multiarch trivy

.gitea/workflows/vulnscan.yaml

@@ -1,59 +1,52 @@
 ---
-  name: Vulnerability Scan
+name: Vulnerability Scan
 
-  on:
+on:
-    schedule:
+  schedule:
-      - cron: "0 14 * * *"
+    - cron: "0 14 * * *"
-    workflow_dispatch:
+  workflow_dispatch:
 
-  jobs:
+jobs:
-    scan:
+  scan:
-      name: Daily Vulnerability Scan
+    name: Daily Vulnerability Scan
-      runs-on: ubuntu-latest
+    runs-on: ubuntu-latest
-      container:
+    container:
-        image: catthehacker/ubuntu:act-latest
+      image: catthehacker/ubuntu:act-latest
 
-      steps:
+    steps:
-        - name: Pull docker image
+      - name: Pull docker image
-          run: docker pull docker.asperti.com/paspo/smtp-relay:latest
+        run: docker pull docker.asperti.com/paspo/smtp-relay:latest
 
-        - uses: actions/cache/restore@v4
+      - name: Setup trivy
-          with:
+        run: |
-            path: |
+          echo "Installing Trivy for arch: $(uname -m)"
-              /root/.cache/trivy
+          case $(uname -m) in
-            key: trivy-db
+            x86_64)
+              wget -O /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.58.2/trivy_0.58.2_Linux-64bit.deb ;;
+            aarch64)
+              wget -O /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.58.2/trivy_0.58.2_Linux-ARM64.deb ;;
+            *) exit 1 ;;
+          esac
+          dpkg -i /tmp/trivy.deb
 
-        - name: Setup trivy
+      - name: Run Trivy vulnerability scanner
-          run: |
+        id: scan
-            wget -O /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.57.1/trivy_0.57.1_Linux-64bit.deb
+        run: |
-            dpkg -i /tmp/trivy.deb
+          trivy --server ${{ secrets.TRIVY_SERVER }} --token ${{ secrets.TRIVY_TOKEN }} image --format json docker.asperti.com/paspo/smtp-relay:latest > trivy-results.json
 
-        - name: Run Trivy vulnerability scanner
+      # if some vulnerability is found, we fail
-          id: scan
+      - name: check output
-          run: |
+        id: vulncount
-            trivy image --format json docker.asperti.com/paspo/smtp-relay:latest > trivy-results.json
+        run: |
-  
+          echo "VULNCOUNT=$(jq '.Results[0].Vulnerabilities|length' trivy-results.json)" >> ${GITHUB_OUTPUT}
-        - uses: actions/cache/save@v4
+          if [ $(jq '.Results[0].Vulnerabilities|length' trivy-results.json) -ne "0" ] ; then exit 1 ; fi
-          if: always()  # salva in cache anche se trova vulnerabilità
-          with:
-            path: |
-              /root/.cache/trivy
-            key: trivy-db
-  
-        # if some vulnerability is found, we fail
-        - name: check output
-          id: vulncount
-          run: |
-            echo "VULNCOUNT=$(jq '.Results[0].Vulnerabilities|length' trivy-results.json)" >> ${GITHUB_OUTPUT}
-            if [ $(jq '.Results[0].Vulnerabilities|length' trivy-results.json) -ne "0" ] ; then exit 1 ; fi
-  
-        - name: send telegram notification
-          if: failure()
-          uses: appleboy/telegram-action@master
-          with:
-            to: ${{ secrets.TELEGRAM_TO }}
-            token: ${{ secrets.TELEGRAM_TOKEN }}
-            format: markdown
-            message: |
-              Found **${{ steps.vulncount.outputs.VULNCOUNT }}** vulnerabilities in `${{ github.repository }}`
 
+      - name: send telegram notification
+        if: failure()
+        uses: appleboy/telegram-action@master
+        with:
+          to: ${{ secrets.TELEGRAM_TO }}
+          token: ${{ secrets.TELEGRAM_TOKEN }}
+          format: markdown
+          message: |
+            Found **${{ steps.vulncount.outputs.VULNCOUNT }}** vulnerabilities in `${{ github.repository }}`