Skip to content

Commit 7c23d82

Browse files
devdropsdevdrops
authored
Create trivy.yml
1 parent 65e0d85 commit 7c23d82

File tree

1 file changed

+193
-0
lines changed

1 file changed

+193
-0
lines changed

‎.github/workflows/trivy.yml‎

Lines changed: 193 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,193 @@
1+
# This workflow uses actions that are not certified by GitHub.
2+
# They are provided by a third-party and are governed by
3+
# separate terms of service, privacy policy, and support
4+
# documentation.
5+
6+
name: trivy
7+
8+
on:
9+
push:
10+
branches: [ "main" ]
11+
schedule:
12+
- cron: '40 11 * * 3'
13+
14+
permissions:
15+
contents: read
16+
17+
jobs:
18+
build-7-4:
19+
permissions:
20+
contents: read # for actions/checkout to fetch code
21+
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
22+
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
23+
name: Build 7.4 images
24+
runs-on: "ubuntu-20.04"
25+
steps:
26+
- name: Checkout code
27+
uses: actions/checkout@v3
28+
29+
- name: Build image from Dockerfile
30+
run: |
31+
cd ./7.4
32+
make latest
33+
34+
- name: Run Trivy vulnerability scanner (xdebug == false)
35+
uses: aquasecurity/trivy-action@7b7aa264d83dc58691451798b4d117d53d21edfe
36+
with:
37+
image-ref: 'docker.io/devdrops/php-toolbox:7.4'
38+
format: 'template'
39+
template: '@/contrib/sarif.tpl'
40+
output: 'trivy-results-74.sarif'
41+
severity: 'CRITICAL,HIGH'
42+
43+
- name: Run Trivy vulnerability scanner (xdebug == true)
44+
uses: aquasecurity/trivy-action@7b7aa264d83dc58691451798b4d117d53d21edfe
45+
with:
46+
image-ref: 'docker.io/devdrops/php-toolbox:7.4-xdebug'
47+
format: 'template'
48+
template: '@/contrib/sarif.tpl'
49+
output: 'trivy-results-74-xdebug.sarif'
50+
severity: 'CRITICAL,HIGH'
51+
52+
- name: Upload Trivy scan results to GitHub Security tab
53+
uses: github/codeql-action/upload-sarif@v2
54+
with:
55+
sarif_file: 'trivy-results-74.sarif'
56+
57+
- name: Upload Trivy scan results to GitHub Security tab
58+
uses: github/codeql-action/upload-sarif@v2
59+
with:
60+
sarif_file: 'trivy-results-74-xdebug.sarif'
61+
62+
build-8-0:
63+
permissions:
64+
contents: read # for actions/checkout to fetch code
65+
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
66+
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
67+
name: Build 8.0 images
68+
runs-on: "ubuntu-20.04"
69+
steps:
70+
- name: Checkout code
71+
uses: actions/checkout@v3
72+
73+
- name: Build image from Dockerfile
74+
run: |
75+
cd ./8.0
76+
make latest
77+
78+
- name: Run Trivy vulnerability scanner (xdebug == false)
79+
uses: aquasecurity/trivy-action@7b7aa264d83dc58691451798b4d117d53d21edfe
80+
with:
81+
image-ref: 'docker.io/devdrops/php-toolbox:8.0'
82+
format: 'template'
83+
template: '@/contrib/sarif.tpl'
84+
output: 'trivy-results-80.sarif'
85+
severity: 'CRITICAL,HIGH'
86+
87+
- name: Run Trivy vulnerability scanner (xdebug == true)
88+
uses: aquasecurity/trivy-action@7b7aa264d83dc58691451798b4d117d53d21edfe
89+
with:
90+
image-ref: 'docker.io/devdrops/php-toolbox:8.0-xdebug'
91+
format: 'template'
92+
template: '@/contrib/sarif.tpl'
93+
output: 'trivy-results-80-xdebug.sarif'
94+
severity: 'CRITICAL,HIGH'
95+
96+
- name: Upload Trivy scan results to GitHub Security tab
97+
