Trivy DB #8319
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: Trivy DB | |
| on: | |
| schedule: | |
| - cron: "0 */6 * * *" | |
| workflow_dispatch: | |
| env: | |
| REPO_OWNER: ${{ github.repository_owner }} # used in 'make db-build' | |
| GH_USER: aqua-bot | |
| VERSION: 2 | |
| jobs: | |
| build: | |
| name: Build DB | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| # vuln-list dirs + language repositories use more than 31GB of storage | |
| - name: Maximize build space | |
| uses: AdityaGarg8/remove-unwanted-software@90e01b21170618765a73370fcc3abbd1684a7793 | |
| with: | |
| remove-android: 'true' | |
| remove-dotnet: 'true' | |
| remove-haskell: 'true' | |
| remove-codeql: 'true' | |
| remove-docker-images: 'true' | |
| remove-large-packages: 'true' | |
| remove-cached-tools: 'true' | |
| remove-swapfile: 'true' | |
| - name: Check out code into the Go module directory | |
| uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 | |
| - name: Set up Go | |
| uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0 | |
| with: | |
| go-version-file: go.mod | |
| - name: Install bbolt | |
| run: go install go.etcd.io/bbolt/cmd/[email protected] | |
| - name: Download vuln-list and advisories | |
| run: make db-fetch-langs db-fetch-vuln-list | |
| - name: Build the binary | |
| run: make build | |
| - name: Build database | |
| run: make db-build | |
| - name: Compact DB | |
| run: make db-compact | |
| - name: Compress assets | |
| run: make db-compress | |
| - name: Move DB | |
| run: mv assets/db.tar.gz . | |
| - name: Login to Docker Hub | |
| uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USER }} | |
| password: ${{ secrets.DOCKERHUB_TOKEN }} | |
| - name: Login to GitHub Packages Container registry | |
| uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ env.GH_USER }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Login to ECR | |
| uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0 | |
| with: | |
| registry: public.ecr.aws | |
| username: ${{ secrets.ECR_ACCESS_KEY_ID }} | |
| password: ${{ secrets.ECR_SECRET_ACCESS_KEY }} | |
| - name: Install oras | |
| run: | | |
| curl -LO https://github.com/oras-project/oras/releases/download/v1.2.0/oras_1.2.0_linux_amd64.tar.gz | |
| tar -xvf ./oras_1.2.0_linux_amd64.tar.gz | |
| - name: Upload assets to registries | |
| run: | | |
| lowercase_repo=$(echo "${{ github.repository }}" | tr '[:upper:]' '[:lower:]') | |
| echo "Starting artifact upload process..." | |
| # Define an array of registry base URLs and their corresponding repository names | |
| declare -A registries=( | |
| ["ghcr.io"]="${lowercase_repo}" | |
| ["public.ecr.aws"]="${lowercase_repo}" | |
| ["docker.io"]="${lowercase_repo}" | |
| ) | |
| # Special case for docker.io if the organization is 'aquasecurity' | |
| if [[ "${lowercase_repo}" == "aquasecurity/"* ]]; then | |
| registries["docker.io"]="aquasec/${lowercase_repo#aquasecurity/}" | |
| echo "Docker Hub repository adjusted for aquasecurity: ${registries["docker.io"]}" | |
| fi | |
| # Loop through each registry and push the artifact | |
| for registry in "${!registries[@]}"; do | |
| repo_name=${registries[$registry]} | |
| full_registry_url="${registry}/${repo_name}" | |
| echo "Processing registry: ${full_registry_url}" | |
| tags=(latest ${{ env.VERSION }}) | |
| for tag in "${tags[@]}"; do | |
| echo "Pushing artifact with tag: ${tag}" | |
| if ./oras push --artifact-type application/vnd.aquasec.trivy.config.v1+json \ | |
| "${full_registry_url}:${tag}" \ | |
| db.tar.gz:application/vnd.aquasec.trivy.db.layer.v1.tar+gzip; then | |
| echo "Successfully pushed to ${full_registry_url}:${tag}" | |
| else | |
| echo "Failed to push to ${full_registry_url}:${tag}" | |
| exit 1 | |
| fi | |
| done | |
| done | |
| echo "Artifact upload process completed." | |
| - name: Microsoft Teams Notification | |
| uses: Skitionek/notify-microsoft-teams@e7a2493ac87dad8aa7a62f079f295e54ff511d88 | |
| if: failure() | |
| with: | |
| webhook_url: ${{ secrets.TRIVY_MSTEAMS_WEBHOOK }} | |
| needs: ${{ toJson(needs) }} | |
| job: ${{ toJson(job) }} | |
| steps: ${{ toJson(steps) }} |