trivy-scan.yml

name: Trivy CVE Dependency Scanner

on:
  workflow_call:
    inputs:
      repo:
        required: true
        type: string
        description: Github Organization and Repository of the tool to be scanned
      branch:
        required: false
        type: string
        default: develop
        description: Branch name to retrieve the code from
      tool:
        required: true
        type: string
        description: Tool name
      goVersion:
        required: false
        type: string
        description: Version of Go used to compile the application
        default: ""
    secrets:
      slackWebhookURL:
        required: true
        description: Webhook URL where the slack message is sent to
      githubToken:
        required: true
        description: Github token used to retrieve trivy CVE database
jobs:
  scan:
    runs-on: ubuntu-latest
    # Set permissions of github token. See https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#permissions
    permissions:
      security-events: write
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0
          persist-credentials: false
          repository: ${{ inputs.repo }}
          ref: ${{ inputs.branch }}

      # Backwards compatibility, when no version is provided it will use the go.mod file version
      - name: Set up Go
        if: inputs.goVersion != ''
        uses: actions/setup-go@v5
        with:
          go-version: ${{ inputs.goVersion }}
      - name: Set up Go
        if: inputs.goVersion == ''
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod

      - name: Build the ${{ inputs.tool }} binary file
        run: |
          set -o pipefail
          # KC get dependencies
          test -x ./hack/install-deps.sh && ./hack/install-deps.sh
          
          # Build Binary File
          ./hack/build.sh

      - name: Trivy Cache
        uses: yogeshlonkar/trivy-cache-action@v0
        with:
          gh-token: ${{ secrets.githubToken }}

      - name: Read dismissed CVEs from Github
        run: |
          set -o pipefail
          trap 'on_error' ERR
          on_error() {
            echo "the curl reply was:"
            cat cves.txt
          }

          curl https://api.github.com/repos/${{ inputs.repo }}/code-scanning/alerts \
            --header 'authorization: Bearer ${{ secrets.githubToken }}' > cves.txt
          cat cves.txt| jq '.[] | select(.state == "dismissed" or .state == "closed" or .state == "fixed") | .rule.id' | tr -d '"' > .trivyignore

      - name: Run Trivy scanner output sarif
        uses: aquasecurity/trivy-action@0.28.0
        with:
          scan-type: 'fs'
          scan-ref: '${{ inputs.tool }}'
          format: 'sarif'
          severity: 'HIGH,CRITICAL'
          output: 'trivy-results.sarif'
          exit-code: 1
          ignore-unfixed: true
          cache-dir: .trivy

      - name: Upload Trivy scan results to GitHub Security tab
        if: always()
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'