22d2755f77
feature(config): add terraform variable files ( #285 )
...
* Action now takes an input for terraform variable filess
* added tf-vars
* updated README.md
* Updated yamlconfig test to latest version of trivy output for that container
* updated for correct cpu type
* test trivy version change to 0.45.0
* run scan with correct parameters
* Added test for terraform tfvars
* Updated output for other tests
* use test data as path and updated tf vars to be relative
* removed quiet
2023-12-04 16:27:47 -07:00
2b6a709cf9
Add filesystem alias ( #269 )
2023-11-06 18:35:42 -07:00
47e481a388
Update to trivy version 0.47.0 in Dockerfile ( #280 )
...
See:
- https://github.com/aquasecurity/trivy/releases/tag/v0.47.0
2023-11-06 18:35:08 -07:00
7b07fa7d6a
fix: set return code after each Trivy call ( #247 )
...
This change moves the return code to outside the trivy call. This fixes
#228 as the return code was not being propagated.
2023-11-06 18:32:48 -07:00
f78e9ecf42
Update Dockerfile to 0.46.1 ( #277 )
...
This update fixes https://github.com/aquasecurity/trivy/issues/5441
2023-10-30 18:28:16 -06:00
b77b85c025
Update Dockerfile to 0.46.0 ( #274 )
...
* Update Dockerfile to 0.46.0
This will address bugs before 0.46.0
* updating tests
2023-10-25 11:39:02 -06:00
69cbbc0cbb
fix: mark image-ref attribute optional ( #261 )
2023-09-14 22:32:56 -06:00
fbd16365eb
feat(trivy): Bump to v0.45.0 ( #256 )
2023-09-01 11:44:50 -06:00
559eb1224e
Merge pull request #234 from jdsmithit/patch-1
...
Update README.md to change the example to the new default brach name …
2023-08-07 12:32:05 +01:00
e602665a11
ci: add workflow to bump trivy ( #245 )
...
* ci: add workflow to bump trivy
* update trivy version in tests
* dispatch event workflow_dispatch
* use ORG_REPO_TOKEN secret
2023-07-25 15:58:10 -06:00
3dd517d8c9
chore(deps): Update trivy to v0.43.1 ( #243 )
...
* chore(deps): Update trivy to v0.43.1
* fix tests
Signed-off-by: Simar <simar@linux.com >
---------
Signed-off-by: Simar <simar@linux.com >
2023-07-17 11:07:42 +03:00
41f05d9ecf
Revert "Include args when using trivy config file ( #231 )"
...
Fixes: https://github.com/aquasecurity/trivy-action/issues/238
This reverts commit 82ec0dd604
2023-06-09 16:37:19 -06:00
0cd397afbf
bump trivy to v0.42.1 ( #240 )
...
* bump trivy to v0.42.1
* revert formatting
2023-06-09 12:01:09 -06:00
b43daad0c3
feat: add exit-code parameter to sarif format ( #213 )
2023-06-05 11:19:20 -06:00
dedfa59531
Enhance GitHub Dependency Snapshot upload ( #233 )
2023-06-05 11:12:39 -06:00
f96f79aa22
bump trivy to v0.42.0 ( #237 )
...
* chore(deps): update trivy to v0.42.0
* revert formatting
* revert formatting again
* update sarif version in tests
2023-06-05 11:08:24 -06:00
82ec0dd604
Include args when using trivy config file ( #231 )
...
Previously, arguments provided using regular flags
were ignored if a trivy config file was provided
Note that this pull request makes no effort to
deduce or merge desired argument if the same
configuration with different values are provided
both within the config file and as flags. Behaviour
for this case would develop on the implementation
of trivy
2023-05-31 14:47:20 -06:00
463f27e2d8
Update README.md to change the example to the new default brach name main from master.
...
Update README.md to change the example to the new default branch name "main" from "master".
I hope this will make the action slightly easier to work with for newer members of the community.
2023-05-12 10:45:16 +01:00
e5f43133f6
chore: Update Trivy to 0.40.0 ( #223 )
...
* chore: Update trivy to 0.39.0
* chore: Update trivy to 0.40.0
2023-04-18 17:44:36 -07:00
1a09192c0e
docs: improve SBOM documentation ( #208 )
...
