docker-image-scan.yml

name: Docker Image Scan
on:
  workflow_dispatch:
  schedule:
    - cron: "0 0 * * *"

jobs:
  scan:
    name: DockerImageScan
    runs-on: ubuntu-latest
    outputs:
      result: ${{ steps.trivy-result.outputs.result }}
      result-alpine: ${{ steps.trivy-result-alpine.outputs.result }}
      version: ${{ steps.extract-version.outputs.version }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Extract latest release
        id: extract-release
        shell: bash
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          #!/bin/bash
          release=$(gh release view --json "tagName" --jq ".tagName")
          echo "$release"
          echo "release=$release" >> "$GITHUB_OUTPUT"
      - name: Extract version
        id: extract-version
        run: |
          tag=${{ steps.extract-release.outputs.release }}
          version=${tag%-*}
          echo $version
          echo "version=${version}" >> $GITHUB_OUTPUT

      - id: trivy-db
        name: Check trivy db sha
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          endpoint='/orgs/aquasecurity/packages/container/trivy-db/versions'
          headers='Accept: application/vnd.github+json'
          jqFilter='.[] | select(.metadata.container.tags[] | contains("latest")) | .name | sub("sha256:";"")'
          sha=$(gh api -H "${headers}" "${endpoint}" | jq --raw-output "${jqFilter}")
          echo "Trivy DB sha256:${sha}"
          echo "sha=${sha}" >> $GITHUB_OUTPUT
      - id: ignore-policies
        name: Ignore some policies
        run: |
          cat > .trivyignore << EOL
          # Ignore gosu issue. They say they are not affected. Issue will be removed as soon
          # as wiremock image updates to a newer gosu version, which removed runc.
          CVE-2023-27561
          CVE-2024-21626
          EOL
      - uses: actions/cache@v4
        with:
          path: .trivy
          key: ${{ runner.os }}-trivy-db-${{ steps.trivy-db.outputs.sha }}
      - name: Run Trivy json result
        uses: aquasecurity/trivy-action@0.19.0
        with:
          image-ref: 'docker.io/holomekc/wiremock-gui:${{ steps.extract-version.outputs.version }}'
          format: 'json'
          exit-code: '0'
          output: trivy-result.json
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'
          hide-progress: true
          cache-dir: .trivy
      - name: Run Trivy sarif result
        uses: aquasecurity/trivy-action@0.19.0
        with:
          image-ref: 'docker.io/holomekc/wiremock-gui:${{ steps.extract-version.outputs.version }}'
          format: 'sarif'
          exit-code: '0'
          output: trivy-result.sarif
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'
          limit-severities-for-sarif: true
          hide-progress: true
          cache-dir: .trivy
      - name: Run Trivy sbom result
        uses: aquasecurity/trivy-action@0.19.0
        with:
          image-ref: 'docker.io/holomekc/wiremock-gui:${{ steps.extract-version.outputs.version }}'
          format: 'github'
          exit-code: '0'
          output: dependency-results.sbom.json
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'
          hide-progress: true
          cache-dir: .trivy
          github-pat: ${{ secrets.GITHUB_TOKEN }}
      - name: Run Trivy json result alpine
        uses: aquasecurity/trivy-action@0.19.0
        with:
          image-ref: 'docker.io/holomekc/wiremock-gui:${{ steps.extract-version.outputs.version }}-alpine'
          format: 'json'
          exit-code: '0'
          output: trivy-result-alpine.json
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'
          hide-progress: true
          cache-dir: .trivy
      - name: Run Trivy sarif result alpine
        uses: aquasecurity/trivy-action@0.19.0
        with:
          image-ref: 'docker.io/holomekc/wiremock-gui:${{ steps.extract-version.outputs.version }}-alpine'
          format: 'sarif'
          exit-code: '0'
          output: trivy-result-alpine.sarif
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'
          limit-severities-for-sarif: true
          hide-progress: true
          cache-dir: .trivy
      - name: Run Trivy sbom result alpine
        uses: aquasecurity/trivy-action@0.19.0
        with:
          image-ref: 'docker.io/holomekc/wiremock-gui:${{ steps.extract-version.outputs.version }}-alpine'
          format: 'github'
          exit-code: '0'
          output: dependency-results-alpine.sbom.json
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH'
          hide-progress: true
          cache-dir: .trivy
          github-pat: ${{ secrets.GITHUB_TOKEN }}
      - name: Fix .trivy permissions
        run: sudo chown -R $(stat . -c %u:%g) .trivy

      - name: Check result
        id: trivy-result
        shell: bash
        run: |
          #!/bin/bash
          cat trivy-result.json
          jq -e 'select((.Results[].Vulnerabilities | length) > 0)' trivy-result.json && code=$? || code=$?
          echo "result=${code}" >> $GITHUB_OUTPUT
          cat trivy-result.sarif

      - name: Check result alpine
        id: trivy-result-alpine
        shell: bash
        run: |
          #!/bin/bash
          cat trivy-result-alpine.json
          jq -e 'select((.Results[].Vulnerabilities | length) > 0)' trivy-result-alpine.json && code=$? || code=$?
          echo "result=${code}" >> $GITHUB_OUTPUT
          cat trivy-result-alpine.sarif

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-result.sarif'
      - name: Upload Trivy alpine scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-result-alpine.sarif'

  docker:
    needs: [scan]
    # Looks strange, but 0=Vulnerabilities found
    if: ${{ needs.scan.outputs.result == 0 || needs.scan.outputs.result-alpine == 0 }}
    uses: ./.github/workflows/docker-release.yml
    with:
      version: ${{ needs.scan.outputs.version }}
    secrets:
      dockerUsername: ${{ secrets.DOCKERHUB_USERNAME }}
      dockerToken: ${{ secrets.DOCKERHUB_TOKEN }}