Public Access
generated from Philipp/template-git
Philipp
599b74ef49
Philipp/Global-Workflows: Pre-commit Lint (Scoped) / pre-commit (pull_request) Successful in 1m53s
Extract ~450 lines of complex bash from action.yaml into modular, unit-tested Node.js scripts in lib/. All logic is covered by 26 native node:test unit tests (node --test, no external dependencies). Modules added: - lib/platforms.js - platform parsing and OCI manifest auto-discovery - lib/distro.js - SPDX PURL distro detection (os_name/os_version) - lib/verifier.js - Trivy arch mapping and SHA256 verification - lib/diagnostics.js - CI terminal diagnostic formatters - lib/install-trivy.js - Trivy install/verify entrypoint (replaces bash step) - lib/extract-sboms.js - SBOM extraction entrypoint (replaces bash step) - lib/scan-sboms.js - SBOM scan + diff entrypoint (replaces bash step) Tests added (all pass, auto-discovered by ode --test): - test/platforms.test.js - test/distro.test.js - test/verifier.test.js - test/diagnostics.test.js - test/orchestration.test.js action.yaml shrinks from 554 to 107 lines. Inputs are bridged to Node scripts via INPUT_* env vars so modules are fully decoupled from the Actions runner and testable in isolation.
107 lines
4.1 KiB
YAML
107 lines
4.1 KiB
YAML
name: Trivy Multi-Arch CVE Delta Comparison
|
|
description: Downloads and verifies Trivy, extracts multi-platform SBOMs, and computes a consolidated set-based CVE delta report
|
|
|
|
inputs:
|
|
head-image:
|
|
description: Head container image reference (e.g. host/server/gitea:git-12345678)
|
|
required: true
|
|
target-image:
|
|
description: Target baseline container image reference (e.g. host/server/gitea:latest)
|
|
required: true
|
|
target-branch:
|
|
description: Target branch name for delta heading (e.g. main)
|
|
required: false
|
|
default: main
|
|
architectures:
|
|
description: Comma-separated list of architectures or platforms to scan (e.g. 'amd64,arm64' or 'linux/amd64,linux/arm64'). If empty, scans all architectures found in the container image.
|
|
required: false
|
|
default: ''
|
|
output-delta:
|
|
description: Output markdown file for CVE delta report
|
|
required: false
|
|
default: cve-delta.md
|
|
output-summary:
|
|
description: Output markdown file for full vulnerability summary
|
|
required: false
|
|
default: cve-summary.md
|
|
write-summary:
|
|
description: Whether to append the generated reports to the job summary ($GITHUB_STEP_SUMMARY)
|
|
required: false
|
|
default: 'true'
|
|
use-inbuild-sbom:
|
|
description: Whether to inspect and use built-in image SBOM attestations. If false (recommended default), generates SBOMs directly with Trivy for maximum vulnerability detection fidelity. If true, extracts attestations without pulling layers (faster, but findings may differ from direct scans due to binary vs source package tracking; falls back to Trivy image scan if 0 CVEs detected).
|
|
required: false
|
|
default: 'false'
|
|
|
|
outputs:
|
|
delta-report:
|
|
description: Path to CVE delta markdown report
|
|
value: ${{ inputs.output-delta }}
|
|
summary-report:
|
|
description: Path to full vulnerability markdown report
|
|
value: ${{ inputs.output-summary }}
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- name: Prepare Cache Keys and Environment
|
|
id: vars
|
|
shell: bash
|
|
env:
|
|
TRIVY_VERSION: 0.74.0 # trivy-version
|
|
run: |
|
|
echo "date=$(date -u +%Y-%m-%d)" >> "$GITHUB_OUTPUT"
|
|
echo "version=${TRIVY_VERSION}" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Cache Trivy (Binary & Vulnerability DB)
|
|
uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
|
|
with:
|
|
path: |
|
|
~/.cache/trivy-bin
|
|
~/.cache/trivy
|
|
key: trivy-${{ steps.vars.outputs.version }}-${{ runner.os }}-${{ runner.arch }}-${{ steps.vars.outputs.date }}
|
|
restore-keys: |
|
|
trivy-${{ steps.vars.outputs.version }}-${{ runner.os }}-${{ runner.arch }}-
|
|
|
|
- name: Install and Verify Trivy
|
|
shell: bash
|
|
env:
|
|
TRIVY_VERSION: ${{ steps.vars.outputs.version }}
|
|
run: node "${{ github.action_path }}/lib/install-trivy.js"
|
|
|
|
- name: Extract Multi-Platform SBOMs
|
|
shell: bash
|
|
env:
|
|
PATH: ${{ env.HOME }}/.local/bin:${{ env.PATH }}
|
|
TRIVY_SKIP_VERSION_CHECK: 'true'
|
|
INPUT_HEAD_IMAGE: ${{ inputs.head-image }}
|
|
INPUT_TARGET_IMAGE: ${{ inputs.target-image }}
|
|
INPUT_ARCHITECTURES: ${{ inputs.architectures }}
|
|
INPUT_USE_INBUILD_SBOM: ${{ inputs.use-inbuild-sbom }}
|
|
run: node "${{ github.action_path }}/lib/extract-sboms.js"
|
|
|
|
- name: Scan Multi-Platform SBOMs and Generate Delta
|
|
shell: bash
|
|
env:
|
|
PATH: ${{ env.HOME }}/.local/bin:${{ env.PATH }}
|
|
TRIVY_SKIP_VERSION_CHECK: 'true'
|
|
INPUT_HEAD_IMAGE: ${{ inputs.head-image }}
|
|
INPUT_TARGET_IMAGE: ${{ inputs.target-image }}
|
|
INPUT_TARGET_BRANCH: ${{ inputs.target-branch }}
|
|
INPUT_USE_INBUILD_SBOM: ${{ inputs.use-inbuild-sbom }}
|
|
INPUT_OUTPUT_DELTA: ${{ inputs.output-delta }}
|
|
INPUT_OUTPUT_SUMMARY: ${{ inputs.output-summary }}
|
|
run: node "${{ github.action_path }}/lib/scan-sboms.js"
|
|
|
|
- name: Publish Reports to Step Summary
|
|
shell: bash
|
|
run: |
|
|
if [ "${{ inputs.write-summary }}" = "true" ] && [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
|
|
if [ -f "${{ inputs.output-delta }}" ]; then
|
|
cat "${{ inputs.output-delta }}" >> "$GITHUB_STEP_SUMMARY"
|
|
fi
|
|
if [ -f "${{ inputs.output-summary }}" ]; then
|
|
cat "${{ inputs.output-summary }}" >> "$GITHUB_STEP_SUMMARY"
|
|
fi
|
|
fi
|