* fix: dependency graph name ocurrences
* feat: improve readability and add useful links
* feat: improve readability and instructions
Improves readability and adds missing information about github_token, another authentication method.
* feat: add github_token instructions
* feat: add github_token to inputs table
* feat: add "what is an SBOM" link
* fix: GitHub dependency graph name ocurrence
* feat: improve SBOM input description
* fix: remove "on pull request" trigger
Co-authored-by: Duncan Casteleyn <10881109+DuncanCasteleyn@users.noreply.github.com >
* fix: outdated input name
---------
Co-authored-by: Duncan Casteleyn <10881109+DuncanCasteleyn@users.noreply.github.com >
2023-03-28 17:48:04 -07:00
1f0aa582c8
Rename security-checks to scanners ( #211 )
...
* Renaming securityChecks to runners
* Renaming securityChecks to runners
* Renaming securityChecks to runners
* Correcting README
2023-03-06 21:00:01 -08:00
43849adf01
bump trivy to v0.38.1 ( #215 )
2023-03-06 20:58:30 -08:00
8bd2f9fbda
⬆️ bump trivy action ( #203 )
2023-02-10 16:20:50 +09:00
cff3e9a7f6
feat(trivy): Bump Trivy to v0.37.1 ( #199 )
...
Signed-off-by: Simar <simar@linux.com >
2023-02-01 16:40:29 -08:00
ab15891596
Update README.md ( #186 )
...
Fix typo
2023-02-01 16:23:59 -08:00
cacfd7a243
docs: add trivy-config to table ( #195 )
2023-02-01 16:19:16 -08:00
1e0bef4613
fix(sarif): Add option to limit severities for sarif (aquasecurity#192) ( #198 )
2023-02-01 16:18:31 -08:00
9ab158e859
Add 0.34.0 release ( #177 )
...
* bump to ghcr.io/aquasecurity/trivy:0.33.0
* fix tests
* bump to 0.34.0
2022-10-31 17:18:27 -07:00
e55de85bee
Add npm to action Dockerfile ( #176 )
2022-10-25 07:04:22 -07:00
d63413b0a4
Fix github dependency submission API call ( #162 )
...
* Update entrypoint.sh
* Update entrypoint.sh
* Update entrypoint.sh
2022-08-17 14:54:57 -07:00
1db49f5326
feat(trivy): Bump Trivy to v0.31.0 ( #165 )
...
Fixes: https://github.com/aquasecurity/trivy-action/issues/164
Signed-off-by: Simar <simar@linux.com >
Signed-off-by: Simar <simar@linux.com >
2022-08-16 17:25:38 -07:00
12814ff8bc
docs: correct format and add output on config scan with sarif ( #159 )
2022-08-15 11:09:42 -07:00
cb606dfdb0
fix(sarif): Add timeout and security-checks for sarif ( #156 )
2022-08-03 17:32:25 -07:00
0d7cf2ddfb
chore: improve message output sbom with gh ( #145 )
...
* fix: merge with master- entrypoint
* chore: gitignore .vscode
Co-authored-by: carolina valencia <krol3@users.noreply.github.com >
2022-08-02 15:24:58 -07:00
5144f05a8d
fix(config): Drop mixing of options with yaml config. ( #148 )
...
Also adds some documentation explaining how the config
and flags are used in conjunction with each other.
Fixes: https://github.com/aquasecurity/trivy-action/issues/147
Signed-off-by: Simar <simar@linux.com >
2022-07-29 14:30:07 -07:00
81b9a6f5ab
Update Dockerfile ( #152 )
2022-07-26 13:08:58 -07:00
503d3abc15
feat(yaml): Add support for trivy.yaml ( #143 )
...
* feat(yaml): Add support for trivy.yaml
Signed-off-by: Simar <simar@linux.com >
* chore: fixing test using trivy v 0.30.0
* chore(deps): Update to use Trivy v0.30.2
Signed-off-by: Simar <simar@linux.com >
Co-authored-by: carolina valencia <krol3@users.noreply.github.com >
2022-07-21 16:36:46 -07:00
0105373003
docs(trivy): Add instructions to scan tarballs. ( #134 )
...
