diff --git a/.github/.zizmor.yml b/.github/.zizmor.yml index d76efd0dcf..709ff942f3 100644 --- a/.github/.zizmor.yml +++ b/.github/.zizmor.yml @@ -10,9 +10,3 @@ rules: # access to commit signatures). Mitigated: checkout uses ref: main # (not PR head), no untrusted input in run: steps. - cla.yml - - template-injection: - ignore: - # steps.scan-ref.outputs.ref is set by echo in the same job (not - # user-controllable). zizmor flags it at Low confidence. - - docker.yml diff --git a/.github/actions/build-apko-base/action.yml b/.github/actions/build-apko-base/action.yml index ba5b69e745..fdbd924413 100644 --- a/.github/actions/build-apko-base/action.yml +++ b/.github/actions/build-apko-base/action.yml @@ -100,7 +100,8 @@ runs: curl -sfL --retry 5 --retry-delay 5 --retry-all-errors "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" -o "/tmp/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" curl -sfL --retry 5 --retry-delay 5 --retry-all-errors "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_checksums.txt" -o /tmp/trivy_checksums.txt (cd /tmp && grep "trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" trivy_checksums.txt | sha256sum -c -) - tar -xzf "/tmp/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" -C /usr/local/bin trivy + tar -xzf "/tmp/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" -C /tmp trivy + sudo install -m 0755 /tmp/trivy /usr/local/bin/trivy - name: Trivy scan shell: bash @@ -120,19 +121,14 @@ runs: - name: Trivy SARIF scan if: always() - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 - with: # zizmor: ignore[template-injection] - image-ref: ghcr.io/aureliolo/synthorg-${{ inputs.image-name }}-base:${{ steps.image-ref.outputs.tag }} - format: sarif - output: trivy-${{ inputs.image-name }}-base.sarif - exit-code: "0" - severity: CRITICAL,HIGH - # Pin trivy version as a literal so zizmor's `unpinned-tools` - # audit recognises the pin. Keep in sync with TRIVY_VERSION env - # vars used by the curl-install steps in this composite. - # renovate: datasource=github-releases depName=aquasecurity/trivy - version: v0.70.0 - trivyignores: .github/.trivyignore.yaml + shell: bash + env: + IMAGE_NAME: ${{ inputs.image-name }} + IMAGE_TAG: ${{ steps.image-ref.outputs.tag }} + run: | + IMAGE_REF="ghcr.io/aureliolo/synthorg-${IMAGE_NAME}-base:${IMAGE_TAG}" + trivy image "${IMAGE_REF}" --format sarif --output "trivy-${IMAGE_NAME}-base.sarif" \ + --exit-code 0 --severity CRITICAL,HIGH --ignorefile .github/.trivyignore.yaml - name: Upload SARIF to GitHub Security if: always() diff --git a/.github/actions/build-scan-image/action.yml b/.github/actions/build-scan-image/action.yml index dd544181d3..ba2c03c1d2 100644 --- a/.github/actions/build-scan-image/action.yml +++ b/.github/actions/build-scan-image/action.yml @@ -89,6 +89,9 @@ inputs: enable. required: false default: "false" + trivy-version: + description: "Trivy version, WITHOUT a leading `v` (e.g. `0.70.0`). The release download URL adds the `v` prefix; the tarball filename does not." + required: true outputs: ref_amd64: @@ -308,20 +311,28 @@ runs: DISPLAY_NAME: ${{ inputs.display-name }} run: scripts/report-image-size.sh "$SCAN_REF" "$DISPLAY_NAME (arm64)" + - name: Install Trivy + shell: bash + env: + TRIVY_VERSION: ${{ inputs.trivy-version }} + run: | + curl -sfL --retry 5 --retry-delay 5 --retry-all-errors "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" -o "/tmp/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" + curl -sfL --retry 5 --retry-delay 5 --retry-all-errors "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_checksums.txt" -o /tmp/trivy_checksums.txt + (cd /tmp && grep "trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" trivy_checksums.txt | sha256sum -c -) + tar -xzf "/tmp/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" -C /tmp trivy + sudo install -m 0755 /tmp/trivy /usr/local/bin/trivy + # Trivy JSON + SARIF + CIS benchmark per arch. JSON feeds # evaluate-scan.sh (fails on CRITICAL, warns on HIGH). SARIF goes to # GitHub Security for both arches with distinct categories. - name: Trivy scan (amd64) - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 - with: - image-ref: ${{ steps.scan-ref.outputs.ref_amd64 }} - format: json - output: trivy-${{ inputs.image-name }}-amd64.json - exit-code: "0" - severity: CRITICAL,HIGH - trivyignores: .github/.trivyignore.yaml - # renovate: datasource=github-releases depName=aquasecurity/trivy - version: v0.70.0 + shell: bash + env: + IMAGE_NAME: ${{ inputs.image-name }} + SCAN_REF: ${{ steps.scan-ref.outputs.ref_amd64 }} + run: | + trivy image "${SCAN_REF}" --format json --output "trivy-${IMAGE_NAME}-amd64.json" \ + --exit-code 0 --severity CRITICAL,HIGH --ignorefile .github/.trivyignore.yaml - name: Evaluate Trivy results (amd64) shell: bash @@ -332,16 +343,13 @@ runs: - name: Trivy scan (arm64) if: github.event_name != 'pull_request' && inputs.enable-arm64 == 'true' - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 - with: - image-ref: ${{ steps.scan-ref.outputs.ref_arm64 }} - format: json - output: trivy-${{ inputs.image-name }}-arm64.json - exit-code: "0" - severity: CRITICAL,HIGH - trivyignores: .github/.trivyignore.yaml - # renovate: datasource=github-releases depName=aquasecurity/trivy - version: v0.70.0 + shell: bash + env: + IMAGE_NAME: ${{ inputs.image-name }} + SCAN_REF: ${{ steps.scan-ref.outputs.ref_arm64 }} + run: | + trivy image "${SCAN_REF}" --format json --output "trivy-${IMAGE_NAME}-arm64.json" \ + --exit-code 0 --severity CRITICAL,HIGH --ignorefile .github/.trivyignore.yaml - name: Evaluate Trivy results (arm64) if: github.event_name != 'pull_request' && inputs.enable-arm64 == 'true' @@ -362,16 +370,13 @@ runs: - name: Trivy SARIF scan (amd64) if: always() - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 - with: - image-ref: ${{ steps.scan-ref.outputs.ref_amd64 }} - format: sarif - output: trivy-${{ inputs.image-name }}-amd64.sarif - exit-code: "0" - severity: CRITICAL,HIGH - trivyignores: .github/.trivyignore.yaml - # renovate: datasource=github-releases depName=aquasecurity/trivy - version: v0.70.0 + shell: bash + env: + IMAGE_NAME: ${{ inputs.image-name }} + SCAN_REF: ${{ steps.scan-ref.outputs.ref_amd64 }} + run: | + trivy image "${SCAN_REF}" --format sarif --output "trivy-${IMAGE_NAME}-amd64.sarif" \ + --exit-code 0 --severity CRITICAL,HIGH --ignorefile .github/.trivyignore.yaml - name: Upload SARIF amd64 to GitHub Security if: always() @@ -382,16 +387,13 @@ runs: - name: Trivy SARIF scan (arm64) if: always() && github.event_name != 'pull_request' && inputs.enable-arm64 == 'true' - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 - with: - image-ref: ${{ steps.scan-ref.outputs.ref_arm64 }} - format: sarif - output: trivy-${{ inputs.image-name }}-arm64.sarif - exit-code: "0" - severity: CRITICAL,HIGH - trivyignores: .github/.trivyignore.yaml - # renovate: datasource=github-releases depName=aquasecurity/trivy - version: v0.70.0 + shell: bash + env: + IMAGE_NAME: ${{ inputs.image-name }} + SCAN_REF: ${{ steps.scan-ref.outputs.ref_arm64 }} + run: | + trivy image "${SCAN_REF}" --format sarif --output "trivy-${IMAGE_NAME}-arm64.sarif" \ + --exit-code 0 --severity CRITICAL,HIGH --ignorefile .github/.trivyignore.yaml - name: Upload SARIF arm64 to GitHub Security if: always() && github.event_name != 'pull_request' && inputs.enable-arm64 == 'true' diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml index 8657bc1a6f..109a2b8311 100644 --- a/.github/workflows/docker.yml +++ b/.github/workflows/docker.yml @@ -532,6 +532,7 @@ jobs: base-image-digest: ${{ needs.build-backend-base-publish.outputs.digest }} base-image-artifact-name: ${{ needs.build-backend-base.outputs.artifact-name }} base-image-tarball-name: ${{ needs.build-backend-base.outputs.tarball-name }} + trivy-version: ${{ env.TRIVY_VERSION }} # ``LOGFIRE_PROJECT_TOKEN`` is the GHA repo secret; the # Dockerfile's ``embed_logfire_token.py`` step writes it # into ``_embedded_token.py`` before ``uv sync`` packages @@ -810,35 +811,35 @@ jobs: run: echo "ref=ghcr.io/aureliolo/synthorg-web:sha-${GITHUB_SHA::7}" >> "$GITHUB_OUTPUT" - name: Report image size - run: scripts/report-image-size.sh "${{ steps.scan-ref.outputs.ref }}" "Web" + env: + SCAN_REF: ${{ steps.scan-ref.outputs.ref }} + run: scripts/report-image-size.sh "${SCAN_REF}" "Web" + + - name: Install Trivy + run: | + curl -sfL --retry 5 --retry-delay 5 --retry-all-errors "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" -o "/tmp/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" + curl -sfL --retry 5 --retry-delay 5 --retry-all-errors "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_checksums.txt" -o /tmp/trivy_checksums.txt + (cd /tmp && grep "trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" trivy_checksums.txt | sha256sum -c -) + tar -xzf "/tmp/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" -C /tmp trivy + sudo install -m 0755 /tmp/trivy /usr/local/bin/trivy - name: Trivy scan - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 - with: - image-ref: ${{ steps.scan-ref.outputs.ref }} - format: json - output: trivy-web.json - exit-code: "0" - severity: CRITICAL,HIGH - trivyignores: .github/.trivyignore.yaml - # renovate: datasource=github-releases depName=aquasecurity/trivy - version: v0.70.0 + env: + SCAN_REF: ${{ steps.scan-ref.outputs.ref }} + run: | + trivy image "${SCAN_REF}" --format json --output trivy-web.json \ + --exit-code 0 --severity CRITICAL,HIGH --ignorefile .github/.trivyignore.yaml - name: Evaluate Trivy results run: scripts/evaluate-scan.sh --verbose trivy-web.json "Web" - name: Trivy SARIF scan (web) if: always() - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 - with: - image-ref: ${{ steps.scan-ref.outputs.ref }} - format: sarif - output: trivy-web.sarif - exit-code: "0" - severity: CRITICAL,HIGH - trivyignores: .github/.trivyignore.yaml - # renovate: datasource=github-releases depName=aquasecurity/trivy - version: v0.70.0 + env: + SCAN_REF: ${{ steps.scan-ref.outputs.ref }} + run: | + trivy image "${SCAN_REF}" --format sarif --output trivy-web.sarif \ + --exit-code 0 --severity CRITICAL,HIGH --ignorefile .github/.trivyignore.yaml - name: Upload SARIF to GitHub Security (web) if: always() @@ -948,6 +949,7 @@ jobs: base-image-digest: ${{ needs.build-sandbox-base-publish.outputs.digest }} base-image-artifact-name: ${{ needs.build-sandbox-base.outputs.artifact-name }} base-image-tarball-name: ${{ needs.build-sandbox-base.outputs.tarball-name }} + trivy-version: ${{ env.TRIVY_VERSION }} build-sandbox-publish: name: Publish Sandbox @@ -1010,6 +1012,7 @@ jobs: base-image-digest: ${{ needs.build-sidecar-base-publish.outputs.digest }} base-image-artifact-name: ${{ needs.build-sidecar-base.outputs.artifact-name }} base-image-tarball-name: ${{ needs.build-sidecar-base.outputs.tarball-name }} + trivy-version: ${{ env.TRIVY_VERSION }} build-sidecar-publish: name: Publish Sidecar @@ -1096,6 +1099,7 @@ jobs: enable-arm64: "false" cache-scope: fine-tune-${{ matrix.variant }} free-disk-space: "true" + trivy-version: ${{ env.TRIVY_VERSION }} build-fine-tune-publish: name: Publish Fine-Tune