Skip to content

Commit df65449

Browse files
nikpivkinnikpivkin
authored
chore: update README (#493)
Signed-off-by: Nikita Pivkin <[email protected]>
1 parent 0317097 commit df65449

1 file changed

Lines changed: 76 additions & 32 deletions

File tree

‎README.md‎

Lines changed: 76 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ jobs:
5050
- name: Build an image from Dockerfile
5151
run: docker build -t docker.io/my-organization/my-app:${{ github.sha }} .
5252
- name: Run Trivy vulnerability scanner
53-
uses: aquasecurity/trivy-action@0.28.0
53+
uses: aquasecurity/trivy-action@0.33.1
5454
with:
5555
image-ref: 'docker.io/my-organization/my-app:${{ github.sha }}'
5656
format: 'table'
@@ -78,7 +78,7 @@ jobs:
7878
uses: actions/checkout@v4
7979

8080
- name: Run Trivy vulnerability scanner in fs mode
81-
uses: aquasecurity/trivy-action@0.28.0
81+
uses: aquasecurity/trivy-action@0.33.1
8282
with:
8383
scan-type: 'fs'
8484
scan-ref: '.'
@@ -119,7 +119,7 @@ If you want to disable caching, set the `cache` input to `false`, but we recomme
119119

120120
```yaml
121121
- name: Run Trivy scanner without cache
122-
uses: aquasecurity/trivy-action@0.28.0
122+
uses: aquasecurity/trivy-action@0.33.1
123123
with:
124124
scan-type: 'fs'
125125
scan-ref: '.'
@@ -180,7 +180,7 @@ When running a scan, set the environment variables `TRIVY_SKIP_DB_UPDATE` and `T
180180

181181
```yaml
182182
- name: Run Trivy scanner without downloading DBs
183-
uses: aquasecurity/trivy-action@0.28.0
183+
uses: aquasecurity/trivy-action@0.33.1
184184
with:
185185
scan-type: 'image'
186186
scan-ref: 'myimage'
@@ -287,7 +287,7 @@ Therefore, you can't install `Trivy` using the `setup-trivy` action.
287287
To fix this problem, you need to overwrite the token for `setup-trivy` using `token-setup-trivy` input:
288288
```yaml
289289
- name: Run Trivy scanner without cache
290-
uses: aquasecurity/trivy-action@0.28.0
290+
uses: aquasecurity/trivy-action@0.33.1
291291
with:
292292
scan-type: 'fs'
293293
scan-ref: '.'
@@ -318,7 +318,7 @@ jobs:
318318
docker save -o vuln-image.tar <your-docker-image>
319319
320320
- name: Run Trivy vulnerability scanner in tarball mode
321-
uses: aquasecurity/trivy-action@0.28.0
321+
uses: aquasecurity/trivy-action@0.33.1
322322
with:
323323
input: /github/workspace/vuln-image.tar
324324
severity: 'CRITICAL,HIGH'
@@ -345,7 +345,7 @@ jobs:
345345
uses: actions/checkout@v4
346346
347347
- name: Run Trivy vulnerability scanner
348-
uses: aquasecurity/trivy-action@0.28.0
348+
uses: aquasecurity/trivy-action@0.33.1
349349
with:
350350
scan-type: "fs"
351351
scan-ref: .
@@ -374,7 +374,7 @@ jobs:
374374
uses: actions/checkout@v4
375375
376376
- name: Run Trivy vulnerability scanner
377-
uses: aquasecurity/trivy-action@0.28.0
377+
uses: aquasecurity/trivy-action@0.33.1
378378
with:
379379
scan-type: "fs"
380380
scan-ref: .
@@ -395,6 +395,9 @@ jobs:
395395
build:
396396
name: Build
397397
runs-on: ubuntu-24.04
398+
permissions:
399+
contents: read # Required to checkout and read repo files
400+
security-events: write # Required to upload SARIF files to Security tab
398401
steps:
399402
- name: Checkout code
400403
uses: actions/checkout@v4
@@ -404,14 +407,14 @@ jobs:
404407
docker build -t docker.io/my-organization/my-app:${{ github.sha }} .
405408
406409
- name: Run Trivy vulnerability scanner
407-
uses: aquasecurity/trivy-action@0.28.0
410+
uses: aquasecurity/trivy-action@0.33.1
408411
with:
409412
image-ref: 'docker.io/my-organization/my-app:${{ github.sha }}'
410413
format: 'sarif'
411414
output: 'trivy-results.sarif'
412415
413416
- name: Upload Trivy scan results to GitHub Security tab
414-
uses: github/codeql-action/upload-sarif@v3
417+
uses: github/codeql-action/upload-sarif@v4
415418
with:
416419
sarif_file: 'trivy-results.sarif'
417420
```
@@ -430,6 +433,9 @@ jobs:
430433
build:
431434
name: Build
432435
runs-on: ubuntu-24.04
436+
permissions:
437+
contents: read # Required to checkout and read repo files
438+
security-events: write # Required to upload SARIF files to Security tab
433439
steps:
434440
- name: Checkout code
435441
uses: actions/checkout@v4
@@ -439,14 +445,14 @@ jobs:
439445
docker build -t docker.io/my-organization/my-app:${{ github.sha }} .
440446
441447
- name: Run Trivy vulnerability scanner
442-
uses: aquasecurity/trivy-action@0.28.0
448+
uses: aquasecurity/trivy-action@0.33.1
443449
with:
444450
image-ref: 'docker.io/my-organization/my-app:${{ github.sha }}'
445451
format: 'sarif'
446452
output: 'trivy-results.sarif'
447453
448454
- name: Upload Trivy scan results to GitHub Security tab
449-
uses: github/codeql-action/upload-sarif@v3
455+
uses: github/codeql-action/upload-sarif@v4
450456
if: always()
451457
with:
452458
sarif_file: 'trivy-results.sarif'
@@ -455,7 +461,7 @@ jobs:
455461
See this for more details: https://docs.github.com/en/actions/learn-github-actions/expressions#always
456462

