Merge pull request #95 from getjavelin/cicd-patch

devops: Adding the trivy scan
getjavelin · Dec 27, 2024 · 2ae6e5e · 2ae6e5e
2 parents 32ff1c9 + 0de1c12
commit 2ae6e5e
Showing 1 changed file with 201 additions and 0 deletions.
diff --git a/.github/workflows/cicd-sec-trivy.yml b/.github/workflows/cicd-sec-trivy.yml
@@ -0,0 +1,201 @@
+name: CICD Trivy Scan - Javelin Cloud
+
+on:
+  push:
+    branches:
+      - "main"
+
+env:
+  env_var: ${{ vars.ENV_CONTEXT_VAR }}
+  DEVOPS_REPO: "javelin-cloud"
+  DEVOPS_BRANCH: "main"
+  GH_SEC_REPORT: false
+  TRIVY_REPORT_FILE: "trivy-scan-result"
+
+jobs:
+  javelin-env:
+    permissions:
+      contents: 'read'
+      id-token: 'write'
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Setting up Repo Env
+        id: repo_env_setup
+        shell: bash
+        run: |-
+          echo "repository=$(basename ${{ github.repository }})" >> ${GITHUB_OUTPUT}
+          echo "shortsha=$(git rev-parse --short=7 HEAD)" >> ${GITHUB_OUTPUT}
+
+      - name: Set Lowercase Repo Name
+        id: lc_repository
+        env:
+          REPO_NAME: ${{ steps.repo_env_setup.outputs.repository }}
+        shell: bash
+        run: echo "name=${REPO_NAME,,}" >> ${GITHUB_OUTPUT}
+
+      - name: DevOps Repository Checkout
+        uses: actions/checkout@v4
+        with:
+          repository: "${{ github.repository_owner }}/${{ env.DEVOPS_REPO }}"
+          token: ${{ secrets.DEVOPS_GITHUB_TOKEN }}
+          fetch-depth: 0
+          persist-credentials: false
+          ref: ${{ env.DEVOPS_BRANCH }}
+          path: ${{ env.DEVOPS_REPO }}
+
+      - name: Get Build Config
+        id: build_config
+        shell: bash
+        run: |-
+          trivy_severity=$(cat ${{ env.DEVOPS_REPO }}/app-config/javelin-default/sec-config.json | jq -r '.trivy.severity')
+          slack_scan_channel_id=$(cat ${{ env.DEVOPS_REPO }}/app-config/javelin-default/notify-config.json | jq -r '.slack.scan.channel_id')
+          echo "trivy_severity=${trivy_severity}" >> ${GITHUB_OUTPUT}
+          echo "slack_scan_channel_id=${slack_scan_channel_id}" >> ${GITHUB_OUTPUT}
+    outputs:
+      svc_name: ${{ steps.lc_repository.outputs.name }}
+      short_sha: ${{ steps.repo_env_setup.outputs.shortsha }}
+      trivy_severity: ${{ steps.build_config.outputs.trivy_severity }}
+      slack_scan_channel_id: ${{ steps.build_config.outputs.slack_scan_channel_id }}
+
+  javelin-trivy-scan:
+    needs:
+      - javelin-env
+    permissions:
+      contents: 'read'
+      id-token: 'write'
+      actions: 'read'
+      security-events: 'write'
+    runs-on: ubuntu-24.04
+    env:
+      TRIVY_SEVERITY: ${{ needs.javelin-env.outputs.trivy_severity }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: true
+
+      - name: Trivy Scan - GitHub Security Report
+        if: ${{ env.GH_SEC_REPORT == 'true' }}
+        uses: aquasecurity/[email protected]
+        with:
+          scan-type: "fs"
+          ignore-unfixed: true
+          format: "sarif"
+          output: "${{ env.TRIVY_REPORT_FILE }}.sarif"
+          severity: "${{ env.TRIVY_SEVERITY }}"
+
+      - name: Upload Report - GitHub Security Report
+        if: ${{ env.GH_SEC_REPORT == 'true' }}
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: "${{ env.TRIVY_REPORT_FILE }}.sarif"
+
+      - name: Trivy Scan - Text Security Report
+        if: ${{ env.GH_SEC_REPORT == 'false' }}
+        uses: aquasecurity/[email protected]
+        with:
+          scan-type: "fs"
+          ignore-unfixed: true
+          format: "table"
+          output: "${{ env.TRIVY_REPORT_FILE }}.txt"
+          severity: "${{ env.TRIVY_SEVERITY }}"
+
+      - name: Upload Report - Text Security Report
