action.yml

name: stordco/actions-trivy

branding:
  color: blue
  icon: list

description: >-
  GitHub Composite Action for running Trivy scans

inputs:
  github-token:
    description: "GitHub token for authentication."
    required: false
  image-ref:
    description: "Specify the local Docker image to be scanned. This value needs to be set if the scan-type = image."
    required: false
  matrix-id:
    description: "Specify the matrix indicator to be leveraged on notification steps."
    required: false
  scan-type:
    description: >-
      "Specify the type of scan to be perforemed (e.g., 'fs' for filesystem scan, `image` for image scan)."
    required: true
  slack-bot-token:
    description: "Slackbot token for sending notifications."
    required: false
  slack-channel-id:
    description: "Slack channel ID for sending notifications."
    required: false
  update-db:
    description: "Update Trivy vulnerability database."
    required: false
    default: "true"

outputs:
  artifact-url:
    description: "Link to the Trivy scan artifact"
    value: ${{ steps.trivy_artifact_upload.outputs.artifact-url }}

runs:
  using: composite
  steps:
    - name: Configure configuration file
      id: configuration_file
      run: |
        if [[ '${{ inputs.scan-type }}' == 'fs' ]]; then
          echo "config_file_type=fs" >> "$GITHUB_OUTPUT"
        fi
        if [[ '${{ inputs.scan-type }}' == 'image' ]]; then
          echo "config_file_type=image" >> "$GITHUB_OUTPUT"
        fi
      shell: bash

    - name: Run Trivy vulnerability scanner in ${{ inputs.scan-type }} mode
      id: trivy_scan
      uses: aquasecurity/trivy-action@0.28.0
      env:
        TRIVY_SKIP_DB_UPDATE: ${{ inputs.update-db == 'false' && 'true' || 'false' }}
      with:
        scan-type: ${{ inputs.scan-type }}
        image-ref: ${{ inputs.image-ref }}
        trivy-config: .trivy/${{ steps.configuration_file.outputs.config_file_type }}-config.yaml
      continue-on-error: true

    - name: Set artifact upload metadata
      id: artifact_metadata
      run: |
        if [[ '${{ github.ref_name }}' == 'main' ]]; then
          echo "Keep trivy artifact for 90 days on main branch merge"
          echo "days=90" >> "$GITHUB_OUTPUT"
        else
          echo "Keep trivy artifact for 1 day on PR builds"
          echo "days=1" >> "$GITHUB_OUTPUT"
        fi

        sha_short=$(git rev-parse --short HEAD)
        sanitized_ref_name=$(echo "${{ github.ref_name }}" | sed 's/[\\\/:*?<>|]/-/g')

        if [[ -z '${{ inputs.matrix-id }}' ]]; then
          echo "name=trivy-${{ inputs.scan-type }}-results-${sha_short}-${sanitized_ref_name}" >> $GITHUB_OUTPUT
        else
          echo "name=trivy-${{ inputs.scan-type }}-results-${sha_short}-${sanitized_ref_name}-${{ inputs.matrix-id }}" >> $GITHUB_OUTPUT
        fi
      shell: bash

    - name: Upload Trivy report to artifacts
      uses: actions/upload-artifact@v4
      id: trivy_artifact_upload
      with:
        name: ${{ steps.artifact_metadata.outputs.name }}
        path: trivy-${{ inputs.scan-type }}-results.json
        retention-days: ${{ steps.artifact_metadata.outputs.days }}
        if-no-files-found: ignore
        overwrite: true

