Skip to content

Latest commit

 

History

History
60 lines (40 loc) · 1.91 KB

TRIVY.md

File metadata and controls

60 lines (40 loc) · 1.91 KB
Raw

Trivy

According to the official documentation, Trivy is a comprehensive and versatile security scanner. Trivy has scanners that look for security issues, and targets where it can find those issues.

Description

By enabling Trivy in the integration test, the Trivy GitHub action will run a scan in the repository (fs type) or a Docker image (image type) to find vulnerabilities.

The result will be available in the integration test output.

Warning

  • Environment variables have preference over configuration set by trivy-fs-config or trivy-image-config parameters.

How to use

If there is no need for customization, the test can be enabled by setting the parameter trivy-fs-enabled to true.

For fs, the trivy-fs-ref has "." as default value.

Default configuration: will fail with exit code 1 for high and critical vulnerabilities.

Custom configurations can be set in a trivy.yaml file stored in the repository for both types of testing. The location should be set in trivy-fs-config and/or trivy-image-configparameters.

Examples

Default

jobs:
  integration-tests:
    uses: canonical/operator-workflows/.github/workflows/integration_test.yaml@main
    secrets: inherit
    with:
      trivy-fs-enabled: true

Since trivy-fs-ref is not set, the current directory (repository root) will be used as the target.

Custom configuration

jobs:
  integration-tests:
    uses: canonical/operator-workflows/.github/workflows/integration_test.yaml@main
    secrets: inherit
    with:
      trivy-fs-enabled: true
      trivy-fs-config: tests/trivy/trivy.yaml

Example of trivy.yaml content:

format: json
exit-code: 1
severity: CRITICAL

See the Config file for the options list.