diff --git a/.github/trivy-markdown.tpl b/.github/trivy-markdown.tpl
new file mode 100644
index 0000000..e5d5ce0
--- /dev/null
+++ b/.github/trivy-markdown.tpl
@@ -0,0 +1,56 @@
+{{- if . }}
+{{- range . }}
+
Target {{ escapeXML .Target }}
+{{- if (eq (len .Vulnerabilities) 0) }}
+No Vulnerabilities found
+{{- else }}
+Vulnerabilities ({{ len .Vulnerabilities }})
+
+
+ | Package |
+ ID |
+ Severity |
+ Installed Version |
+ Fixed Version |
+
+ {{- range .Vulnerabilities }}
+
+ {{ escapeXML .PkgName }} |
+ {{ escapeXML .VulnerabilityID }} |
+ {{ escapeXML .Severity }} |
+ {{ escapeXML .InstalledVersion }} |
+ {{ escapeXML .FixedVersion }} |
+
+ {{- end }}
+
+{{- end }}
+{{- if (eq (len .Misconfigurations ) 0) }}
+No Misconfigurations found
+{{- else }}
+Misconfigurations
+
+
+ | Type |
+ ID |
+ Check |
+ Severity |
+ Message |
+
+ {{- range .Misconfigurations }}
+
+ | {{ escapeXML .Type }} |
+ {{ escapeXML .ID }} |
+ {{ escapeXML .Title }} |
+ {{ escapeXML .Severity }} |
+
+ {{ escapeXML .Message }}
+ {{ escapeXML .PrimaryURL }}
+ |
+
+ {{- end }}
+
+{{- end }}
+{{- end }}
+{{- else }}
+Trivy Returned Empty Report
+{{- end }}
diff --git a/.github/workflows/trivy.yaml b/.github/workflows/trivy.yaml
index 5a4be42..12e7d75 100644
--- a/.github/workflows/trivy.yaml
+++ b/.github/workflows/trivy.yaml
@@ -87,8 +87,11 @@ jobs:
uses: aquasecurity/trivy-action@v0.36.0
with:
image-ref: '${{ env.REGISTRY }}/${{ needs.preparation.outputs.repo }}/${{ matrix.folder }}:${{ env.TARGET_IMAGE_BASETAG }}'
- format: 'sarif'
- output: 'trivy-results.sarif'
+ #format: 'sarif'
+ #output: 'trivy-results.sarif'
+ format: 'template'
+ output: 'trivy-results.md'
+ template: "@.github/trivy-markdown.tpl"
severity: 'CRITICAL,HIGH'
ignore-unfixed: true
env:
@@ -96,8 +99,16 @@ jobs:
TRIVY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
INPUT_LIMIT_SEVERITIES_FOR_SARIF: true
TARGET_IMAGE_BASETAG: ${{ env.TARGET_IMAGE_BASETAG }}
- - name: Upload Trivy scan results to GitHub Security tab
- uses: github/codeql-action/upload-sarif@v4
+ - name: Upload Trivy scan results as Markdows report
if: always()
- with:
- sarif_file: 'trivy-results.sarif'
+ run: |
+ echo "# Trivy Scan Results for ${{ matrix.folder }}:${{ env.TARGET_IMAGE_BASETAG }}" > ${GITHUB_STEP_SUMMARY}
+ cat trivy-results.md >> ${GITHUB_STEP_SUMMARY}
+ echo "Trivy scan results uploaded as Markdown report"
+ env:
+ TARGET_IMAGE_BASETAG: ${{ env.TARGET_IMAGE_BASETAG }}
+ #- name: Upload Trivy scan results to GitHub Security tab
+ # uses: github/codeql-action/upload-sarif@v4
+ # if: always()
+ # with:
+ # sarif_file: 'trivy-results.sarif'