    - name: Upload Trivy Report as PR Comment and parse Critical vulnerabilities
      id: trivy_report_notification
      if: ${{ inputs.github-token && github.event_name == 'pull_request' && steps.trivy_artifact_upload.outputs.artifact-url }}
      uses: actions/github-script@v7
      env:
        GITHUB_TOKEN: ${{ inputs.github-token }}
        SCAN_TYPE: ${{ inputs.scan-type }}
        MATRIX_ID: ${{ inputs.matrix-id }}
      with:
        script: |
          const fs = require('fs');
          const path = require('path');

          if (context.payload.pull_request == null) {
            core.info('No pull request found, skipping comment creation');
            return;
          }

          const issue_number = context.payload.pull_request.number;
          const owner = context.repo.owner;
          const repo = context.repo.repo;

          let commentIdentifier;
          if (!process.env.MATRIX_ID) {
            commentIdentifier = `<!-- trivyReportComment-${process.env.SCAN_TYPE}-->`;
          } else {
            commentIdentifier = `<!-- trivyReportComment-${process.env.SCAN_TYPE}-${process.env.MATRIX_ID}-->`;
          }

          const filePath = path.join(process.env.GITHUB_WORKSPACE, `trivy-${process.env.SCAN_TYPE}-results.json`);
          const fileContent = fs.readFileSync(filePath, 'utf8');
          const jsonData = JSON.parse(fileContent);

          function formatVulnerabilities(results) {
            const headers = ["Library", "Vulnerability", "Severity", "Status", "Installed Version", "Fixed Version", "Title", "Target"];
            const headerRow = `| ${headers.join(" | ")} |`;
            const separatorRow = `| ${headers.map(() => "---").join(" | ")} |`;

            const rows = results.flatMap(result => {
              if (result.Vulnerabilities && result.Vulnerabilities.length > 0) {
                return result.Vulnerabilities.map(vuln => {
                  const titleWithUrl = `${vuln.Title || ""} (${vuln.PrimaryURL || ""})`;
                  return `| ${[
                    vuln.PkgName || "",
                    vuln.VulnerabilityID || "",
                    vuln.Severity || "",
                    vuln.Status || "",
                    vuln.InstalledVersion || "",
                    vuln.FixedVersion || "",
                    titleWithUrl,
                    result.Target || ""
                  ].join(" | ")} |`;
                });
              } else {
                return [];
              }
            });

            return [headerRow, separatorRow, ...rows].join("\n");
          }

          function parseTrivyResults(data) {
            return data.Results.map(result => ({
              Target: result.Target,
              Vulnerabilities: result.Vulnerabilities || []
            }));
          }

          const vulnerabilities = parseTrivyResults(jsonData);
          const criticalVulnerabilitiesCount = vulnerabilities.flatMap(result => result.Vulnerabilities).filter(vuln => vuln.Severity === 'CRITICAL').length;
          core.setOutput('critical_vulnerabilities_count', criticalVulnerabilitiesCount.toString());
          core.info(`Found ${criticalVulnerabilitiesCount} critical vulnerabilities`);

          const comments = await github.rest.issues.listComments({
              owner,
              repo,
              issue_number,
            });

          const botComment = comments.data.find(comment => comment.body.includes(commentIdentifier));
          core.info(`Parsed Vulnerabilities: ${JSON.stringify(vulnerabilities)}`)

          const scanTypeName = process.env.SCAN_TYPE === 'fs' ? 'filesystem' : 'image';

          if (vulnerabilities.flatMap(result => result.Vulnerabilities).length === 0) {
            if (botComment) {
              const noErrorsComment = `No Trivy ${scanTypeName} vulnerabilities to be reported${process.env.MATRIX_ID ? ` for ${process.env.MATRIX_ID}` : ''}.\n${commentIdentifier}`;

              await github.rest.issues.updateComment({
                owner,
                repo,
                comment_id: botComment.id,
                body: noErrorsComment,
              });
              core.info('Updated existing PR comment to indicate no vulnerabilities detected anymore');
            } else {
              core.info('No vulnerabilities found, no comment posted');
            }
          } else {
            const formattedContent = `
            <details>
              <summary>Trivy Scan Report</summary>

            ${formatVulnerabilities(vulnerabilities)}
            ${commentIdentifier}
            </details>
            `;

            const MAX_COMMENT_LENGTH = 65536;

            let fullCommentBody;

            if (formattedContent.length > MAX_COMMENT_LENGTH) {
              fullCommentBody = `
              The Trivy ${scanTypeName} scan report${process.env.MATRIX_ID ? ` for ${process.env.MATRIX_ID}` : ''} is too large to display here. Please view the detailed output from the job:

