actions/superlint
1
0
Fork 0
mirror of https://github.com/super-linter/super-linter.git synced 2024-11-25 10:10:56 -05:00
Code Issues Projects Releases Packages Wiki Activity

Reinstate Trivy with no blocks for vulnerabilities found (#1455)

Browse source 
* enable trivy

* enable docker build

* Add audit fix to patch vulns

* exit success on vulnerabilities found
This commit is contained in:
Zack Koppert 2021-04-17 14:50:23 -07:00 committed by GitHub
parent a908937c78
commit 786e7056de
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 44 additions and 44 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

85
.github/workflows/trivy.yml vendored
View file

@ -1,47 +1,46 @@
# Disabling trivy scans while they get troubleshooting for failures # Disabling trivy scans while they get troubleshooting for failures
# --- ---
# name: Container Security Scan with Trivy name: Container Security Scan with Trivy
# on: on:
# push: push:
# branches: branches:
# - master - master
# pull_request: pull_request:
# jobs: jobs:
# scan-container: scan-container:
# name: Build name: Build
# runs-on: ubuntu-18.04 runs-on: ubuntu-18.04
# steps: steps:
# ###################### ######################
# # Checkout code base # # Checkout code base #
# ###################### ######################
# - name: Checkout code - name: Checkout code
# uses: actions/checkout@v2 uses: actions/checkout@v2
# # ########################## # ##########################
# # # Build the docker image # # # Build the docker image #
# # ########################## # ##########################
# # - name: Build an image from Dockerfile - name: Build an image from Dockerfile
# # run: | run: |
# # docker build -t docker.io/github/super-linter:${{ github.sha }} . docker build -t docker.io/github/super-linter:${{ github.sha }} .
# ################################# #################################
# # Run Trivy Scan of source code # # Run Trivy Scan of source code #
# ################################# #################################
# - name: Trivy Scan - name: Trivy Scan
# uses: aquasecurity/trivy-action@master uses: aquasecurity/trivy-action@master
# with: with:
# scan-type: 'fs' scan-type: 'fs'
# format: 'template' format: 'template'
# exit-code: '1' template: '@/contrib/sarif.tpl'
# template: '@/contrib/sarif.tpl' output: 'report.sarif'
# output: 'report.sarif' severity: 'HIGH,CRITICAL'
# severity: 'HIGH,CRITICAL'
# ################################# #################################
# # Upload report to security tab # # Upload report to security tab #
# ################################# #################################
# - name: Upload Trivy scan results to GitHub Security tab - name: Upload Trivy scan results to GitHub Security tab
# uses: github/codeql-action/upload-sarif@v1 uses: github/codeql-action/upload-sarif@v1
# if: always() if: always()
# with: with:
# sarif_file: 'report.sarif' sarif_file: 'report.sarif'

3
Dockerfile
View file

@ -150,7 +150,8 @@ RUN pipenv install --clear --system
#################### ####################
RUN npm config set package-lock false \ RUN npm config set package-lock false \
&& npm config set loglevel error \ && npm config set loglevel error \
&& npm --no-cache install && npm --no-cache install \
&& npm audit fix
############################# #############################
# Add node packages to path # # Add node packages to path #