Skip to content

Commit c6287d9

Browse files
jmcombsjmcombs
committed
feat: add Trivy security scanning and SBOM generation
- Add security-scan job with matrix strategy for all 3 images (base-ubuntu, node, python) - Generate SBOM in CycloneDX format and store as workflow artifacts - Scan for CRITICAL, HIGH, and MEDIUM vulnerabilities - Upload SARIF results to GitHub Security tab with separate categories - Add scheduled weekly scans (Sundays 00:00 UTC) to catch new CVEs - Add workflow_dispatch for manual triggering - Add security badges and documentation to README
1 parent 56804aa commit c6287d9

File tree

2 files changed

+75
-5
lines changed

2 files changed

+75
-5
lines changed

‎.github/workflows/build-and-publish.yml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,11 @@ on:
77
pull_request:
88
branches:
99
- main
10+
schedule:
11+
# Run weekly on Sundays at 00:00 UTC to catch new vulnerabilities
12+
- cron: "0 0 * * 0"
13+
workflow_dispatch:
14+
# Allow manual triggering
1015

1116
env:
1217
REGISTRY: ghcr.io
@@ -85,3 +90,57 @@ jobs:
8590
--platform linux/arm64,linux/amd64 \
8691
--output type=registry \
8792
${{ env.LABEL_ARGS }}
93+
94+
# Security scanning job - runs after successful build
95+
security-scan:
96+
needs: build-and-publish
97+
runs-on: ubuntu-latest
98+
# Only run on push to main or scheduled runs (not on PRs to avoid duplicate scans)
99+
if: github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
100+
permissions:
101+
contents: read
102+
packages: read
103+
security-events: write
104+
strategy:
105+
fail-fast: false
106+
matrix:
107+
image: [base-ubuntu, node, python]
108+
109+
steps:
110+
- name: Login to GitHub Container Registry
111+
uses: docker/login-action@v3
112+
with:
113+
registry: ghcr.io
114+
username: ${{ github.actor }}
115+
password: ${{ secrets.GITHUB_TOKEN }}
116+
117+
- name: Pull container image
118+
run: docker pull ghcr.io/${{ github.repository }}:${{ matrix.image }}
119+
120+
- name: Generate SBOM with Trivy
121+
uses: aquasecurity/trivy-action@master
122+
with:
123+
image-ref: "ghcr.io/${{ github.repository }}:${{ matrix.image }}"
124+
format: "cyclonedx"
125+
output: "sbom-${{ matrix.image }}.json"
126+
127+
- name: Upload SBOM as artifact
128+
uses: actions/upload-artifact@v4
129+
with:
130+
name: sbom-${{ matrix.image }}
131+
path: sbom-${{ matrix.image }}.json
132+
retention-days: 90
133+
134+
- name: Scan for vulnerabilities with Trivy
135+
uses: aquasecurity/trivy-action@master
136+
with:
137+
image-ref: "ghcr.io/${{ github.repository }}:${{ matrix.image }}"
138+
format: "sarif"
139+
output: "trivy-${{ matrix.image }}.sarif"
140+
severity: "CRITICAL,HIGH,MEDIUM"
141+
142+
- name: Upload Trivy scan results to GitHub Security tab
143+
uses: github/codeql-action/upload-sarif@v3
144+
with:
145+
sarif_file: "trivy-${{ matrix.image }}.sarif"
146+
category: "container-${{ matrix.image }}"

‎README.md‎

Lines changed: 16 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,19 @@
11
# Devcontainer
22

3-
[![GitHub stars](https://img.shields.io/github/stars/jmcombs/devcontainer)](https://github.com/jmcombs/devcontainer/stargazers) ![GitHub Workflow Status](https://img.shields.io/github/actions/workflow/status/jmcombs/devcontainer/build-and-publish.yml?logo=github)
3+
[![GitHub stars](https://img.shields.io/github/stars/jmcombs/devcontainer)](https://github.com/jmcombs/devcontainer/stargazers)
4+
[![Build and Publish](https://img.shields.io/github/actions/workflow/status/jmcombs/devcontainer/build-and-publish.yml?label=build&logo=github)](https://github.com/jmcombs/devcontainer/actions/workflows/build-and-publish.yml)
5+
[![Security Scan](https://img.shields.io/github/actions/workflow/status/jmcombs/devcontainer/build-and-publish.yml?label=security%20scan&logo=trivy&logoColor=white)](https://github.com/jmcombs/devcontainer/security/code-scanning)
46
[![GitHub issues](https://img.shields.io/github/issues/jmcombs/devcontainer)](https://github.com/jmcombs/devcontainer/issues)
57

8+
## Security
9+
10+
This repository implements automated security scanning for all container images:
11+
12+
- 🔍 **Vulnerability Scanning**: All images are scanned with [Trivy](https://trivy.dev/) for CVEs
13+
- 📋 **SBOM Generation**: Software Bill of Materials generated in CycloneDX format
14+
- 🔄 **Scheduled Scans**: Weekly security scans catch newly discovered vulnerabilities
15+
- 📊 **Security Dashboard**: View results in the [Security tab](https://github.com/jmcombs/devcontainer/security/code-scanning)
16+
617
A collection of [Development Container](https://containers.dev/) definitions for creating consistent, reproducible development environments. This repository provides pre-configured `devcontainer` images to streamline setting up development environments in tools like Visual Studio Code, GitHub Codespaces, or other container-based IDEs.
718

819
## About
@@ -20,10 +31,10 @@ This repository contains a set of **dev container images** which are Docker imag
2031

2132
Below is a list of available Dev Container definitions in this repository:
2233

23-
| Name | Description | Base Image | Documentation |
24-
| -------- | ------------------------------------------------------------ | ------------------------------------- | ------------------------------------------ |
25-
| `python` | Python 3.x environment with common tools (e.g., pip, pylint) | `ghcr.io/jmcombs/devcontainer:python` | [Python Docs](src/python/README.md) |
26-
| `node` | Node.js environment with npm/yarn and VS Code extensions | `ghcr.io/jmcombs/devcontainer:node` | [Node Docs](src/node/README.md) |
34+
| Name | Description | Base Image | Documentation |
35+
| ------------- | ------------------------------------------------------------ | ------------------------------------------ | --------------------------------------------- |
36+
| `python` | Python 3.x environment with common tools (e.g., pip, pylint) | `ghcr.io/jmcombs/devcontainer:python` | [Python Docs](src/python/README.md) |
37+
| `node` | Node.js environment with npm/yarn and VS Code extensions | `ghcr.io/jmcombs/devcontainer:node` | [Node Docs](src/node/README.md) |
2738
| `base-ubuntu` | Base Ubuntu 22.04 image with essential tools | `ghcr.io/jmcombs/devcontainer:base-ubuntu` | [Base Ubuntu Docs](src/base-ubuntu/README.md) |
2839

2940
## Usage

0 commit comments

Comments
 (0)