trivy.yaml

name: Trivy scanner

on:
  workflow_dispatch:
  push:
    branches: [ master, 'release-**' ]
    paths:
      - '.github/workflows/trivy.yaml'
      - 'pkg/**.go'
      - '!pkg/azureclients/v2/**.go'
      - '!kubetest2-aks/**.go'
      - 'cmd/**.go'
      - 'go.*'
      - '!vendor/**'
      - 'health-probe-proxy/**'
  pull_request:
    branches: [ master, 'release-**' ]
    paths:
      - '.github/workflows/trivy.yaml'
      - 'pkg/**.go'
      - '!pkg/azureclients/v2/**.go'
      - '!kubetest2-aks/**.go'
      - 'cmd/**.go'
      - 'go.*'
      - '!vendor/**'
      - 'health-probe-proxy/**'
  schedule:
    - cron: '35 12 * * 4'
permissions:
  contents: read
jobs:
  build:
    permissions:
      contents: read # for actions/checkout to fetch code
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
    name: Build
    runs-on: ubuntu-latest
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
        with:
          egress-policy: audit

      - name: Checkout code
        uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
      - name: Set up Go 1.x
        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
        with:
          go-version: '>=1.20'
          check-latest: true
        id: go
      - name: Build images
        run: |
          export TAG=${{ github.sha }}
          export IMAGE_TAG=${{ github.sha }}
          make build-ccm-image
          make build-node-image-linux-amd64
          cd health-probe-proxy && make build-health-probe-proxy-image && cd ..

      - name: Run Trivy scanner CCM
        uses: aquasecurity/trivy-action@d710430a6722f083d3b36b8339ff66b32f22ee55 # master
        with:
          image-ref: 'local/azure-cloud-controller-manager:${{ github.sha }}'
          format: 'sarif'
          output: 'trivy-ccm-results.sarif'
          exit-code: '1'
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN'
      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4
        with:
          sarif_file: 'trivy-ccm-results.sarif'
          category: azure-cloud-controller-manager-image
      - name: Run Trivy scanner CNM
        uses: aquasecurity/trivy-action@d710430a6722f083d3b36b8339ff66b32f22ee55 # master
        with:
          image-ref: 'local/azure-cloud-node-manager:${{ github.sha }}-linux-amd64'
          format: 'sarif'
          output: 'trivy-cnm-linux-results.sarif'
          exit-code: '1'
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN'
      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4
        with:
          sarif_file: 'trivy-cnm-linux-results.sarif'
          category: azure-cloud-node-manager-linux-image
      - name: Run Trivy scanner health-probe-proxy
        uses: aquasecurity/trivy-action@d710430a6722f083d3b36b8339ff66b32f22ee55 # master
        with:
          image-ref: 'local/health-probe-proxy:${{ github.sha }}'
          format: 'sarif'
          output: 'trivy-health-probe-proxy-linux-results.sarif'
          exit-code: '1'
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN'
      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4
        with:
          sarif_file: 'trivy-health-probe-proxy-linux-results.sarif'
          category: health-probe-proxy-linux-image

      - name: Run Trivy vulnerability scanner in repo mode
        uses: aquasecurity/trivy-action@d710430a6722f083d3b36b8339ff66b32f22ee55 # master
        with:
          scan-type: 'fs'
          ignore-unfixed: true
          format: 'github'
          output: 'dependency-results.sbom.json'
          image-ref: '.'
          github-pat: ${{ secrets.GITHUB_TOKEN }}