Initial commit

scripts/trivy-scan.sh

@@ -0,0 +1,123 @@
+#!/bin/sh
+set -eu
+
+TRIVY_IMAGE="${TRIVY_IMAGE:-aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969}"
+TRIVY_CACHE_DIR="${TRIVY_CACHE_DIR:-.cache/trivy}"
+TRIVY_SEVERITY="${TRIVY_SEVERITY:-HIGH,CRITICAL}"
+TRIVY_EXIT_CODE="${TRIVY_EXIT_CODE:-0}"
+TRIVY_IGNORE_UNFIXED="${TRIVY_IGNORE_UNFIXED:-true}"
+TRIVY_IMAGE_SOURCE="${TRIVY_IMAGE_SOURCE:-docker}"
+
+usage() {
+  echo "Usage: $0 secret-fs|vuln-fs|vuln-image <target>" >&2
+}
+
+if [ "$#" -ne 2 ]; then
+  usage
+  exit 2
+fi
+
+mode="$1"
+target="$2"
+
+mkdir -p "$TRIVY_CACHE_DIR"
+
+common_args="--cache-dir /trivy-cache"
+ignore_unfixed_arg=""
+if [ "$TRIVY_IGNORE_UNFIXED" = "true" ]; then
+  ignore_unfixed_arg="--ignore-unfixed"
+fi
+
+case "$mode" in
+  secret-fs)
+    container_id="$(docker create \
+      -v "$(pwd)/$TRIVY_CACHE_DIR:/trivy-cache" \
+      "$TRIVY_IMAGE" \
+      fs \
+      $common_args \
+      --scanners secret \
+      --exit-code 1 \
+      --skip-dirs /work/.git \
+      --skip-dirs /work/.agents \
+      --skip-dirs /work/.cache \
+      --skip-dirs /work/.codex \
+      --skip-dirs /work/.opencode \
+      --skip-dirs /work/.venv \
+      --skip-dirs /work/frontend \
+      --skip-dirs /work/node_modules \
+      --skip-dirs /work/.next \
+      /work)"
+    trap 'docker rm -f "$container_id" >/dev/null 2>&1 || true' EXIT
+    docker cp "$target" "$container_id:/work"
+    docker start -a "$container_id"
+    ;;
+  vuln-fs)
+    container_id="$(docker create \
+      -v "$(pwd)/$TRIVY_CACHE_DIR:/trivy-cache" \
+      "$TRIVY_IMAGE" \
+      fs \
+      $common_args \
+      --scanners vuln \
+      --severity "$TRIVY_SEVERITY" \
+      $ignore_unfixed_arg \
+      --exit-code "$TRIVY_EXIT_CODE" \
+      --skip-dirs /work/.git \
+      --skip-dirs /work/.agents \
+      --skip-dirs /work/.cache \
+      --skip-dirs /work/.codex \
+      --skip-dirs /work/.opencode \
+      --skip-dirs /work/.venv \
+      --skip-dirs /work/frontend \
+      --skip-dirs /work/node_modules \
+      --skip-dirs /work/.next \
+      "/work/$target")"
+    trap 'docker rm -f "$container_id" >/dev/null 2>&1 || true' EXIT
+    docker cp . "$container_id:/work"
+    docker start -a "$container_id"
+    ;;
+  vuln-image)
+    case "$TRIVY_IMAGE_SOURCE" in
+      docker)
+        docker run --rm \
+          -v /var/run/docker.sock:/var/run/docker.sock \
+          -v "$(pwd)/$TRIVY_CACHE_DIR:/trivy-cache" \
+          "$TRIVY_IMAGE" \
+          image \
+          $common_args \
+          --scanners vuln \
+          --severity "$TRIVY_SEVERITY" \
+          $ignore_unfixed_arg \
+          --exit-code "$TRIVY_EXIT_CODE" \
+          "$target"
+        ;;
+      remote)
+        docker_config_dir="${DOCKER_CONFIG:-$HOME/.docker}"
+        if [ ! -f "$docker_config_dir/config.json" ]; then
+          echo "Docker registry credentials not found: $docker_config_dir/config.json" >&2
+          exit 1
+        fi
+        docker run --rm \
+          -e DOCKER_CONFIG=/root/.docker \
+          -v "$docker_config_dir/config.json:/root/.docker/config.json:ro" \
+          -v "$(pwd)/$TRIVY_CACHE_DIR:/trivy-cache" \
+          "$TRIVY_IMAGE" \
+          image \
+          $common_args \
+          --image-src remote \
+          --scanners vuln \
+          --severity "$TRIVY_SEVERITY" \
+          $ignore_unfixed_arg \
+          --exit-code "$TRIVY_EXIT_CODE" \
+          "$target"
+        ;;
+      *)
+        echo "Unsupported TRIVY_IMAGE_SOURCE: $TRIVY_IMAGE_SOURCE (expected docker or remote)" >&2
+        exit 2
+        ;;
+    esac
+    ;;
+  *)
+    usage
+    exit 2
+    ;;
+esac