Integrate Trivy into workflows

.github/workflows/publish-release.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
     inputs:
       is_prerelease:
-        description: 'Create a pre-release (RC) version'
+        description: "Create a pre-release (RC) version"
         required: false
         type: boolean
         default: false
@@ -35,6 +35,22 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-ballerina-
 
+      - name: Generate SBOM
+        env:
+          packageUser: ${{ github.actor }}
+          packagePAT: ${{ secrets.GITHUB_TOKEN }}
+        run: ./gradlew cyclonedxBom
+
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@master
+        with:
+          scan-type: "sbom"
+          scan-ref: "build/sbom.json"
+          format: "table"
+          timeout: "10m0s"
+          exit-code: "1"
+          severity: "CRITICAL,HIGH"
+
       - name: Set version env variable
         run: |
           # Extract BASE_VERSION from gradle.properties (strip any suffix after '-')
@@ -45,18 +61,18 @@ jobs:
             # Pre release - determine the next RC number
             # Fetch all tags to check for existing RC tags
             git fetch --tags
-          
+
             # Find the highest RC number for this base version
             HIGHEST_RC=$(git tag -l "v${BASE_VERSION}-rc.*" | sed "s/v${BASE_VERSION}-rc.//" | sort -n | tail -1)
-          
+
             if [ -z "$HIGHEST_RC" ]; then
               # No RC tags found, start with rc1
               RC_NUMBER=1
             else
               # Increment the highest RC number
               RC_NUMBER=$((HIGHEST_RC + 1))
             fi
-          
+
             echo VERSION=${BASE_VERSION}-rc.${RC_NUMBER} >> $GITHUB_ENV
             echo PRE_RELEASE=true >> $GITHUB_ENV
           else
@@ -73,7 +89,7 @@ jobs:
           echo "Pre Release: ${PRE_RELEASE}"
           git config user.name ${{ secrets.BALLERINA_BOT_USERNAME }}
           git config user.email ${{ secrets.BALLERINA_BOT_EMAIL }}
-          
+
           # Check if release branch exists in origin
           if git ls-remote --heads origin release-${BASE_VERSION} | grep -q release-${BASE_VERSION}; then
             echo "Branch release-${BASE_VERSION} exists in origin, checking out..."

.github/workflows/trivy.yml

@@ -0,0 +1,38 @@
+name: Trivy
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "30 7 * * *"
+
+jobs:
+  ubuntu-build:
+    name: Build on Ubuntu
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up JDK 21
+        uses: actions/setup-java@v3
+        with:
+          distribution: "temurin"
+          java-version: 21.0.3
+
+      - name: Setup Gradle
+        uses: gradle/gradle-build-action@v2
+
+      - name: Generate SBOM
+        env:
+          packageUser: ${{ github.actor }}
+          packagePAT: ${{ secrets.GITHUB_TOKEN }}
+        run: ./gradlew cyclonedxBom
+
+      - name: Run Trivy vulnerability
+        uses: aquasecurity/trivy-action@master
+        with:
+          scan-type: "sbom"
+          scan-ref: "build/sbom.json"
+          format: "table"
+          timeout: "10m0s"
+          exit-code: "1"

build.gradle

@@ -20,6 +20,7 @@ plugins {
     id "com.github.johnrengelman.shadow" version "${shadowJarPluginVersion}"
     id "de.undercouch.download" version "${downloadPluginVersion}"
     id "net.researchgate.release" version "${releasePluginVersion}"
+    id "org.cyclonedx.bom" version "${cyclonedxBomPluginVersion}"
     id "java"
 }
 apply plugin: 'maven-publish'
@@ -404,6 +405,16 @@ release {
     }
 }
 
+// Configure CycloneDX SBOM generation
+cyclonedxBom {
+    includeConfigs = ["externalJarDeps"]
+    schemaVersion = "1.4"
+    destination = file("$buildDir")
+    outputName = "sbom"
+    outputFormat = "json"
+    includeBomSerialNumber = true
+}
+
 build.dependsOn test
 build.doNotTrackState("build needs to run every time")
 publishToMavenLocal.dependsOn build

gradle.properties

@@ -13,6 +13,7 @@ puppycrawlCheckstyleVersion=10.12.1
 releasePluginVersion=2.8.0
 shadowJarPluginVersion=8.1.1
 spotbugsPluginVersion=6.0.18
+cyclonedxBomPluginVersion=1.8.2
 testngVersion=7.7.0
 graphqlJavaVersion=21.5
 sqliteJdbcVersion=3.41.2.2