.sarif'
|
|
category: "Container Images (hawkbit-simple-ui)"
|
|
|
|
- name: Upload Docker image scan results to GitHub Security tab
|
|
uses: github/codeql-action/upload-sarif@v3
|
|
with:
|
|
sarif_file: 'scans/eclipse-hawkbit/hawkbit/hawkbit-update-server:latest.sarif'
|
|
category: "Container Images (hawkbit-update-server)" |