From afd9f24d71cf6246cff8863ef9ad65d9ccc0f563 Mon Sep 17 00:00:00 2001 From: Avgustin Marinov Date: Fri, 15 Dec 2023 14:08:50 +0200 Subject: [PATCH] Adds .trivyignore and use it in the scan (#1520) Signed-off-by: Marinov Avgustin --- .github/workflows/.trivyignore | 5 +++++ .github/workflows/trivy-scan.yml | 5 +++-- 2 files changed, 8 insertions(+), 2 deletions(-) create mode 100644 .github/workflows/.trivyignore diff --git a/.github/workflows/.trivyignore b/.github/workflows/.trivyignore new file mode 100644 index 0000000000..919ad390c0 --- /dev/null +++ b/.github/workflows/.trivyignore @@ -0,0 +1,5 @@ +# org.springframework:spring-web:5.3.31.RELEASE, ineffective vulnerability - hawkBit doesn't use beans of type HttpInvokerServiceExporter in applications +CVE-2016-1000027 + +# org.yaml:snakeyaml:1.33, ineffective vulnerability - Not applicable. Applications does not consume user-provided YAML data +CVE-2022-1471 \ No newline at end of file diff --git a/.github/workflows/trivy-scan.yml b/.github/workflows/trivy-scan.yml index dc2b2c28d0..ca27e868ca 100644 --- a/.github/workflows/trivy-scan.yml +++ b/.github/workflows/trivy-scan.yml @@ -32,7 +32,8 @@ jobs: mvn clean install -DskipTests && \ cd hawkbit-runtime/docker/docker_build && \ chmod +x build_all_dev.sh && \ - ./build_all_dev.sh + ./build_all_dev.sh && \ + cd ../../.. - name: Determine most recent Trivy version run: | @@ -48,7 +49,7 @@ jobs: mkdir -p scans/eclipse/hawkbit for IMAGE in $(docker image ls --format "{{.Repository}}:{{.Tag}}" "hawkbit/hawkbit-*:latest"); do echo "Scanning image ${IMAGE} ..." - ./trivy image "${IMAGE}" --ignore-unfixed --severity HIGH,CRITICAL --vuln-type library --output "scans/eclipse/$IMAGE.sarif" --format sarif + ./trivy image "${IMAGE}" --ignore-unfixed --ignorefile .github/workflows/.trivyignore --severity HIGH,CRITICAL --vuln-type library --output "scans/eclipse/$IMAGE.sarif" --format sarif done - name: Upload Docker image scan results to GitHub Security tab