Update descriptions #1417
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: PR Vulnerability Scan | |
| on: pull_request_target | |
| permissions: | |
| pull-requests: write | |
| issues: write | |
| jobs: | |
| trivy: | |
| name: Trivy Scan | |
| runs-on: ubuntu-20.04 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v3 | |
| - name: Build Loki Image | |
| run: | | |
| IMAGE_TAG="$(./tools/image-tag)" | |
| make loki-image | |
| echo "IMAGE_TAG=${IMAGE_TAG}" >> $GITHUB_ENV | |
| - name: Run Trivy image scanner | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: "docker.io/grafana/loki:${{ env.IMAGE_TAG }}" | |
| format: "json" | |
| output: "trivy-image.json" | |
| severity: "CRITICAL,HIGH" | |
| - name: Run Trivy fs scanner | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| scan-type: "fs" | |
| scan-ref: "go.mod" | |
| format: "json" | |
| output: "trivy-fs.json" | |
| severity: "CRITICAL,HIGH" | |
| - name: Prepare Trivy Message | |
| run: | | |
| echo "Trivy scan found the following vulnerabilities:" > trivy.txt | |
| - name: Format Trivy Message | |
| uses: sergeysova/jq-action@v2 | |
| continue-on-error: true | |
| with: | |
| cmd: | | |
| jq -r '.Results[] | select(.Vulnerabilities != null) | .Target as $target | .Type as $type | .Vulnerabilities[] | "* **\(.Severity)**, Target: \($target), Type: \($type) [\(.Title)](\(.PrimaryURL)) in `\(.PkgName)` v\(.InstalledVersion). Fixed in v\(.FixedVersion)"' trivy-image.json >> trivy.txt | |
| jq -r '.Results[] | select(.Vulnerabilities != null) | .Target as $target | .Type as $type | .Vulnerabilities[] | "* **\(.Severity)**, Target: \($target), Type: \($type) [\(.Title)](\(.PrimaryURL)) in `\(.PkgName)` v\(.InstalledVersion). Fixed in v\(.FixedVersion)"' trivy-fs.json >> trivy.text | |
| - name: Determine whether to comment | |
| continue-on-error: true | |
| id: should-comment | |
| run: | | |
| if [[ $(wc -l < trivy.txt) -gt 1 ]]; then | |
| echo "\nTo see more details on these vulnerabilities, and how/where to fix them, please run `make scan-vulnerabilities` on your branch. If these were not introduced by your PR, please considering fixing them in `main` via a subsequent PR. Thanks!" >> trivy.txt | |
| exit 0; | |
| fi | |
| exit 1 | |
| - name: Comment on PR with Trivy scan results | |
| uses: mshick/add-pr-comment@v2 | |
| if: ${{ steps.should-comment.outcome == 'success' }} | |
| with: | |
| message-id: trivy-${{ github.event.number }} | |
| message-path: trivy.txt |