rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update trivy-action to 0.36.0 and print findings in CI logs

Browse Source 
Bump aquasecurity/trivy-action from 0.35.0 to 0.36.0 (Trivy 0.70.0)
and add a step to print CVE findings from the SARIF output so they are
visible directly in CI logs.

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>
This commit is contained in:
Sacha Al Himdani
2026-04-23 11:50:03 +02:00
parent 800f3d4b02
commit b9cf93a306
2 changed files with 8 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
.github/workflows/make.yaml vendored
View File

@@ -153,21 +153,15 @@ jobs:
key: "trivy-db-${{ matrix.arch }}-${{ github.run_id }}" key: "trivy-db-${{ matrix.arch }}-${{ github.run_id }}"
restore-keys: "trivy-db-${{ matrix.arch }}-" restore-keys: "trivy-db-${{ matrix.arch }}-"
- name: "Scan Docker image with Trivy" - name: "Scan Docker image with Trivy"
uses: "aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1" # 0.35.0 uses: "aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25" # 0.36.0
with: with:
image-ref: "ghcr.io/getprobo/probo:snapshot-${{ matrix.arch }}" image-ref: "ghcr.io/getprobo/probo:snapshot-${{ matrix.arch }}"
format: "sarif" format: "table"
output: "trivy-results.sarif" exit-code: 1
exit-code: 0
ignore-unfixed: true ignore-unfixed: true
vuln-type: "os,library" vuln-type: "os,library"
severity: "CRITICAL,HIGH" severity: "CRITICAL,HIGH"
cache-dir: ~/.cache/trivy cache-dir: ~/.cache/trivy
- name: "Upload Trivy scan results"
uses: "github/codeql-action/upload-sarif@6bc82e05fd0ea64601dd4b465378bbcf57de0314" # v4.32.1
with:
sarif_file: "trivy-results.sarif"
category: "trivy-${{ matrix.arch }}"
# ── Snapshot: SBOM & vulnerability scan ──────────────────────────── # ── Snapshot: SBOM & vulnerability scan ────────────────────────────
snapshot-scan: snapshot-scan:

6
.github/workflows/release.yaml vendored
View File

@@ -315,7 +315,7 @@ jobs:
path: "archives" path: "archives"
merge-multiple: true merge-multiple: true
- name: "Scan Docker image with Trivy" - name: "Scan Docker image with Trivy"
uses: "aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1" # 0.35.0 uses: "aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25" # 0.36.0
with: with:
image-ref: "ghcr.io/getprobo/probo:${{ github.ref_name }}" image-ref: "ghcr.io/getprobo/probo:${{ github.ref_name }}"
format: "sarif" format: "sarif"
@@ -324,6 +324,10 @@ jobs:
ignore-unfixed: true ignore-unfixed: true
vuln-type: "os,library" vuln-type: "os,library"
severity: "CRITICAL,HIGH" severity: "CRITICAL,HIGH"
- name: "Print Trivy findings"
if: always()
run: |
jq -r '.runs[] | (.results // [])[] | .message.text' trivy-results.sarif
- name: "Upload Trivy scan results" - name: "Upload Trivy scan results"
uses: "github/codeql-action/upload-sarif@6bc82e05fd0ea64601dd4b465378bbcf57de0314" # v4.32.1 uses: "github/codeql-action/upload-sarif@6bc82e05fd0ea64601dd4b465378bbcf57de0314" # v4.32.1
if: always() if: always()