457463
### Using Trivy to scan your Git repo
458-
It's also possible to scan your git repos with Trivy's built-in repo scan. This can be handy if you want to run Trivy as a build time check on each PR that gets opened in your repo. This helps you identify potential vulnerablites that might get introduced with each PR.
464+
It's also possible to scan your git repos with Trivy's built-in repo scan. This can be handy if you want to run Trivy as a build time check on each PR that gets opened in your repo. This helps you identify potential vulnerabilities that might get introduced with each PR.
459465

460466
If you have [GitHub code scanning](https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/about-code-scanning) available you can use Trivy as a scanning tool as follows:
461467
```yaml
@@ -469,12 +475,15 @@ jobs:
469475
build:
470476
name: Build
471477
runs-on: ubuntu-24.04
478+
permissions:
479+
contents: read # Required to checkout and read repo files
480+
security-events: write # Required to upload SARIF files to Security tab
472481
steps:
473482
- name: Checkout code
474483
uses: actions/checkout@v4
475484
476485
- name: Run Trivy vulnerability scanner in repo mode
477-
uses: aquasecurity/trivy-action@0.28.0
486+
uses: aquasecurity/trivy-action@0.33.1
478487
with:
479488
scan-type: 'fs'
480489
ignore-unfixed: true
@@ -483,13 +492,13 @@ jobs:
483492
severity: 'CRITICAL'
484493
485494
- name: Upload Trivy scan results to GitHub Security tab
486-
uses: github/codeql-action/upload-sarif@v3
495+
uses: github/codeql-action/upload-sarif@v4
487496
with:
488497
sarif_file: 'trivy-results.sarif'
489498
```
490499

491500
### Using Trivy to scan your rootfs directories
492-
It's also possible to scan your rootfs directories with Trivy's built-in rootfs scan. This can be handy if you want to run Trivy as a build time check on each PR that gets opened in your repo. This helps you identify potential vulnerablites that might get introduced with each PR.
501+
It's also possible to scan your rootfs directories with Trivy's built-in rootfs scan. This can be handy if you want to run Trivy as a build time check on each PR that gets opened in your repo. This helps you identify potential vulnerabilities that might get introduced with each PR.
493502