uses: github/codeql-action/upload-sarif@v2
98+
with:
99+
sarif_file: 'trivy-results-80.sarif'
100+
101+
- name: Upload Trivy scan results to GitHub Security tab
102+
uses: github/codeql-action/upload-sarif@v2
103+
with:
104+
sarif_file: 'trivy-results-80-xdebug.sarif'
105+
106+
build-8.1:
107+
permissions:
108+
contents: read # for actions/checkout to fetch code
109+
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
110+
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
111+
name: Build 8.1 images
112+
runs-on: "ubuntu-20.04"
113+
steps:
114+
- name: Checkout code
115+
uses: actions/checkout@v3
116+
117+
- name: Build image from Dockerfile
118+
run: |
119+
cd ./8.1
120+
make latest
121+
122+
- name: Run Trivy vulnerability scanner (xdebug == false)
123+
uses: aquasecurity/trivy-action@7b7aa264d83dc58691451798b4d117d53d21edfe
124+
with:
125+
image-ref: 'docker.io/devdrops/php-toolbox:8.1'
126+
format: 'template'
127+
template: '@/contrib/sarif.tpl'
128+
output: 'trivy-results-81.sarif'
129+
severity: 'CRITICAL,HIGH'
130+
131+
- name: Run Trivy vulnerability scanner (xdebug == true)
132+
uses: aquasecurity/trivy-action@7b7aa264d83dc58691451798b4d117d53d21edfe
133+
with:
134+
image-ref: 'docker.io/devdrops/php-toolbox:8.1-xdebug'
135+
format: 'template'
136+
template: '@/contrib/sarif.tpl'
137+
output: 'trivy-results-81-xdebug.sarif'
138+
severity: 'CRITICAL,HIGH'
139+
140+
- name: Upload Trivy scan results to GitHub Security tab
141+
uses: github/codeql-action/upload-sarif@v2
142+
with:
143+
sarif_file: 'trivy-results-81.sarif'
144+
145+
- name: Upload Trivy scan results to GitHub Security tab
146+
uses: github/codeql-action/upload-sarif@v2
147+
with:
148+
sarif_file: 'trivy-results-81-xdebug.sarif'
149+
150+
build-8-2:
151+
permissions:
152+
contents: read # for actions/checkout to fetch code
153+
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
154+
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
155+
name: Build 8.2 images
156+
runs-on: "ubuntu-20.04"
157+
steps:
158+
- name: Checkout code
159+
uses: actions/checkout@v3
160+
161+
- name: Build image from Dockerfile
162+
run: |
163+
cd ./8.2
164+
make latest
165+
166+
- name: Run Trivy vulnerability scanner (xdebug == false)
167+
uses: aquasecurity/trivy-action@7b7aa264d83dc58691451798b4d117d53d21edfe
168+
with:
169+
image-ref: 'docker.io/devdrops/php-toolbox:8.2'
170+
format: 'template'
171+
template: '@/contrib/sarif.tpl'
172+
output: 'trivy-results-82.sarif'
173+
severity: 'CRITICAL,HIGH'
174+
175+
- name: Run Trivy vulnerability scanner (xdebug == true)
176+
uses: aquasecurity/trivy-action@7b7aa264d83dc58691451798b4d117d53d21edfe
177+
with:
178+
image-ref: 'docker.io/devdrops/php-toolbox:8.2-xdebug'
179+
format: 'template'
180+
template: '@/contrib/sarif.tpl'
181+
output: 'trivy-results-82-xdebug.sarif'
182+
severity: 'CRITICAL,HIGH'
183+
184+
- name: Upload Trivy scan results to GitHub Security tab
185+
uses: github/codeql-action/upload-sarif@v2
186+
with:
187+
sarif_file: 'trivy-results-82.sarif'
188+
189+
- name: Upload Trivy scan results to GitHub Security tab
190+
uses: github/codeql-action/upload-sarif@v2
191+
with:
192+
sarif_file: 'trivy-results-82-xdebug.sarif'
193+
sarif_file: 'trivy-results-82-xdebug.sarif'

0 commit comments

Comments
 (0)