Per Hoener
0d45331f5c
Deploy / validate-dispatch (push) Successful in 43s
Deploy / scheduled-rebuild-dev (push) Skipped
Deploy / scheduled-rebuild-master (push) Skipped
Deploy / rollback-dev (push) Skipped
Deploy / rollback-master (push) Skipped
Deploy / changes (push) Successful in 13s
Deploy / secret-scan (push) Successful in 9s
Deploy / app-quality (push) Successful in 11m21s
Deploy / security-deps (push) Successful in 14s
Deploy / context (push) Failing after 1s
Deploy / app-image (push) Skipped
Deploy / deploy-dev (push) Skipped
Deploy / deploy-master (push) Skipped
124 lines
3.4 KiB
Bash
Executable File
124 lines
3.4 KiB
Bash
Executable File
#!/bin/sh
|
|
set -eu
|
|
|
|
TRIVY_IMAGE="${TRIVY_IMAGE:-aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969}"
|
|
TRIVY_CACHE_DIR="${TRIVY_CACHE_DIR:-.cache/trivy}"
|
|
TRIVY_SEVERITY="${TRIVY_SEVERITY:-HIGH,CRITICAL}"
|
|
TRIVY_EXIT_CODE="${TRIVY_EXIT_CODE:-0}"
|
|
TRIVY_IGNORE_UNFIXED="${TRIVY_IGNORE_UNFIXED:-true}"
|
|
TRIVY_IMAGE_SOURCE="${TRIVY_IMAGE_SOURCE:-docker}"
|
|
|
|
usage() {
|
|
echo "Usage: $0 secret-fs|vuln-fs|vuln-image <target>" >&2
|
|
}
|
|
|
|
if [ "$#" -ne 2 ]; then
|
|
usage
|
|
exit 2
|
|
fi
|
|
|
|
mode="$1"
|
|
target="$2"
|
|
|
|
mkdir -p "$TRIVY_CACHE_DIR"
|
|
|
|
common_args="--cache-dir /trivy-cache"
|
|
ignore_unfixed_arg=""
|
|
if [ "$TRIVY_IGNORE_UNFIXED" = "true" ]; then
|
|
ignore_unfixed_arg="--ignore-unfixed"
|
|
fi
|
|
|
|
case "$mode" in
|
|
secret-fs)
|
|
container_id="$(docker create \
|
|
-v "$(pwd)/$TRIVY_CACHE_DIR:/trivy-cache" \
|
|
"$TRIVY_IMAGE" \
|
|
fs \
|
|
$common_args \
|
|
--scanners secret \
|
|
--exit-code 1 \
|
|
--skip-dirs /work/.git \
|
|
--skip-dirs /work/.agents \
|
|
--skip-dirs /work/.cache \
|
|
--skip-dirs /work/.codex \
|
|
--skip-dirs /work/.opencode \
|
|
--skip-dirs /work/.venv \
|
|
--skip-dirs /work/frontend \
|
|
--skip-dirs /work/node_modules \
|
|
--skip-dirs /work/.next \
|
|
/work)"
|
|
trap 'docker rm -f "$container_id" >/dev/null 2>&1 || true' EXIT
|
|
docker cp "$target" "$container_id:/work"
|
|
docker start -a "$container_id"
|
|
;;
|
|
vuln-fs)
|
|
container_id="$(docker create \
|
|
-v "$(pwd)/$TRIVY_CACHE_DIR:/trivy-cache" \
|
|
"$TRIVY_IMAGE" \
|
|
fs \
|
|
$common_args \
|
|
--scanners vuln \
|
|
--severity "$TRIVY_SEVERITY" \
|
|
$ignore_unfixed_arg \
|
|
--exit-code "$TRIVY_EXIT_CODE" \
|
|
--skip-dirs /work/.git \
|
|
--skip-dirs /work/.agents \
|
|
--skip-dirs /work/.cache \
|
|
--skip-dirs /work/.codex \
|
|
--skip-dirs /work/.opencode \
|
|
--skip-dirs /work/.venv \
|
|
--skip-dirs /work/frontend \
|
|
--skip-dirs /work/node_modules \
|
|
--skip-dirs /work/.next \
|
|
"/work/$target")"
|
|
trap 'docker rm -f "$container_id" >/dev/null 2>&1 || true' EXIT
|
|
docker cp . "$container_id:/work"
|
|
docker start -a "$container_id"
|
|
;;
|
|
vuln-image)
|
|
case "$TRIVY_IMAGE_SOURCE" in
|
|
docker)
|
|
docker run --rm \
|
|
-v /var/run/docker.sock:/var/run/docker.sock \
|
|
-v "$(pwd)/$TRIVY_CACHE_DIR:/trivy-cache" \
|
|
"$TRIVY_IMAGE" \
|
|
image \
|
|
$common_args \
|
|
--scanners vuln \
|
|
--severity "$TRIVY_SEVERITY" \
|
|
$ignore_unfixed_arg \
|
|
--exit-code "$TRIVY_EXIT_CODE" \
|
|
"$target"
|
|
;;
|
|
remote)
|
|
docker_config_dir="${DOCKER_CONFIG:-$HOME/.docker}"
|
|
if [ ! -f "$docker_config_dir/config.json" ]; then
|
|
echo "Docker registry credentials not found: $docker_config_dir/config.json" >&2
|
|
exit 1
|
|
fi
|
|
docker run --rm \
|
|
-e DOCKER_CONFIG=/root/.docker \
|
|
-v "$docker_config_dir/config.json:/root/.docker/config.json:ro" \
|
|
-v "$(pwd)/$TRIVY_CACHE_DIR:/trivy-cache" \
|
|
"$TRIVY_IMAGE" \
|
|
image \
|
|
$common_args \
|
|
--image-src remote \
|
|
--scanners vuln \
|
|
--severity "$TRIVY_SEVERITY" \
|
|
$ignore_unfixed_arg \
|
|
--exit-code "$TRIVY_EXIT_CODE" \
|
|
"$target"
|
|
;;
|
|
*)
|
|
echo "Unsupported TRIVY_IMAGE_SOURCE: $TRIVY_IMAGE_SOURCE (expected docker or remote)" >&2
|
|
exit 2
|
|
;;
|
|
esac
|
|
;;
|
|
*)
|
|
usage
|
|
exit 2
|
|
;;
|
|
esac
|