494503
If you have [GitHub code scanning](https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/about-code-scanning) available you can use Trivy as a scanning tool as follows:
495504
```yaml
@@ -503,12 +512,15 @@ jobs:
503512
build:
504513
name: Build
505514
runs-on: ubuntu-24.04
515+
permissions:
516+
contents: read # Required to checkout and read repo files
517+
security-events: write # Required to upload SARIF files to Security tab
506518
steps:
507519
- name: Checkout code
508520
uses: actions/checkout@v4
509521
510522
- name: Run Trivy vulnerability scanner with rootfs command
511-
uses: aquasecurity/trivy-action@0.28.0
523+
uses: aquasecurity/trivy-action@0.33.1
512524
with:
513525
scan-type: 'rootfs'
514526
scan-ref: 'rootfs-example-binary'
@@ -518,13 +530,15 @@ jobs:
518530
severity: 'CRITICAL'
519531
520532
- name: Upload Trivy scan results to GitHub Security tab
521-
uses: github/codeql-action/upload-sarif@v3
533+
uses: github/codeql-action/upload-sarif@v4
522534
with:
523535
sarif_file: 'trivy-results.sarif'
524536
```
525537

526538
### Using Trivy to scan Infrastructure as Code
527-
It's also possible to scan your IaC repos with Trivy's built-in repo scan. This can be handy if you want to run Trivy as a build time check on each PR that gets opened in your repo. This helps you identify potential vulnerablites that might get introduced with each PR.
539+
It's also possible to scan your IaC repos with Trivy's built-in repo scan.
540+
This can be handy if you want to run Trivy as a build time check on each PR that gets opened in your repo.
541+
This helps you identify potential vulnerabilities that might get introduced with each PR.
528542

529543
If you have [GitHub code scanning](https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/about-code-scanning) available you can use Trivy as a scanning tool as follows:
530544
```yaml
@@ -538,12 +552,15 @@ jobs:
538552
build:
539553
name: Build
540554
runs-on: ubuntu-24.04
555+
permissions:
556+
contents: read # Required to checkout and read repo files
557+
security-events: write # Required to upload SARIF files to Security tab
541558
steps:
542559
- name: Checkout code
543560
uses: actions/checkout@v4
544561
545562
- name: Run Trivy vulnerability scanner in IaC mode
546-
uses: aquasecurity/trivy-action@0.28.0
563+
uses: aquasecurity/trivy-action@0.33.1
547564
with:
548565
scan-type: 'config'
549566
hide-progress: true
@@ -553,11 +570,26 @@ jobs:
553570
severity: 'CRITICAL,HIGH'
554571
555572
- name: Upload Trivy scan results to GitHub Security tab
556-
uses: github/codeql-action/upload-sarif@v3
573+
if: always()
574+
uses: github/codeql-action/upload-sarif@v4
557575
with:
558576
sarif_file: 'trivy-results.sarif'
559577
```
560578

579+
**Note**: If your Terraform configuration contains private modules, configure Git to authenticate with the repository hosting them.
580+
This can be done by adding a step in your CI workflow that sets up access, for example using a Personal Access Token (PAT) or SSH keys:
581+
582+
```yaml
583+
- name: Configure Git for private modules
584+
run: |
585+
git config --global url."https://$GITHUB_USER:[email protected]/".insteadOf "https://github.com/"
586+
env:
587+
GITHUB_USER: ${{ github.actor }}
588+
PRIVATE_REPO_TOKEN: ${{ secrets.PRIVATE_REPO_TOKEN }}
589+
```
590+
This ensures Trivy can download private modules.
591+
592+
561593
### Using Trivy to generate SBOM
562594
It's possible for Trivy to generate an [SBOM](https://www.aquasec.com/cloud-native-academy/supply-chain-security/sbom/) of your dependencies and submit them to a consumer like [GitHub Dependency Graph](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph).
563595

