Skip to content

Commit 1b6aa75

Browse files
author
Blaize Kaye
committed
Adds trivy image
1 parent b656b87 commit 1b6aa75

File tree

3 files changed

+161
-0
lines changed

3 files changed

+161
-0
lines changed

‎.github/workflows/insights-trivy-image.yaml‎

Lines changed: 142 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,142 @@
1+
name: Publish insights-trivy image
2+
3+
on:
4+
schedule:
5+
- cron: "1 0 * * *"
6+
push:
7+
branches:
8+
- 'main'
9+
- 'build-image'
10+
paths:
11+
- 'insights-trivy/**'
12+
- '.github/workflows/insights-trivy-image.yaml'
13+
tags:
14+
- 'insights-trivy-v*.*.*'
15+
pull_request:
16+
branches:
17+
- 'main'
18+
paths:
19+
- 'insights-trivy/**'
20+
- '.github/workflows/insights-trivy-image.yaml'
21+
22+
jobs:
23+
docker:
24+
permissions:
25+
attestations: write
26+
contents: write
27+
id-token: write
28+
packages: write
29+
runs-on: ubuntu-latest
30+
steps:
31+
-
32+
name: Checkout PR
33+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
34+
if: ${{ github.event_name == 'pull_request' }}
35+
with:
36+
fetch-depth: "0"
37+
ref: ${{ github.event.pull_request.head.sha }}
38+
-
39+
name: Checkout Branch or Tag
40+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
41+
if: ${{ github.event_name != 'pull_request' }}
42+
with:
43+
fetch-depth: "0"
44+
-
45+
name: Create SERVICE_TAG variable
46+
id: service_tag_var
47+
run: |
48+
RAW_TAG=$(git describe --abbrev=0 --tags --match 'insights-trivy-*')
49+
SERVICE_TAG=${RAW_TAG#"insights-trivy-"}
50+
echo "using insights-trivy tag $SERVICE_TAG"
51+
echo "SERVICE_TAG=$SERVICE_TAG" >> "$GITHUB_ENV"
52+
-
53+
name: Set version for non-tag build
54+
if: "!startsWith(github.ref, 'refs/tags/insights-trivy')"
55+
id: version_non-tag_build
56+
run: |
57+
DOCKER_TAG="${{ env.SERVICE_TAG }}-$(git rev-parse --short=8 HEAD)"
58+
echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
59+
echo "insights-trivy version $DOCKER_TAG"
60+
-
61+
name: Set version for tag build
62+
if: "startsWith(github.ref, 'refs/tags/insights-trivy')"
63+
id: version_tag_build
64+
run: |
65+
DOCKER_TAG=${{ env.SERVICE_TAG }}
66+
echo "DOCKER_TAG=$DOCKER_TAG" >> "$GITHUB_ENV"
67+
echo "insights-trivy version $DOCKER_TAG"
68+
-
69+
name: Docker meta
70+
id: meta
71+
uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # v5.7.0
72+
with:
73+
# list of Docker images to use as base name for tags
74+
images: |
75+
${{ github.repository_owner }}/insights-trivy
76+
ghcr.io/${{ github.repository_owner }}/insights-trivy
77+
tags: |
78+
# set edge tag for default branch
79+
type=edge,enable={{is_default_branch}}
80+
# set tag+build for default branch
81+
type=raw,value=${{ env.DOCKER_TAG}},enable={{is_default_branch}}
82+
# tag event
83+
type=raw,value=${{ env.DOCKER_TAG}},enable=${{ startsWith(github.ref, 'refs/tags/insights-trivy') }}
84+
type=raw,value=latest,enable=${{ startsWith(github.ref, 'refs/tags/insights-trivy') }}
85+
# pull request event
86+
type=ref,event=pr
87+
# pull request event
88+
type=ref,event=branch
89+
-
90+
name: Set up QEMU
91+
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
92+
-
93+
name: Set up Docker Buildx
94+
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
95+
-
96+
name: Login to DockerHub
97+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
98+
with:
99+
username: ${{ secrets.DOCKERHUB_USERNAME }}
100+
password: ${{ secrets.DOCKERHUB_TOKEN }}
101+
-
102+
name: Login to GHCR
103+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
104+
with:
105+
registry: ghcr.io
106+
username: ${{ github.repository_owner }}
107+
password: ${{ secrets.GITHUB_TOKEN }}
108+
-
109+
name: Build and push
110+
uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # v6.15.0
111+
id: build-and-push
112+
with:
113+
context: insights-trivy
114+
platforms: linux/amd64,linux/arm64
115+
push: true
116+
tags: ${{ steps.meta.outputs.tags }}
117+
labels: ${{ steps.meta.outputs.labels }}
118+
- name: Attest dockerhub image
119+
uses: actions/attest-build-provenance@c074443f1aee8d4aeeae555aebba3282517141b2 # v2.2.3
120+
with:
121+
subject-digest: ${{steps.build-and-push.outputs.digest}}
122+
subject-name: index.docker.io/${{ github.repository_owner }}/insights-trivy
123+
push-to-registry: true
124+
- name: Attest ghcr image
125+
uses: actions/attest-build-provenance@c074443f1aee8d4aeeae555aebba3282517141b2 # v2.2.3
126+
with:
127+
subject-digest: ${{steps.build-and-push.outputs.digest}}
128+
subject-name: ghcr.io/${{ github.repository_owner }}/insights-trivy
129+
push-to-registry: true
130+
- uses: anchore/sbom-action@f325610c9f50a54015d37c8d16cb3b0e2c8f4de0 # v0.18.0
131+
if: startsWith(github.ref, 'refs/tags/')
132+
with:
133+
image: ghcr.io/${{ github.repository_owner }}/insights-trivy@${{steps.build-and-push.outputs.digest}}
134+
output-file: sbom.spdx.json
135+
upload-artifact: false
136+
upload-release-assets: false
137+
- name: Release
138+
uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda # v2.2.1
139+
if: startsWith(github.ref, 'refs/tags/')
140+
with:
141+
files: |
142+
sbom.spdx.json

‎insights-trivy/Dockerfile‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
FROM aquasec/trivy:0.52.2
2+
3+
LABEL org.opencontainers.image.authors="The Lagoon Authors" maintainer="The Lagoon Authors"
4+
LABEL org.opencontainers.image.source="https://github.com/uselagoon/lagoon-service-images" repository="https://github.com/uselagoon/lagoon-service-images"
5+
6+
ENV LAGOON=insights-scanner
7+
8+
ENV TRIVY_CACHE_DIR=/
9+
10+
RUN trivy image --cache-dir . --download-db-only && \
11+
trivy image --cache-dir . --download-java-db-only

‎insights-trivy/README.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# Insights-Remote Trivy
2+
3+
This image simply extends the standard Trivy docker image to include the vulnerability databases,
4+
rather than downloading them every time it is invoked.
5+
6+
It results in a bigger image, but the way Insights scans work often require the _entire_ DB to be downloaded
7+
every time it is run (which is multiple times a build).
8+

0 commit comments

Comments
 (0)