Skip to content

Maintenance #440

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ikostan merged 2 commits into from
Mar 2, 2026
Merged

Maintenance #440

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3f37409
Delete _trivy.yml
ikostan Mar 2, 2026
fe656a6
Update trivy.yml
ikostan Mar 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 0 additions & 41 deletions .github/workflows/_trivy.yml
View file
Open in desktop

This file was deleted.

27 changes: 19 additions & 8 deletions .github/workflows/trivy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,17 +13,28 @@ jobs:
security-events: write # For uploading SARIF to Security tab
steps:
- name: "Checkout repository"
uses: "actions/checkout@v4"
uses: "actions/checkout@v6"

@sourcery-ai sourcery-ai Bot Mar 2, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

issue (bug_risk): The actions/checkout@v6 reference is likely invalid and will cause the job to fail.

actions/checkout currently only goes up to v4, so @v6 will fail to resolve and the workflow will stop before reaching the Trivy step. Use actions/checkout@v4 (or a pinned v4 commit) instead.

with:
# This explicitly tells the runner to use the branch that triggered the workflow
ref: ${{ github.ref_name }}
fetch-depth: 0
persist-credentials: false
- name: "Run Trivy vulnerability scanner"
uses: "aquasecurity/trivy-action@0.69.2"
Comment on lines +22 to +23

@sourcery-ai sourcery-ai Bot Mar 2, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚨 suggestion (security): The Trivy action is version-tagged and also configured with version: 'latest', which reduces reproducibility and supply-chain safety.

Relying on a floating tag and version: 'latest' makes the workflow vulnerable to tag retargeting and unexpected upgrades. Please:

  • Pin aquasecurity/trivy-action to the commit SHA of the intended release (e.g., the SHA for v0.69.2), and
  • Either drop the version input or set it to a specific Trivy CLI version so scans are deterministic.
    This keeps behavior stable even if tags move or future Trivy releases change behavior.

Suggested implementation:

      - name: "Run Trivy vulnerability scanner"
        uses: "aquasecurity/trivy-action@<TRIVY_ACTION_V0_69_2_COMMIT_SHA>"  # Pinned to SHA for v0.69.2
        # uses: "aquasecurity/trivy-action@0.69.2"  # v0.69.2 tag (do not use floating tags in production)
        # uses: "aquasecurity/trivy-action@c1824fd6edce30d7ab345a9989de00bbd46ef284"  # Pinned to SHA for v0.34.0
        env:  # Suppress version check notification
          TRIVY_SKIP_VERSION_CHECK: 'true'
        with:
          version: '0.69.2'
          scan-type: 'fs'  # Scans the filesystem (your repo after checkout)
  1. Replace &lt;TRIVY_ACTION_V0_69_2_COMMIT_SHA&gt; with the actual commit SHA corresponding to the Trivy action release v0.69.2 (from https://github.com/aquasecurity/trivy-action/releases or the v0.69.2 tag).
  2. Optionally, if the Trivy CLI version you want differs from the action version, update version: '0.69.2' to the exact CLI version you intend to standardize on, and document this in a comment for future maintainers.

# uses: "aquasecurity/trivy-action@c1824fd6edce30d7ab345a9989de00bbd46ef284" # Pinned to SHA for v0.34.0
env: # Suppress version check notification
TRIVY_SKIP_VERSION_CHECK: 'true'
with:
version: 'latest'
scan-type: 'fs' # Scans the filesystem (your repo after checkout)
scanners: 'vuln,secret,misconfig,license' # Vulns, secrets, configs, licenses
hide-progress: false
format: 'sarif' # Outputs in SARIF for GitHub integration (shows in Security tab)
output: 'trivy-results.sarif'
severity: 'CRITICAL,HIGH' # Focus on serious issues
exit-code: '1' # Fail the workflow if critical/high vulns found (set to '0' to not fail)
ignore-unfixed: true # Ignore vulns without fixes available

- name: "Install Trivy"
run: |
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v0.48.3

- name: "Run Trivy FS Scan"
run: |
trivy fs --format sarif -exit-code 1 --output trivy-results.sarif --severity CRITICAL,HIGH --ignore-unfixed .
- name: "Upload Trivy scan results to GitHub Security tab"
uses: "github/codeql-action/upload-sarif@ef618feace3c4838ae42b239ab86e8fb46437508" # Pinned to SHA for v4.32.2
if: always() # Upload even if scan fails
Expand Down
Loading