+        if: ${{ env.GH_SEC_REPORT == 'false' }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: "${{ env.TRIVY_REPORT_FILE }}"
+          path: "${{ env.TRIVY_REPORT_FILE }}.txt"
+          if-no-files-found: error
+          retention-days: 1
+
+  javelin-trivy-notify:
+    needs:
+      - javelin-env
+      - javelin-trivy-scan
+    permissions:
+      contents: 'read'
+      id-token: 'write'
+    runs-on: ubuntu-24.04
+    if: |
+      always()
+    env:
+      SVC_NAME: ${{ needs.javelin-env.outputs.svc_name }}
+      JOB_STATUS: ${{ needs.javelin-trivy-scan.result }}
+      JOB_STATUS_FAIL_MARK: ":x:"
+      JOB_STATUS_SUCCESS_MARK: ":white_check_mark:"
+      COMMIT_AUTHOR: ${{ github.event.commits[0].author.name }}
+      COMMIT_SHA: ${{ needs.javelin-env.outputs.short_sha }}
+      SLACK_CHANNEL_ID: ${{ needs.javelin-env.outputs.slack_scan_channel_id }}
+      COMMIT_URL: ${{ github.event.head_commit.url }}
+      BUILD_URL: "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+      GH_SEC_URL: "${{ github.server_url }}/${{ github.repository }}/security"
+      SLACK_PAYLOAD_JSON: slack-trivy-scan-payload.json
+    steps:
+      - name: DevOps Repository Checkout
+        uses: actions/checkout@v4
+        with:
+          repository: "${{ github.repository_owner }}/${{ env.DEVOPS_REPO }}"
+          token: ${{ secrets.DEVOPS_GITHUB_TOKEN }}
+          fetch-depth: 0
+          persist-credentials: false
+          ref: ${{ env.DEVOPS_BRANCH }}
+          path: ${{ env.DEVOPS_REPO }}
+
+      - name: Download Report - Text Security Report
+        if: ${{ env.GH_SEC_REPORT == 'false' }}
+        uses: actions/download-artifact@v4
+        with:
+          name: "${{ env.TRIVY_REPORT_FILE }}"
+
+      - name: Slack Payload Template
+        id: slack_template
+        shell: bash
+        run: |-
+          if [[ ${{ needs.javelin-trivy-scan.result }} == "success" ]] ; then
+            export JOB_STATUS_MARK=${JOB_STATUS_SUCCESS_MARK}
+          else
+            export JOB_STATUS_MARK=${JOB_STATUS_FAIL_MARK}
+          fi
+          if [[ ${{ env.GH_SEC_REPORT }} == 'true' ]] ; then
+            export PAYLOAD_JSON="slack-trivy-scan-sec-payload.json"
+          else
+            export PAYLOAD_JSON="slack-trivy-scan-file-payload.json"
+          fi
+          if [[ -f ${{ env.TRIVY_REPORT_FILE }}.txt ]] ; then
+            if [[ -s ${{ env.TRIVY_REPORT_FILE }}.txt ]] ; then
+              export REPORT_INFO="Please check the attachment"
+              echo "report_file=available" >> ${GITHUB_OUTPUT}
+            else
+              export REPORT_INFO="No vulnerabilities found"
+              echo "report_file=not-available" >> ${GITHUB_OUTPUT}
+            fi
+          fi
+          envsubst < ${{ env.DEVOPS_REPO }}/slack-notify/${PAYLOAD_JSON} > ${{ env.SLACK_PAYLOAD_JSON }}
+          cat ${{ env.SLACK_PAYLOAD_JSON }}
+
+      - name: Slack Notification
+        uses: slackapi/[email protected]
+        id: slack_notify
+        with:
+          method: chat.postMessage
+          token: ${{ secrets.SLACK_BOT_TOKEN }}
+          payload-file-path: "${{ env.SLACK_PAYLOAD_JSON }}"
+
+      - name: Upload Report Slack - Text Security Report
+        if: ${{ env.GH_SEC_REPORT == 'false' && steps.slack_template.outputs.report_file == 'available' }}
+        uses: slackapi/[email protected]
+        with:
+          method: files.uploadV2
+          token: ${{ secrets.SLACK_BOT_TOKEN }}
+          payload: |
+            channel_id: "${{ env.SLACK_CHANNEL_ID }}"
+            thread_ts: ${{ steps.slack_notify.outputs.ts }}
+            initial_comment: "The Trivy Scan Result (${{ env.COMMIT_SHA }})"
+            file: "${{ env.TRIVY_REPORT_FILE }}.txt"
+            filename: "${{ env.TRIVY_REPORT_FILE }}-${{ env.COMMIT_SHA }}.txt"