Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Issue #2496] cache trivy #2839

Merged
merged 9 commits into from
Nov 13, 2024
Merged

[Issue #2496] cache trivy #2839

Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
7682e01
cache trivy take 1
coilysiren Nov 13, 2024
db05817
linter stuff
coilysiren Nov 13, 2024
1393e8f
test trivy cache again
coilysiren Nov 13, 2024
2c9f3c2
sub cache on app name
coilysiren Nov 13, 2024
61de1b1
add run name
coilysiren Nov 13, 2024
e136428
move comment
coilysiren Nov 13, 2024
e9e04d9
quotes
coilysiren Nov 13, 2024
17d417d
Revert "sub cache on app name"
coilysiren Nov 13, 2024
e99bc37
Update vulnerability-scans.yml
coilysiren Nov 13, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 45 additions & 0 deletions .github/workflows/vulnerability-scans.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,6 +94,48 @@ jobs:
steps:
- uses: actions/checkout@v4

- name: Get current date
id: date
run: echo "date=$(date +'%Y-%m-%d')" >> "$GITHUB_OUTPUT"

- name: Restore cached trivy vulnerability and Java DBs
id: trivy-cache
uses: actions/cache/restore@v4
with:
path: ${{ github.workspace }}/.cache/trivy
key: trivy-cache-${{ steps.date.outputs.date }}

# Download and extract the vulnerability DB and Java DB
# This is based on the instructions here:
# https://github.com/aquasecurity/trivy-action/?tab=readme-ov-file#updating-caches-in-the-default-branch

- name: Setup oras
if: steps.trivy-cache.outputs.cache-hit != 'true'
uses: oras-project/setup-oras@v1

- name: Download and extract the vulnerability DB
if: steps.trivy-cache.outputs.cache-hit != 'true'
run: |
mkdir -p "$GITHUB_WORKSPACE/.cache/trivy/db"
oras pull ghcr.io/aquasecurity/trivy-db:2
tar -xzf db.tar.gz -C "$GITHUB_WORKSPACE/.cache/trivy/db"
rm db.tar.gz

- name: Download and extract the Java DB
if: steps.trivy-cache.outputs.cache-hit != 'true'
run: |
mkdir -p "$GITHUB_WORKSPACE/.cache/trivy/java-db"
oras pull ghcr.io/aquasecurity/trivy-java-db:1
tar -xzf javadb.tar.gz -C "$GITHUB_WORKSPACE/.cache/trivy/java-db"
rm javadb.tar.gz

- name: Cache DBs
if: steps.trivy-cache.outputs.cache-hit != 'true'
uses: actions/cache/save@v4
with:
path: ${{ github.workspace }}/.cache/trivy
key: trivy-cache-${{ steps.date.outputs.date }}

- name: Restore cached Docker image
uses: actions/cache/restore@v4
with:
Expand All @@ -116,6 +158,9 @@ jobs:
ignore-unfixed: true
vuln-type: os
scanners: vuln,secret
env:
TRIVY_SKIP_DB_UPDATE: true
TRIVY_SKIP_JAVA_DB_UPDATE: true

- name: Save output to workflow summary
if: always() # Runs even if there is a failure
Expand Down