@@ -585,7 +617,7 @@ jobs:
585617
uses: actions/checkout@v4
586618
587619
- name: Run Trivy in GitHub SBOM mode and submit results to Dependency Graph
588-
uses: aquasecurity/trivy-action@0.28.0
620+
uses: aquasecurity/trivy-action@0.33.1
589621
with:
590622
scan-type: 'fs'
591623
format: 'github'
@@ -615,7 +647,7 @@ jobs:
615647
runs-on: ubuntu-latest
616648
steps:
617649
- name: Scan image in a private registry
618-
uses: aquasecurity/trivy-action@0.28.0
650+
uses: aquasecurity/trivy-action@0.33.1
619651
with:
620652
image-ref: "private_image_registry/image_name:image_tag"
621653
scan-type: image
@@ -653,12 +685,15 @@ jobs:
653685
build:
654686
name: Build
655687
runs-on: ubuntu-24.04
688+
permissions:
689+
contents: read # Required to checkout and read repo files
690+
security-events: write # Required to upload SARIF results to the GitHub Security tab
656691
steps:
657692
- name: Checkout code
658693
uses: actions/checkout@v4
659694
660695
- name: Run Trivy vulnerability scanner
661-
uses: aquasecurity/trivy-action@0.28.0
696+
uses: aquasecurity/trivy-action@0.33.1
662697
with:
663698
image-ref: 'docker.io/my-organization/my-app:${{ github.sha }}'
664699
format: 'sarif'
@@ -668,7 +703,7 @@ jobs:
668703
TRIVY_PASSWORD: Password
669704
670705
- name: Upload Trivy scan results to GitHub Security tab
671-
uses: github/codeql-action/upload-sarif@v3
706+
uses: github/codeql-action/upload-sarif@v4
672707
with:
673708
sarif_file: 'trivy-results.sarif'
674709
```
@@ -689,12 +724,15 @@ jobs:
689724
build:
690725
name: Build
691726
runs-on: ubuntu-24.04
727+
permissions:
728+
contents: read # Required to checkout and read repo files
729+
security-events: write # Required to upload SARIF files to Security tab
692730
steps:
693731
- name: Checkout code
694732
uses: actions/checkout@v4
695733
696734
- name: Run Trivy vulnerability scanner
697-
uses: aquasecurity/trivy-action@0.28.0
735+
uses: aquasecurity/trivy-action@0.33.1
698736
with:
699737
image-ref: 'aws_account_id.dkr.ecr.region.amazonaws.com/imageName:${{ github.sha }}'
700738
format: 'sarif'
@@ -705,7 +743,7 @@ jobs:
705743
AWS_DEFAULT_REGION: us-west-2
706744
707745
- name: Upload Trivy scan results to GitHub Security tab
708-
uses: github/codeql-action/upload-sarif@v3
746+
uses: github/codeql-action/upload-sarif@v4
709747
with:
710748
sarif_file: 'trivy-results.sarif'
711749
```
@@ -725,12 +763,15 @@ jobs:
725763
build:
726764
name: Build
727765
runs-on: ubuntu-24.04
766+
permissions:
767+
contents: read # Required to checkout and read repo files
768+
security-events: write # Required to upload SARIF files to Security tab
728769
steps:
729770
- name: Checkout code
730771
uses: actions/checkout@v4
731772
732773
- name: Run Trivy vulnerability scanner
733-
uses: aquasecurity/trivy-action@0.28.0
774+
uses: aquasecurity/trivy-action@0.33.1
734775
with:
735776
image-ref: 'docker.io/my-organization/my-app:${{ github.sha }}'
736777
format: 'sarif'
@@ -739,7 +780,7 @@ jobs:
739780
GOOGLE_APPLICATION_CREDENTIAL: /path/to/credential.json
740781
741782
- name: Upload Trivy scan results to GitHub Security tab
742-
uses: github/codeql-action/upload-sarif@v3
783+
uses: github/codeql-action/upload-sarif@v4
743784
with:
744785
sarif_file: 'trivy-results.sarif'
745786
```
@@ -758,12 +799,15 @@ jobs:
758799
build:
759800
name: Build
760801
runs-on: ubuntu-24.04
802+
permissions:
803+
contents: read # Required to checkout and read repo files
804+
security-events: write # Required to upload SARIF files to Security tab
761805
steps:
762806
- name: Checkout code
763807
uses: actions/checkout@v4
764808
765809
- name: Run Trivy vulnerability scanner
766-
uses: aquasecurity/trivy-action@0.28.0
810+
uses: aquasecurity/trivy-action@0.33.1
767811
with:
768812
image-ref: 'docker.io/my-organization/my-app:${{ github.sha }}'
769813
format: 'sarif'
@@ -773,7 +817,7 @@ jobs:
773817
TRIVY_PASSWORD: Password
774818
775819
- name: Upload Trivy scan results to GitHub Security tab
776-
uses: github/codeql-action/upload-sarif@v3
820+
uses: github/codeql-action/upload-sarif@v4
777821
with:
778822
sarif_file: 'trivy-results.sarif'
779823
```
@@ -786,7 +830,7 @@ This step is especially useful for private repositories without [GitHub Advanced
786830

787831
```yaml
788832
- name: Run Trivy scanner
789-
uses: aquasecurity/trivy-action@0.28.0
833+
uses: aquasecurity/trivy-action@0.33.1
790834
with:
791835
scan-type: config
792836
hide-progress: true

0 commit comments

Comments
 (0)