e7fbf034e4
Update dependencies in README ( #378 )
...
* chore: update dependencies in README
* chore: update the actions/checkout version in documentation
* chore: bump upload-sarif dependency from readme
* docs: bump actions/checkout to v4
Signed-off-by: Nikita Pivkin <nikita.pivkin@smartforce.io >
---------
Signed-off-by: Nikita Pivkin <nikita.pivkin@smartforce.io >
Co-authored-by: Nikita Pivkin <nikita.pivkin@smartforce.io >
2025-07-07 12:46:41 -06:00
dc5a429b52
chore(deps): Update trivy to v0.64.1 ( #474 )
...
Co-authored-by: nikpivkin <nikpivkin@users.noreply.github.com >
2025-07-04 00:18:35 -06:00
76071ef0d7
chore(deps): Update trivy to v0.63.0 ( #467 )
...
* chore(deps): Update trivy to v0.63.0
* update test data
---------
Co-authored-by: simar7 <simar7@users.noreply.github.com >
Co-authored-by: Simar <simar@linux.com >
2025-06-03 13:38:46 +06:00
4844d823d3
ci: fix workflow to bump Trivy ( #466 )
...
Signed-off-by: Nikita Pivkin <nikita.pivkin@smartforce.io >
2025-06-02 21:30:59 -06:00
26d71e622b
refactor: use ubuntu 24.04 ( #465 )
2025-05-16 11:37:50 +06:00
b3dafe507f
Bump Trivy version to fix GitHub actions ( #460 )
2025-05-12 14:16:37 -06:00
99baf0d8b4
Pin aquasecuriy/setup-trivy to hash instead of tag ( #456 )
...
* Pin aquasecuriy/setup-trivy to hash instead of tag
Fixes #423
* Address review comment
* Revisit previous change based on feedback
2025-04-08 20:50:36 -06:00
7aca5acc95
fix: Trivy action inputs leaking between invocations ( #422 ) ( #454 )
...
* fix: use trivy_envs.txt for envs
* test: add test step
* refactor
* refactor
* test
* refactor: use `export` in trivy_envs.txt
* test
* test metadata.json
* test metadata.json
* Clean up envs file better (#422 )
- Explicitly rm -f it at start and end of action
- Also remove temporary test steps from action
* Add BATS test for usage of trivy_envs.txt file (#422 )
* Add optional step triggered only when Actions Debug logging
Dump the generated environment variables file only when tests are run
with actions debug logging
* Fix to always set env vars into file (#422 )
This is done as long as they have a non-empty input value, or a
non-empty default value.
* Clean up env overwriting
- Remove unnecessary debug statements in the action used during testing
- Additional explanatory comments
- Fix to address case where caller explicitly injects environment
variables, either via env: block on the action call or via GITHUB_ENV
* Further refine env var setting logic (#422 )
Noted in documenting this fix that what had been implemented deviated
from the existing configuration priority documentation. Amended the
implementation of the Action to try and restore that consistency.
* Fix shell syntax error (#422 )
---------
Co-authored-by: DmitriyLewen <dmitriy.lewen@smartforce.io >
2025-04-04 23:59:10 -06:00
ea27ac12e1
docs: add info that unix:/ prefix is required ( #455 )
2025-04-01 21:44:53 -06:00
6c175e9c40
chore: bump trivy to v0.60.0 ( #453 )
...
Signed-off-by: Nikita Pivkin <nikita.pivkin@smartforce.io >
2025-03-13 20:58:00 -06:00
53e8848d3e
Improve README/SBOM ( #439 )
...
* Improve README/SBOM
* Use logical workflow name
* Use modern ubuntu version
* Update README.md
2025-03-12 16:11:45 -06:00
ef1b561207
fix: typo in description of an input for action.yaml ( #452 )
2025-03-12 16:11:20 -06:00
a11da62073
fix: Update default trivy version in README ( #444 )
...
As part of PR #434 the default trivy version got bumped
but the readme didn't reflect it.
2025-01-07 16:37:47 -07:00
18f2510ee3
chore(deps): Bump trivy to v0.57.1 ( #434 )
...
* chore(deps): Bump trivy to v0.57.1
* update tests
* use mirrors from mirror.gcr.io
* update workflow for tests
* Revert "use mirrors from mirror.gcr.io"
This reverts commit 529a941eed
2024-11-19 17:11:53 -07:00
93941cebba
docs: remove ignore-unfixed from IaC scan example ( #429 )
...
Signed-off-by: Nikita Pivkin <nikita.pivkin@smartforce.io >
2024-11-18 16:54:58 -07:00
d2a392a137
fix: bump setup-trivy and add new contrib directory path info ( #424 )
...
