Skip to content

Commit

Permalink
Update scan-vulns.yaml
Browse files Browse the repository at this point in the history
  • Loading branch information
binbin-li authored Nov 6, 2024
1 parent ff845a9 commit cd17d40
Showing 1 changed file with 14 additions and 5 deletions.
19 changes: 14 additions & 5 deletions .github/workflows/scan-vulns.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -33,13 +33,9 @@ jobs:
check-latest: true
- uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee # v1.0.4

restore_trivy_cache:
uses: ./.github/workflows/restore-trivy-cache.yml

scan_vulnerabilities:
name: "[Trivy] Scan for vulnerabilities"
runs-on: ubuntu-22.04
needs: ["restore_trivy_cache"]
timeout-minutes: 15
env:
TRIVY_VERSION: 0.49.1
Expand All @@ -59,6 +55,19 @@ jobs:
tar zxvf trivy_${{ env.TRIVY_VERSION }}_Linux-64bit.tar.gz
echo "$(pwd)" >> $GITHUB_PATH
- name: Get current date
id: date
run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
- name: Restore trivy cache directory
uses: actions/cache/restore@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
with:
path: ${{ github.workspace }}/.cache/trivy
key: cache-trivy-${{ steps.date.outputs.date }}
- name: Set up trivy cache directory
run: |
mkdir -p ~/.cache/trivy
cp -r ${{ github.workspace }}/.cache/trivy/db ~/.cache/trivy
- name: Run trivy on git repository
run: |
trivy fs --skip-db-update --format table --ignore-unfixed --scanners vuln .
Expand All @@ -76,4 +85,4 @@ jobs:
run: |
for img in "localbuild:test" "localbuildcrd:test"; do
trivy image --skip-db-update --ignore-unfixed --exit-code 1 --severity HIGH,CRITICAL --vuln-type="os,library" "${img}"
done
done

0 comments on commit cd17d40

Please sign in to comment.