Skip to content

Commit a79ab71

Browse files
justin-taharajustin-tahara
authored
feat(infra): Adding rety to Trivy tests (#5383)
1 parent d1f7cee commit a79ab71

4 files changed

+72
-35
lines changed

‎.github/workflows/docker-build-push-backend-container-on-tag.yml‎

Lines changed: 21 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -142,15 +142,26 @@ jobs:
142142
# can re-enable when they figure it out
143143
# https://github.com/aquasecurity/trivy/discussions/7538
144144
# https://github.com/aquasecurity/trivy-action/issues/389
145+
# Security: Using pinned digest (0.65.0@sha256:a22415a38938a56c379387a8163fcb0ce38b10ace73e593475d3658d578b2436)
146+
# Security: No Docker socket mount needed for remote registry scanning
145147
- name: Run Trivy vulnerability scanner
146-
uses: aquasecurity/trivy-action@master
147-
env:
148-
TRIVY_DB_REPOSITORY: "public.ecr.aws/aquasecurity/trivy-db:2"
149-
TRIVY_JAVA_DB_REPOSITORY: "public.ecr.aws/aquasecurity/trivy-java-db:1"
150-
TRIVY_USERNAME: ${{ secrets.DOCKER_USERNAME }}
151-
TRIVY_PASSWORD: ${{ secrets.DOCKER_TOKEN }}
148+
uses: nick-fields/retry@v3
152149
with:
153-
# To run locally: trivy image --severity HIGH,CRITICAL onyxdotapp/onyx-backend
154-
image-ref: docker.io/${{ env.REGISTRY_IMAGE }}:${{ github.ref_name }}
155-
severity: "CRITICAL,HIGH"
156-
trivyignores: ./backend/.trivyignore
150+
timeout_minutes: 30
151+
max_attempts: 3
152+
retry_wait_seconds: 10
153+
command: |
154+
docker run --rm -v $HOME/.cache/trivy:/root/.cache/trivy \
155+
-v ${{ github.workspace }}/backend/.trivyignore:/tmp/.trivyignore:ro \
156+
-e TRIVY_DB_REPOSITORY="public.ecr.aws/aquasecurity/trivy-db:2" \
157+
-e TRIVY_JAVA_DB_REPOSITORY="public.ecr.aws/aquasecurity/trivy-java-db:1" \
158+
-e TRIVY_USERNAME="${{ secrets.DOCKER_USERNAME }}" \
159+
-e TRIVY_PASSWORD="${{ secrets.DOCKER_TOKEN }}" \
160+
aquasec/trivy@sha256:a22415a38938a56c379387a8163fcb0ce38b10ace73e593475d3658d578b2436 \
161+
image \
162+
--skip-version-check \
163+
--timeout 20m \
164+
--severity CRITICAL,HIGH \
165+
--ignorefile /tmp/.trivyignore \
166+
--exit-code 1 \
167+
docker.io/${{ env.REGISTRY_IMAGE }}:${{ github.ref_name }}

‎.github/workflows/docker-build-push-cloud-web-container-on-tag.yml‎

Lines changed: 17 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -139,12 +139,21 @@ jobs:
139139
# https://github.com/aquasecurity/trivy/discussions/7538
140140
# https://github.com/aquasecurity/trivy-action/issues/389
141141
- name: Run Trivy vulnerability scanner
142-
uses: aquasecurity/trivy-action@master
143-
env:
144-
TRIVY_DB_REPOSITORY: "public.ecr.aws/aquasecurity/trivy-db:2"
145-
TRIVY_JAVA_DB_REPOSITORY: "public.ecr.aws/aquasecurity/trivy-java-db:1"
146-
TRIVY_USERNAME: ${{ secrets.DOCKER_USERNAME }}
147-
TRIVY_PASSWORD: ${{ secrets.DOCKER_TOKEN }}
142+
uses: nick-fields/retry@v3
148143
with:
149-
image-ref: docker.io/${{ env.REGISTRY_IMAGE }}:${{ github.ref_name }}
150-
severity: "CRITICAL,HIGH"
144+
timeout_minutes: 30
145+
max_attempts: 3
146+
retry_wait_seconds: 10
147+
command: |
148+
docker run --rm -v $HOME/.cache/trivy:/root/.cache/trivy \
149+
-e TRIVY_DB_REPOSITORY="public.ecr.aws/aquasecurity/trivy-db:2" \
150+
-e TRIVY_JAVA_DB_REPOSITORY="public.ecr.aws/aquasecurity/trivy-java-db:1" \
151+
-e TRIVY_USERNAME="${{ secrets.DOCKER_USERNAME }}" \
152+
-e TRIVY_PASSWORD="${{ secrets.DOCKER_TOKEN }}" \
153+
aquasec/trivy@sha256:a22415a38938a56c379387a8163fcb0ce38b10ace73e593475d3658d578b2436 \
154+
image \
155+
--skip-version-check \
156+
--timeout 20m \
157+
--severity CRITICAL,HIGH \
158+
--exit-code 1 \
159+
docker.io/${{ env.REGISTRY_IMAGE }}:${{ github.ref_name }}

