Skip to content

Commit a913318

Browse files
trasktrask
committed
Trivy
1 parent 36b7372 commit a913318

File tree

4 files changed

+278
-0
lines changed

4 files changed

+278
-0
lines changed

‎.github/workflows/trivy-security-scan.yml‎

Lines changed: 174 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,174 @@
1+
name: Trivy Security Scan
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
- release/*
8+
pull_request:
9+
branches:
10+
- main
11+
- release/*
12+
schedule:
13+
# Run daily at 2:00 AM UTC
14+
- cron: '0 2 * * *'
15+
workflow_dispatch:
16+
17+
permissions:
18+
contents: read
19+
security-events: write # for uploading SARIF results
20+
actions: read
21+
22+
concurrency:
23+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
24+
cancel-in-progress: true
25+
26+
jobs:
27+
trivy-fs-scan:
28+
name: Trivy Filesystem Scan
29+
runs-on: ubuntu-latest
30+
steps:
31+
- name: Checkout code
32+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
33+
34+
- name: Run Trivy vulnerability scanner in filesystem mode
35+
uses: aquasecurity/trivy-action@f781cce5aab226378ee181d764ab90ea0be3cdd8 # v0.29.0
36+
with:
37+
scan-type: 'fs'
38+
scan-ref: '.'
39+
format: 'sarif'
40+
output: 'trivy-fs-results.sarif'
41+
severity: 'CRITICAL,HIGH,MEDIUM'
42+
trivyignores: '.trivyignore'
43+
44+
- name: Upload Trivy scan results to GitHub Security tab
45+
uses: github/codeql-action/upload-sarif@4f3212b61783c3c68e8309a0f18a699764811cda # v3.27.1
46+
if: always()
47+
with:
48+
sarif_file: 'trivy-fs-results.sarif'
49+
50+
- name: Upload filesystem scan results as artifact
51+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
52+
if: always()
53+
with:
54+
name: trivy-fs-scan-results
55+
path: trivy-fs-results.sarif
56+
57+
trivy-java-scan:
58+
name: Trivy Java Dependencies Scan
59+
runs-on: ubuntu-latest
60+
steps:
61+
- name: Checkout code
62+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
63+
64+
- name: Set up JDK for running Gradle
65+
uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
66+
with:
67+
distribution: temurin
68+
java-version: 17
69+
70+
- name: Set up gradle
71+
uses: gradle/actions/setup-gradle@ac638b010cf58a27ee6c972d7336334ccaf61c96 # v4.4.1
72+
with:
73+
cache-read-only: ${{ github.event_name == 'pull_request' }}
74+
75+
- name: Build project
76+
run: ./gradlew build -x test
77+
78+
- name: Run Trivy vulnerability scanner for Java dependencies
79+
uses: aquasecurity/trivy-action@f781cce5aab226378ee181d764ab90ea0be3cdd8 # v0.29.0
80+
with:
81+
scan-type: 'fs'
82+
scan-ref: '.'
83+
scanners: 'vuln'
84+
format: 'sarif'
85+
output: 'trivy-java-results.sarif'
86+
severity: 'CRITICAL,HIGH,MEDIUM'
87+
trivyignores: '.trivyignore'
88+
89+
- name: Upload Java dependencies scan results to GitHub Security tab
90+
uses: github/codeql-action/upload-sarif@4f3212b61783c3c68e8309a0f18a699764811cda # v3.27.1
91+
if: always()
92+
with:
93+
sarif_file: 'trivy-java-results.sarif'
94+
95+
- name: Upload Java scan results as artifact
96+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
97+
if: always()
98+
with:
99+
name: trivy-java-scan-results
100+
path: trivy-java-results.sarif
101+
102+
trivy-config-scan:
103+
name: Trivy Configuration Scan
104+
runs-on: ubuntu-latest
105+
steps:
106+
- name: Checkout code
107+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
108+
109+
- name: Run Trivy configuration scanner
110+
uses: aquasecurity/trivy-action@f781cce5aab226378ee181d764ab90ea0be3cdd8 # v0.29.0
111+
with:
112+
scan-type: 'config'
113+
scan-ref: '.'
114+
format: 'sarif'
115+
output: 'trivy-config-results.sarif'
116+
severity: 'CRITICAL,HIGH,MEDIUM'
117+
trivyignores: '.trivyignore'
118+
119+
- name: Upload configuration scan results to GitHub Security tab
120+
uses: github/codeql-action/upload-sarif@4f3212b61783c3c68e8309a0f18a699764811cda # v3.27.1
121+
if: always()
122+
with:
123+
sarif_file: 'trivy-config-results.sarif'
124+
125+
- name: Upload configuration scan results as artifact
126+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
127+
if: always()
128+
with:
129+
name: trivy-config-scan-results
130+
path: trivy-config-results.sarif
131+
132+
trivy-secret-scan:
133+
name: Trivy Secret Scan
134+
runs-on: ubuntu-latest
135+
steps:
136+
- name: Checkout code
137+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
138+
139+
- name: Run Trivy secret scanner
140+
uses: aquasecurity/trivy-action@f781cce5aab226378ee181d764ab90ea0be3cdd8 # v0.29.0
141+
with:
142+
scan-type: 'fs'
143+
scan-ref: '.'
144+
scanners: 'secret'
145+
format: 'sarif'
146+
output: 'trivy-secret-results.sarif'
147+
trivyignores: '.trivyignore'
148+
149+
- name: Upload secret scan results to GitHub Security tab
150+
uses: github/codeql-action/upload-sarif@4f3212b61783c3c68e8309a0f18a699764811cda # v3.27.1
151+
if: always()
152+
with:
153+
sarif_file: 'trivy-secret-results.sarif'
154+
155+
- name: Upload secret scan results as artifact
156+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
157+
if: always()
158+
with:
159+
name: trivy-secret-scan-results
160+
path: trivy-secret-results.sarif
161+
162+
workflow-notification:
163+
permissions:
164+
contents: read
165+
issues: write
166+
needs:
167+
- trivy-fs-scan
168+
- trivy-java-scan
169+
- trivy-config-scan
170+
- trivy-secret-scan
171+
if: always()
172+
uses: ./.github/workflows/reusable-workflow-notification.yml
173+
with:
174+
success: ${{ !contains(needs.*.result, 'failure') }}