* chore(deps): use fork for setup-trivy
* docs: add info about templates
* refactor: use `setup-trivy` v0.2.2
* docs: remove `./` prefix
* Merge branch 'main' into 'fix/contrib-dir'
* docs: fix link
* docs: fix typo
Co-authored-by: simar7 <1254783+simar7@users.noreply.github.com >
---------
Co-authored-by: simar7 <1254783+simar7@users.noreply.github.com >
2024-10-25 00:45:28 -06:00
ee8934673c
feat: add token for setup-trivy ( #421 )
...
* feat: add `token-setup-trivy` input.
* docs: add info about `token-setup-trivy`
* fix: use correct commit
* refactor: use `default: ${{ github.token }}` for `token-setup-trivy`
* refactor: use `setup-trivy` v0.2.2
2024-10-24 23:32:23 -06:00
cf990b19d8
Update README.md ( #420 )
2024-10-21 22:43:57 -06:00
bff40be51b
docs: Fix oras command not found ( #413 )
2024-10-21 22:43:42 -06:00
fc1500abdc
feat: Allow skipping setup ( #414 )
...
If a user is invoking the action multiple times then the trivy binary
gets installed multiple times. Users can avoid this by managing the
installation themselves and setting the skip-setup input to true, or by
letting the action install in on their first invocation and then setting
skip-setup to true on subsequent invocations
Co-authored-by: simar7 <1254783+simar7@users.noreply.github.com >
2024-10-15 19:57:47 -06:00
915b19bbe7
chore(deps): bump setup-trivy to v0.2.1 ( #411 )
...
* chore(deps): bump setup-trivy
* chore(deps): bump setup-trivy
* chore(deps): bump setup-trivy to `v0.2.1`
2024-10-15 10:04:03 -06:00
5681af892c
fix: set envs only when passed ( #405 )
...
* fix: set envs when passed
Signed-off-by: knqyf263 <knqyf263@gmail.com >
* use inputs.<input_id>.default
Signed-off-by: knqyf263 <knqyf263@gmail.com >
* Revert "use inputs.<input_id>.default"
This reverts commit 1a12292eacknqyf263@gmail.com >
2024-10-10 22:48:38 -06:00
807896715e
chore: update description for scanners and format inputs ( #407 )
...
Signed-off-by: Nikita Pivkin <nikita.pivkin@smartforce.io >
2024-10-09 15:37:31 -06:00
0fa0cdb177
ci: use setup-trivy to install Trivy ( #406 )
2024-10-09 15:36:41 -06:00
a20de5420d
feat: store artifacts in cache by default ( #399 )
...
* feat: migrate to a composite action
Signed-off-by: knqyf263 <knqyf263@gmail.com >
* Fix tests
Signed-off-by: knqyf263 <knqyf263@gmail.com >
* Delete an unused input
Signed-off-by: knqyf263 <knqyf263@gmail.com >
* test: expect status code 0
Signed-off-by: knqyf263 <knqyf263@gmail.com >
* test: not use run
https://bats-core.readthedocs.io/en/stable/writing-tests.html#when-not-to-use-run
Signed-off-by: knqyf263 <knqyf263@gmail.com >
* feat: add 'cache' input
Signed-off-by: knqyf263 <knqyf263@gmail.com >
* docs: update README
Signed-off-by: knqyf263 <knqyf263@gmail.com >
* feat: pin Trivy version
Signed-off-by: knqyf263 <knqyf263@gmail.com >
* fix: bump trivy version
Signed-off-by: knqyf263 <knqyf263@gmail.com >
* feat: use date for cache key
Signed-off-by: knqyf263 <knqyf263@gmail.com >
* chore: delete a comment
Signed-off-by: knqyf263 <knqyf263@gmail.com >
* docs: update README
Signed-off-by: knqyf263 <knqyf263@gmail.com >
* refactor: resolve conflicts and use envs
Signed-off-by: knqyf263 <knqyf263@gmail.com >
---------
Signed-off-by: knqyf263 <knqyf263@gmail.com >
2024-10-08 14:20:38 -06:00
1b8b83dcc2
docs: add usage info about action/cache for trivy databases ( #397 )
...
* docs: add info about using `action/cache` for `trivy-db`
* docs: add info about trivy-java-db and trivy-checks
2024-10-07 22:05:39 -06:00
f781cce5aa
feat(trivy): Bump to support v0.56.1 ( #387 )
...
* feat(trivy): Bump to support v0.55.2
* fix tests
* update github workflow
* upgrade to v0.56.0
* bump to trivy v0.56.1
* update tests
2024-10-07 14:14:19 -06:00
54f21d8382
ci: sync trivy-checks version 1 ( #398 )
...
