From af51c99a945e18a7a5fc52c89fb2532089e0589f Mon Sep 17 00:00:00 2001 From: Jan Jansen Date: Tue, 17 Oct 2023 07:16:21 +0200 Subject: [PATCH] add trivy scan to docker Signed-off-by: Jan Jansen --- .github/workflows/ci-release.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/.github/workflows/ci-release.yml b/.github/workflows/ci-release.yml index 081b32a6ab4..d131adcb560 100644 --- a/.github/workflows/ci-release.yml +++ b/.github/workflows/ci-release.yml @@ -89,6 +89,22 @@ jobs: with: name: distribution-builds path: janusgraph-dist/target/janusgraph-*.zip + - name: Set JanusGraph version environment variable + run: | + export JG_VER="$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)-$(git rev-parse --short HEAD)" + echo "JG_VER=${JG_VER}" >> $GITHUB_ENV + - name: Run Trivy vulnerability scanner + if: github.repository == 'janusgraph/janusgraph' + uses: aquasecurity/trivy-action@0.12.0 + with: + image-ref: 'ghcr.io/janusgraph/janusgraph:${{ env.JG_VER }}' + format: 'sarif' + output: 'trivy-results.sarif' + - name: Upload Trivy scan results to GitHub Security tab + if: github.repository == 'janusgraph/janusgraph' + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: 'trivy-results.sarif' tp-tests: runs-on: ubuntu-22.04