‎.trivy.yaml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
# Trivy configuration file
2+
# https://aquasecurity.github.io/trivy/latest/docs/references/configuration/config-file/
3+
4+
# Vulnerability detection settings
5+
vulnerability:
6+
# Ignore unfixed vulnerabilities
7+
ignore-unfixed: false
8+
# Security scanner types to run
9+
type: "vuln"
10+
11+
# Misconfiguration detection settings
12+
misconfiguration:
13+
# Scan for misconfigurations
14+
enabled: true
15+
# Include test files in misconfiguration scans
16+
include-non-failures: false
17+
18+
# Secret detection settings
19+
secret:
20+
# Enable secret scanning
21+
enabled: true
22+
23+
# License detection settings
24+
license:
25+
# Skip license scanning for now
26+
enabled: false
27+
28+
# Output settings
29+
format: "table"
30+
output: ""
31+
32+
# Cache settings
33+
cache:
34+
# Cache directory (will be set by GitHub Actions)
35+
dir: ""
36+
37+
# Database settings
38+
db:
39+
# Skip database update
40+
skip-update: false
41+
42+
# Skip directories and files
43+
skip-dirs:
44+
- "**/.gradle/**"
45+
- "**/build/**"
46+
- "**/target/**"
47+
- "**/.git/**"
48+
- "**/node_modules/**"
49+
50+
skip-files:
51+
- "**/*.log"
52+
- "**/*.tmp"
53+
- "**/.DS_Store"
54+
55+
# Vulnerability severity levels to include
56+
severity:
57+
- "CRITICAL"
58+
- "HIGH"
59+
- "MEDIUM"
60+
61+
# Exit code settings
62+
exit-code: 0 # Don't fail the build on vulnerabilities found
63+
64+
# Ignore specific vulnerabilities (example)
65+
# IgnoreVulnerabilities:
66+
# - "CVE-2023-12345" # Example: ignore specific CVE if needed

‎.trivyignore‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# Trivy ignore file
2+
# Use this file to ignore specific vulnerabilities that are false positives
3+
# or have been assessed as acceptable risks
4+
#
5+
# Format: CVE-ID [REASON]
6+
# Example:
7+
# CVE-2023-12345 This vulnerability does not affect our usage pattern
8+
# CVE-2024-67890 Fixed in upcoming release, temporary ignore
9+
10+
# Add specific CVEs to ignore here when needed
11+
# Each line should contain a CVE ID and optionally a reason for ignoring it

‎README.md‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,33 @@ On reaching stable status, the `otel.stable` value in `gradle.properties` should
4747
Note that currently all the libraries are released together with the version of this repo, so breaking changes (after stable
4848
status is reached) would bump the major version of all libraries together. This could get complicated so `stable` has a high bar.
4949

50+
## Security
51+
52+
This project takes security seriously and implements multiple layers of security scanning:
53+
54+
- **[Trivy Security Scanning](./docs/TRIVY_SECURITY_SCANNING.md)** - Comprehensive vulnerability, configuration, and secret scanning
55+
- **CodeQL Analysis** - Static code analysis for security vulnerabilities
56+
- **OWASP Dependency Check** - Daily dependency vulnerability scanning
57+
- **OSSF Scorecard** - Security best practices assessment
58+
59+
### Security Scanning
60+
61+
Automated security scans run on every pull request and daily via GitHub Actions. You can also run scans locally:
62+
63+
```bash
64+
# Linux/macOS
65+
./scripts/trivy-local-scan.sh
66+
67+
# Windows
68+
scripts\trivy-local-scan.bat
69+
```
70+
71+
For detailed information about security scanning, see [docs/TRIVY_SECURITY_SCANNING.md](./docs/TRIVY_SECURITY_SCANNING.md).
72+
73+
### Reporting Security Issues
74+
75+
Please report security vulnerabilities to the [OpenTelemetry Security Team](https://github.com/open-telemetry/community/blob/main/SECURITY.md).
76+
5077
## Getting Started
5178

5279
```bash

0 commit comments

Comments
 (0)