Signed-off-by: Nikita Pivkin <nikita.pivkin@smartforce.io >
2024-10-07 12:23:44 -06:00
89b14e517d
Upgrade GitHub actions ( #374 )
...
* Upgrade Github checkout action
* Upgrade Github upload-sarif action
* Upgrade Github checkout action - Pipeline
2024-10-02 14:41:43 -06:00
97646fedde
chore: use checks bundle snapshot from trivy-action ( #388 )
...
Signed-off-by: Nikita Pivkin <nikita.pivkin@smartforce.io >
2024-09-19 08:58:52 -06:00
d9cd5b1c23
fix(Makefile): recursive option typo ( #371 )
2024-07-09 10:07:51 -06:00
6e7b7d1fd3
Upgrade trivy to v0.53.0 ( #369 )
...
* Upgrade trivy to v0.53.0
* update tests
---------
Co-authored-by: Simar <simar@linux.com >
2024-07-09 00:19:25 -06:00
7c2007bcb5
Upgrade trivy to v0.52.2 ( #367 )
...
* Upgrade trivy to v0.52.2
* Upgrade trivy to v0.52.2
2024-06-17 16:53:33 -06:00
595be6a0f6
Upgrade trivy to v0.52.0 ( #364 )
2024-06-06 17:41:36 -06:00
841fb371db
chore(docs): Reference the use of a pinned version ( #356 )
2024-05-22 18:59:56 -06:00
fd25fed697
bump trivy version to v0.51.2 ( #360 )
...
* bump trivy version to v0.51.2
* bump trivy version to v0.51.2
2024-05-21 16:33:02 -06:00
b2933f565d
bump trivy version to v0.51.1 ( #353 )
...
* bump trivy version to v0.51.1
* update tests
2024-05-07 21:42:16 -06:00
b2cd5ff52c
Update bump-trivy.yaml
2024-05-07 18:03:36 -06:00
6f8c23760b
update tests ( #334 )
...
* update tests
* rename trivy images
* rename workflow steps
2024-05-06 23:18:53 -06:00
7088d18dcb
Revert "fix: 🐛 allow trivy-config and other options to be used together ( #338 )"
...
This reverts commit ee6a4f5af1
2024-04-26 01:13:05 -06:00
ee6a4f5af1
fix: 🐛 allow trivy-config and other options to be used together ( #338 )
2024-04-25 23:57:46 -06:00
b5f4977b78
Bump trivy version to v0.50.2 ( #341 )
...
Co-authored-by: pdefreitas <5927433+pdefreitas@users.noreply.github.com >
2024-04-22 22:07:09 -06:00
207cd40078
Fix docker host bug ( #329 )
...
* Update entrypoint.sh
should be a value not boolean
* Update action.yaml
add example
* Update README.md
2024-04-04 22:59:05 -06:00
840deb4908
Browse scan reports without GitHub Advanced Security license ( #328 )
2024-04-04 22:58:29 -06:00
0f287db5d3
feat(image): add --docker-host option for GH Action users ( #267 )
...
* add option to update docker-host via cli parameter
* chore: update test results
---------
Co-authored-by: simar7 <1254783+simar7@users.noreply.github.com >
2024-04-03 17:26:17 -06:00
f72b7e8127
Make 'hide-progress' input working again ( #323 )
...
* Make hide-progress input working again
* Unify 'hide-progress' default value
2024-03-28 19:06:30 -06:00
d710430a67
bump trivy version to v0.50.1 ( #324 )
2024-03-27 16:22:09 -06:00
062f259268
fix: Refer to scan-ref when scan-type is "sbom" ( #314 )
2024-02-22 14:28:04 -07:00
1f6384b6ce
docs(report): improve documentation around Using Trivy to generate SBOM and sending it to Github ( #307 )
...
* Improved documentation with details on how to send output as an artifact on Github and giving an example of a private image scan
* formatting
* better name for job
2024-02-13 15:20:36 -07:00
84384bd6e7
Upgraded Trivy from 0.48.1 to v0.49.0 ( #304 )
2024-02-05 18:54:03 -07:00
Akshay Iyyadurai Balasundaram
Aqua Security automated builds
Nikita Pivkin
simar7
Maxim Masiutin
Lari Hotari
Rob Vesse
DmitriyLewen
Alex B
Yuta Tokoi
Mario Apra
Daisuke Sato
Rob Vesse
Teppei Fukuda
Oussama Bounaim
chris
Vinayak S
Francisco Javier Barón
Simar
arairyus
Pedro Freitas
Lukas Gravley
uridium
Calin Marina
uridium
cococig
Maxime Durand
Kyle Davies