Skip to content

Develop #199

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Jul 20, 2024
Merged

Develop #199

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
71cc75c
[CONFIG] [Gihub Actions] Docker analisys with Trivy: new secondary "t…
Jul 20, 2024
8dd6016
[Security] [CONFIG] [Docker] FIX CVE-2024-5535 CVE-2024-4741
Jul 20, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 23 additions & 1 deletion .github/workflows/docker-image.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -157,7 +157,7 @@ jobs:
with:
sarif_file: 'snyk.sarif'
scan:
name: "Trivy"
name: "Trivy (sarif)"
runs-on: ubuntu-latest
needs: build
permissions:
Expand Down Expand Up @@ -187,3 +187,25 @@ jobs:
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: 'trivy-results.sarif'

report:
name: "Trivy (report)"
runs-on: ubuntu-latest
needs: build
steps:
- name: Download artifact
uses: actions/download-artifact@v4
with:
name: ${{ env.ARTIFACT_NAME }}_prod
path: /tmp/

- name: Load image
run: |
docker load --input /tmp/${{ env.ARTIFACT_NAME }}_prod.tar
docker image ls -a

- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@0.24.0
with:
image-ref: ${{ env.IMAGE_NAME }}:${{ github.sha }}
format: 'table'
4 changes: 4 additions & 0 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,8 @@ ENV WORKDIR=/app
WORKDIR ${WORKDIR}

RUN apk add --update --no-cache make
RUN apk upgrade --update --no-cache openssl libcrypto3 libssl3 # FIX CVE-2024-5535
RUN apk upgrade --update --no-cache --available # FIX CVE-2024-5535 CVE-2024-4741

###############################################################################
FROM base AS lint
Expand Down Expand Up @@ -92,6 +94,8 @@ CMD ["make", "test"]
## WORKDIR and USER are maintained
##
FROM eclipse-temurin:22.0.1_8-jre-alpine AS production
RUN apk upgrade --update --no-cache openssl libcrypto3 libssl3 # FIX CVE-2024-5535
RUN apk upgrade --update --no-cache --available # FIX CVE-2024-5535 CVE-2024-4741

ENV LOG_LEVEL=INFO
ENV BRUTEFORCE=false
Expand Down