trivy.yaml

# https://aquasecurity.github.io/trivy
name: Trivy

on:
  pull_request:
  push:
    branches:
      - main

env:
  # Use the Go toolchain installed by setup-go
  # https://github.com/actions/setup-go/issues/457
  GOTOOLCHAIN: local

  # Manage the Trivy data directory until upstream can do it reliably
  # https://github.com/aquasecurity/trivy-action/issues/389
  #
  # NOTE: This must match the default "cache-dir" upstream:
  # https://github.com/aquasecurity/trivy-action/blob/-/action.yaml
  TRIVY_CACHE_DIR: ${{ github.workspace }}/.cache/trivy

jobs:
  cache:
    runs-on: ubuntu-latest
    steps:
      - uses: aquasecurity/setup-trivy@v0.2.2
        with:
          cache: true
          version: v0.57.0

      # The "aquasecurity/trivy-action" looks for data in the GitHub action
      # cache under a key with today's date.
      # - https://github.com/actions/cache/blob/-/restore#readme
      # - https://github.com/aquasecurity/trivy-action/blob/-/action.yaml
      - id: values
        run: |
          (
            date +'date=%Y-%m-%d'
            echo "glob=${TRIVY_CACHE_DIR}/*/metadata.json"
          ) |
          tee --append $GITHUB_OUTPUT
      - id: restore
        uses: actions/cache/restore@v4
        with:
          key: cache-trivy-${{ steps.values.outputs.date }}
          path: ${{ env.TRIVY_CACHE_DIR }}
          restore-keys: cache-trivy-

      # Validate or update the Trivy data cache.
      - id: validate
        env:
          METADATA_HASH: ${{ hashFiles(steps.values.outputs.glob) }}
        run: |
          <<< "before=${METADATA_HASH}" tee --append $GITHUB_OUTPUT
          trivy filesystem --download-db-only --scanners license,secret,vuln --quiet

      # Save any successful changes back to the GitHub action cache.
      # - https://github.com/actions/cache/blob/-/save#readme
      - if: ${{ hashFiles(steps.values.outputs.glob) != steps.validate.outputs.before }}
        uses: actions/cache/save@v4
        with:
          key: ${{ steps.restore.outputs.cache-primary-key }}
          path: ${{ env.TRIVY_CACHE_DIR }}

  licenses:
    needs: [cache]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # Trivy needs a populated Go module cache to detect Go module licenses.
      - uses: actions/setup-go@v5
        with: { go-version: stable }
      - run: go mod download

      # Report success only when detected licenses are listed in [/trivy.yaml].
      - name: Scan licenses
        uses: aquasecurity/trivy-action@0.28.0
        env:
          TRIVY_DEBUG: true
        with:
          scan-type: filesystem
          scanners: license
          exit-code: 1

  vulnerabilities:
    if: ${{ github.repository == 'CrunchyData/postgres-operator' }}
    permissions:
      security-events: write

    needs: [cache]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # Print any detected secrets or vulnerabilities to the workflow log for
      # human consumption. This step fails only when Trivy is unable to scan.
      # A later step uploads results to GitHub as a pull request check.
      - name: Log detected vulnerabilities
        uses: aquasecurity/trivy-action@0.28.0
        with:
          scan-type: filesystem
          scanners: secret,vuln

      # Produce a SARIF report of actionable results. This step fails only when
      # Trivy is unable to scan.
      - name: Report actionable vulnerabilities
        uses: aquasecurity/trivy-action@0.28.0
        with:
          scan-type: filesystem
          ignore-unfixed: true
          format: 'sarif'
          output: 'trivy-results.sarif'
          scanners: secret,vuln

      # Submit the SARIF report to GitHub code scanning. Pull requests checks
      # succeed or fail according to branch protection rules.
      # - https://docs.github.com/en/code-security/code-scanning
      - name: Upload results to GitHub
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'