              [View Trivy Report](https://github.com/${owner}/${repo}/actions/runs/${context.runId})

              ${commentIdentifier}
              `;
            } else {

              fullCommentBody = `
              View the Trivy ${scanTypeName} scan report${process.env.MATRIX_ID ? ` for ${process.env.MATRIX_ID}` : ''} below. Click on the dropdown to expand the report.
              ${formattedContent}
              `;
            }

            if (botComment) {
              await github.rest.issues.updateComment({
                owner,
                repo,
                comment_id: botComment.id,
                body: fullCommentBody,
              });
              core.info('Updated existing PR comment');
            } else {
              await github.rest.issues.createComment({
                owner,
                repo,
                issue_number,
                body: fullCommentBody,
              });
              core.info('Created new PR comment');
            }
          }

    - name: Notify Slack of critical vulnerabilities
      if: ${{ steps.trivy_report_notification.outputs.critical_vulnerabilities_count != '0' && github.ref_name == 'main' && inputs.slack-bot-token && !inputs.matrix-id }}
      uses: slackapi/slack-github-action@v1.26.0
      env:
        SLACK_BOT_TOKEN: ${{ inputs.slack-bot-token }}
      with:
        channel-id: ${{ inputs.slack-channel-id }}
        payload: |
          {
            "blocks": [
              {
                "type": "section",
                "text": {
                  "type": "mrkdwn",
                  "text": ":alert: *Critical vulnerabilities detected* in Trivy ${{ inputs.scan-type }} scan. `${{ steps.trivy_report_notification.outputs.critical_vulnerabilities_count }}` critical vulnerabilities detected."
                }
              },
              {
                "type": "section",
                "fields": [
                  {
                    "type": "mrkdwn",
                    "text": "*Repository:*\n`${{ github.repository }}`"
                  },
                  {
                    "type": "mrkdwn",
                    "text": "*Branch:*\n`${{ github.ref_name }}`"
                  }
                ]
              },
              {
                "type": "section",
                "text": {
                  "type": "mrkdwn",
                  "text": "<${{ steps.trivy_artifact_upload.outputs.artifact-url }}|View Artifacts>"
                }
              }
            ]
          }

    - name: Notify Slack of critical vulnerabilities (${{ inputs.matrix-id }})
      if: ${{ steps.trivy_report_notification.outputs.critical_vulnerabilities_count != '0' && github.ref_name == 'main' && inputs.slack-bot-token && inputs.matrix-id }}
      uses: slackapi/slack-github-action@v1.26.0
      env:
        SLACK_BOT_TOKEN: ${{ inputs.slack-bot-token }}
      with:
        channel-id: ${{ inputs.slack-channel-id }}
        payload: |
          {
            "blocks": [
              {
                "type": "section",
                "text": {
                  "type": "mrkdwn",
                  "text": ":alert: *Critical vulnerabilities detected* in Trivy ${{ inputs.scan-type }} scan. `${{ steps.trivy_report_notification.outputs.critical_vulnerabilities_count }}` critical vulnerabilities detected."
                }
              },
              {
                "type": "section",
                "fields": [
                  {
                    "type": "mrkdwn",
                    "text": "*Repository:*\n`${{ github.repository }}`"
                  },
                  {
                    "type": "mrkdwn",
                    "text": "*Branch:*\n`${{ github.ref_name }}`"
                  },
                  {
                    "type": "mrkdwn",
                    "text": "*Matrix ID:*\n`${{ inputs.matrix-id }}`"
                  }
                ]
              },
              {
                "type": "section",
                "text": {
                  "type": "mrkdwn",
                  "text": "<${{ steps.trivy_artifact_upload.outputs.artifact-url }}|View Artifacts>"
                }
              }
            ]
          }