CI: cache Trivy vulnerability database for repo and filesystem scans#3290
CI: cache Trivy vulnerability database for repo and filesystem scans#3290arkid15r merged 2 commits intoOWASP:mainfrom
Conversation
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings. WalkthroughAdds explicit "Setup Trivy" steps with caching to CI jobs and sets Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
.github/workflows/run-ci-cd.yaml (2)
137-141: Consider pinning the Trivy version for consistency.The Setup Trivy step correctly enables caching, which will improve CI performance. However, no Trivy version is specified here, while the production scans (lines 782-786) explicitly pin to
v0.62.1. This inconsistency could lead to different Trivy versions running across jobs in the same workflow.♻️ Suggested version pinning for consistency
- name: Setup Trivy uses: aquasecurity/setup-trivy@e6c2c5e321ed9123bda567646e2f96565e34abe1 with: cache: true + version: v0.62.1
163-167: Consider pinning the Trivy version for consistency.Same as the scan-code job, this Setup Trivy step should specify
version: v0.62.1to match the production scans and ensure consistent vulnerability detection across all jobs.♻️ Suggested version pinning
- name: Setup Trivy uses: aquasecurity/setup-trivy@e6c2c5e321ed9123bda567646e2f96565e34abe1 with: cache: true + version: v0.62.1
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/run-ci-cd.yaml
🧰 Additional context used
🧠 Learnings (1)
📚 Learning: 2025-12-21T19:03:59.068Z
Learnt from: ahmedxgouda
Repo: OWASP/Nest PR: 1139
File: .github/workflows/setup-backend-environment/action.yaml:16-27
Timestamp: 2025-12-21T19:03:59.068Z
Learning: Composite actions (runs: using: composite) execute as steps within the calling job's context and can access the job context, including job.services.* properties (e.g., job.services.<service_id>.id, job.services.<service_id>.ports). Service containers must be defined at the job level, but a composite action's steps can reference them via the job context.
Applied to files:
.github/workflows/run-ci-cd.yaml
🔇 Additional comments (5)
.github/workflows/run-ci-cd.yaml (5)
142-148: LGTM! Correctly reuses cached Trivy DB.The
skip-setup-trivy: trueflag appropriately prevents redundant database downloads by reusing the cached DB from the Setup Trivy step.
168-174: LGTM! Correctly reuses cached Trivy DB.The
skip-setup-trivy: trueflag appropriately prevents redundant setup and reuses the cached database.
782-786: LGTM! Good practice pinning the Trivy version.This Setup Trivy step correctly enables caching and explicitly pins to v0.62.1, ensuring deterministic scans. This version should also be used in the scan-code and scan-ci-dependencies jobs for consistency.
788-806: LGTM! Both image scans correctly reuse the cached DB.Both the backend and frontend image scans appropriately set
skip-setup-trivy: trueto reuse the cached Trivy database, avoiding redundant downloads.
411-442: Verify whether scan-staging-images should also use cached Trivy DB.The
scan-staging-imagesjob was not updated with the Setup Trivy caching pattern, unlikescan-production-images. This means staging image scans will continue re-downloading the Trivy database on each run (~1-2 minutes overhead per the issue).For consistency and to maximize CI performance gains, consider applying the same caching pattern here:
- Add a Setup Trivy step with
cache: trueandversion: v0.62.1- Add
skip-setup-trivy: trueto both image scan steps- Remove the
version: latestparameters from lines 431 and 442♻️ Suggested changes to enable caching
Add Setup Trivy step after line 420:
- name: Setup Trivy uses: aquasecurity/setup-trivy@e6c2c5e321ed9123bda567646e2f96565e34abe1 with: cache: true version: v0.62.1Update backend scan:
- name: Scan backend image continue-on-error: true uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 with: exit-code: 1 image-ref: owasp/nest:backend-staging scan-type: image + skip-setup-trivy: true trivy-config: trivy.yaml trivyignores: trivyignore.yaml - version: latestUpdate frontend scan similarly:
- name: Scan frontend image continue-on-error: true uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 with: exit-code: 1 image-ref: owasp/nest:frontend-staging scan-type: image + skip-setup-trivy: true trivy-config: trivy.yaml trivyignores: trivyignore.yaml - version: latest
|
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
.github/workflows/run-ci-cd.yaml (1)
411-443: Consider applying the same caching pattern for consistency.The
scan-staging-imagesjob doesn't use the Trivy caching pattern that's now implemented inscan-code,scan-ci-dependencies, andscan-production-images. Adding the Setup Trivy step here would improve consistency and CI performance.♻️ Suggested refactor to add caching
Add the Setup Trivy step after the checkout and remove
version: latestfrom the scan steps:- name: Check out repository uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 + - name: Setup Trivy + uses: aquasecurity/setup-trivy@e6c2c5e321ed9123bda567646e2f96565e34abe1 + with: + cache: true + - name: Scan backend image continue-on-error: true uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 with: exit-code: 1 image-ref: owasp/nest:backend-staging scan-type: image + skip-setup-trivy: true trivy-config: trivy.yaml trivyignores: trivyignore.yaml - version: latest - name: Scan frontend image continue-on-error: true uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 with: exit-code: 1 image-ref: owasp/nest:frontend-staging scan-type: image + skip-setup-trivy: true trivy-config: trivy.yaml trivyignores: trivyignore.yaml - version: latest
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
.github/workflows/run-ci-cd.yaml
🧰 Additional context used
🧠 Learnings (1)
📚 Learning: 2025-12-21T19:03:59.068Z
Learnt from: ahmedxgouda
Repo: OWASP/Nest PR: 1139
File: .github/workflows/setup-backend-environment/action.yaml:16-27
Timestamp: 2025-12-21T19:03:59.068Z
Learning: Composite actions (runs: using: composite) execute as steps within the calling job's context and can access the job context, including job.services.* properties (e.g., job.services.<service_id>.id, job.services.<service_id>.ports). Service containers must be defined at the job level, but a composite action's steps can reference them via the job context.
Applied to files:
.github/workflows/run-ci-cd.yaml
🔇 Additional comments (2)
.github/workflows/run-ci-cd.yaml (2)
163-174: LGTM! Caching pattern correctly implemented.The Setup Trivy step and
skip-setup-trivy: trueparameter are correctly configured. This job will benefit from the cached Trivy database, reducing CI execution time. The implementation is consistent with both thescan-codeandscan-production-imagesjobs.
137-148: LGTM! Caching pattern correctly implemented.The addition of the Setup Trivy step with
cache: trueand theskip-setup-trivy: trueparameter correctly follows the pattern established in thescan-production-imagesjob. This should reduce workflow execution time by caching the Trivy vulnerability database.Note: The
scan-staging-imagesjob still usesversion: latestwithout the Setup Trivy caching step. Consider updating it for consistency if that job's performance is also a concern.
2 participants
Proposed change
Resolves #3268
This PR enables caching of the Trivy vulnerability database for the
scan-codeandscan-ci-dependenciesjobs.It adds the
aquasecurity/setup-trivystep with caching enabled and updates the Trivy scan steps to reuse the cached database, following the same pattern already used in thescan-production-imagesjob.There is no change to scan behavior, configuration, or results.
The change only avoids re-downloading the Trivy DB on every workflow run, improving CI performance and consistency.
Checklist
make check-testlocally and all tests passed