Signed-off-by: Simar <simar@linux.com >
2022-06-29 14:34:09 -07:00
bc615ae2d7
fix(tests): Update test golden files for Trivy v0.29.2 ( #136 )
...
Fixes: https://github.com/aquasecurity/trivy-action/issues/133
Fixes: https://github.com/aquasecurity/trivy-action/issues/135
Signed-off-by: Simar <simar@linux.com >
2022-06-29 14:33:23 -07:00
7b7aa264d8
feat(SBOM): Support SBOM generation ( #129 )
...
* feat(sbom): Support SBOM generation
Signed-off-by: Simar <simar@linux.com >
* Update README.md
Co-authored-by: Itay Shakury <itay@itaysk.com >
* feat(sbom): Send results within the entrypoint.sh
* fix(sbom): Fix leading whitespaces for format var.
Signed-off-by: Simar <simar@linux.com >
* docs(sbom): Update README.md
* docs(sbom): Update README.md
* chore(trivy): Bump Trivy version to 0.29.1
Signed-off-by: Simar <simar@linux.com >
* feat(sbom): Change to fs scan.
Signed-off-by: Simar <simar@linux.com >
* fix(tests): Update SARIF goldenfile
Co-authored-by: Itay Shakury <itay@itaysk.com >
2022-06-22 11:24:39 -07:00
63b6e4c61b
docs: added missing HTML template and removed deprecated SARIF template ( #132 )
...
* docs: add missing template
* docs: add missing template and remove deprecated
Add missing HTML template
Remove deprecated SARIF template
* docs: remove deprecated SARIF template
2022-06-21 11:46:57 -07:00
49e970d7ac
chore: pinning 0.29.0 trivy ( #128 )
...
Co-authored-by: carolina valencia <krol3@users.noreply.github.com >
2022-06-17 13:27:39 -07:00
c666240787
Add missing option to README. ( #127 )
2022-06-16 08:25:13 -07:00
e27605859b
feat: update codeql-action/upload-sarif to v2 ( #124 )
2022-06-15 09:16:34 -07:00
2b22459068
Update tests for 0.28.1 and convert to JSON ( #126 )
...
* Fix bug with test for securityChecks option which caused it to be skipped.
* Convert tests to JSON output only, and update them for Trivy 0.28.1.
* Update CI test to use Trivy 0.28.1.
2022-06-15 08:23:38 -07:00
4b3b5f928b
Add support for --ignorefile option (.trivyignore) ( #122 )
...
* Add support for supplying one or more .trivyignore files.
* Fix gitignore for test data.
* Add test for trivyignores option.
* Be explicit about the trivy options we use during testing.
* Add documentation of trivyignores option.
2022-06-14 07:41:49 -07:00
1a53202fc4
Use AWS public ECR instead of rate-limiting dockerhub ( #118 )
2022-06-08 11:17:38 -07:00
df3fb7d00b
Update Trivy Version in Dockerfile ( #117 )
...
Updated the dockerfile to use the latest release of Trivy.
2022-06-02 14:53:00 -07:00
987beb8186
Enable security checks option for image type ( #112 )
...
* Enable security checks option for image type
* Readme: update security checks option
* action.yaml: add default value for security checks option
* echo env var
* action.yaml: remove default value for security checks
* remove useless echo
2022-06-02 14:52:06 -07:00
4b9b6fb4ef
chore: update test to version 0.27.1 ( #106 )
...
* chore: update test to version 0.27.0
* chore: add test file secret and update to 0.27.1
* fix: support repository with securityCheck secret
Co-authored-by: carolina valencia <krol3@users.noreply.github.com >
2022-05-09 13:12:55 -07:00
Kyle Davies
Victor Sollerhed
Liam MacPherson
Witold Ślęczkowski
Brandon Helms
Pavel Kutáč
simar7
Anais Urlichs
Nikita Pivkin
Simar
Daniel Chabr
Roger Coll
abriko
Herman Wika Horn
John Smith
Bruce Bujon
Guilherme Marz Vazzolla
Viktor Sadovnikov
DmitriyLewen
Falk Puschner
Michael Cantú
Omar Silva
AndreyLevchenko
Aibek
Lior Vaisman Argon
chejn
Engin Diri
Carol Valencia
nleconte-csgroup
Achton Smidt Winther
David Calvert
Tanguy Segarra
James Luther