‎.github/workflows/docker-build-push-model-server-container-on-tag.yml‎

Lines changed: 17 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -164,13 +164,21 @@ jobs:
164164
fi
165165
166166
- name: Run Trivy vulnerability scanner
167-
uses: aquasecurity/trivy-action@master
168-
env:
169-
TRIVY_DB_REPOSITORY: "public.ecr.aws/aquasecurity/trivy-db:2"
170-
TRIVY_JAVA_DB_REPOSITORY: "public.ecr.aws/aquasecurity/trivy-java-db:1"
171-
TRIVY_USERNAME: ${{ secrets.DOCKER_USERNAME }}
172-
TRIVY_PASSWORD: ${{ secrets.DOCKER_TOKEN }}
167+
uses: nick-fields/retry@v3
173168
with:
174-
image-ref: docker.io/${{ env.REGISTRY_IMAGE }}:${{ github.ref_name }}
175-
severity: "CRITICAL,HIGH"
176-
timeout: "10m"
169+
timeout_minutes: 30
170+
max_attempts: 3
171+
retry_wait_seconds: 10
172+
command: |
173+
docker run --rm -v $HOME/.cache/trivy:/root/.cache/trivy \
174+
-e TRIVY_DB_REPOSITORY="public.ecr.aws/aquasecurity/trivy-db:2" \
175+
-e TRIVY_JAVA_DB_REPOSITORY="public.ecr.aws/aquasecurity/trivy-java-db:1" \
176+
-e TRIVY_USERNAME="${{ secrets.DOCKER_USERNAME }}" \
177+
-e TRIVY_PASSWORD="${{ secrets.DOCKER_TOKEN }}" \
178+
aquasec/trivy@sha256:a22415a38938a56c379387a8163fcb0ce38b10ace73e593475d3658d578b2436 \
179+
image \
180+
--skip-version-check \
181+
--timeout 20m \
182+
--severity CRITICAL,HIGH \
183+
--exit-code 1 \
184+
docker.io/${{ env.REGISTRY_IMAGE }}:${{ github.ref_name }}

‎.github/workflows/docker-build-push-web-container-on-tag.yml‎

Lines changed: 17 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -150,12 +150,21 @@ jobs:
150150
# https://github.com/aquasecurity/trivy/discussions/7538
151151
# https://github.com/aquasecurity/trivy-action/issues/389
152152
- name: Run Trivy vulnerability scanner
153-
uses: aquasecurity/trivy-action@master
154-
env:
155-
TRIVY_DB_REPOSITORY: "public.ecr.aws/aquasecurity/trivy-db:2"
156-
TRIVY_JAVA_DB_REPOSITORY: "public.ecr.aws/aquasecurity/trivy-java-db:1"
157-
TRIVY_USERNAME: ${{ secrets.DOCKER_USERNAME }}
158-
TRIVY_PASSWORD: ${{ secrets.DOCKER_TOKEN }}
153+
uses: nick-fields/retry@v3
159154
with:
160-
image-ref: docker.io/${{ env.REGISTRY_IMAGE }}:${{ github.ref_name }}
161-
severity: "CRITICAL,HIGH"
155+
timeout_minutes: 30
156+
max_attempts: 3
157+
retry_wait_seconds: 10
158+
command: |
159+
docker run --rm -v $HOME/.cache/trivy:/root/.cache/trivy \
160+
-e TRIVY_DB_REPOSITORY="public.ecr.aws/aquasecurity/trivy-db:2" \
161+
-e TRIVY_JAVA_DB_REPOSITORY="public.ecr.aws/aquasecurity/trivy-java-db:1" \
162+
-e TRIVY_USERNAME="${{ secrets.DOCKER_USERNAME }}" \
163+
-e TRIVY_PASSWORD="${{ secrets.DOCKER_TOKEN }}" \
164+
aquasec/trivy@sha256:a22415a38938a56c379387a8163fcb0ce38b10ace73e593475d3658d578b2436 \
165+
image \
166+
--skip-version-check \
167+
--timeout 20m \
168+
--severity CRITICAL,HIGH \
169+
--exit-code 1 \
170+
docker.io/${{ env.REGISTRY_IMAGE }}:${{ github.ref_name }}

0 commit comments

Comments
 (0)