paspo/docker-smtp-relay
1
0
Fork 0
Code Issues Pull Requests Actions Packages Releases Activity

multiarch trivy
All checks were successful
continuous-integration/drone/push Build is passing
Details
continuous-integration/drone/tag Build is passing
Details
Vulnerability Scan / Daily Vulnerability Scan (push) Successful in 15s
Details

Browse Source
This commit is contained in:
Paolo Asperti 2025-01-17 08:07:03 +01:00
parent a22cadeb8d
commit f5d3ed6cbb
Signed by: paspo
GPG Key ID: 06D46905D19D5182
1 changed files with 51 additions and 58 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

109
.gitea/workflows/vulnscan.yaml
View File

@ -1,59 +1,52 @@
--- ---
name: Vulnerability Scan name: Vulnerability Scan
on: on:
schedule: schedule:
- cron: "0 14 * * *" - cron: "0 14 * * *"
workflow_dispatch: workflow_dispatch:
jobs: jobs:
scan: scan:
name: Daily Vulnerability Scan name: Daily Vulnerability Scan
runs-on: ubuntu-latest runs-on: ubuntu-latest
container: container:
image: catthehacker/ubuntu:act-latest image: catthehacker/ubuntu:act-latest
steps: steps:
- name: Pull docker image - name: Pull docker image
run: docker pull docker.asperti.com/paspo/smtp-relay:latest run: docker pull docker.asperti.com/paspo/smtp-relay:latest
- uses: actions/cache/restore@v4 - name: Setup trivy
with: run: |
path: | echo "Installing Trivy for arch: $(uname -m)"
/root/.cache/trivy case $(uname -m) in
key: trivy-db x86_64)
wget -O /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.58.2/trivy_0.58.2_Linux-64bit.deb ;;
- name: Setup trivy aarch64)
run: | wget -O /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.58.2/trivy_0.58.2_Linux-ARM64.deb ;;
wget -O /tmp/trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.57.1/trivy_0.57.1_Linux-64bit.deb *) exit 1 ;;
dpkg -i /tmp/trivy.deb esac
dpkg -i /tmp/trivy.deb
- name: Run Trivy vulnerability scanner
id: scan - name: Run Trivy vulnerability scanner
run: | id: scan
trivy image --format json docker.asperti.com/paspo/smtp-relay:latest > trivy-results.json run: |
trivy --server ${{ secrets.TRIVY_SERVER }} --token ${{ secrets.TRIVY_TOKEN }} image --format json docker.asperti.com/paspo/smtp-relay:latest > trivy-results.json
- uses: actions/cache/save@v4
if: always() # salva in cache anche se trova vulnerabilità # if some vulnerability is found, we fail
with: - name: check output
path: | id: vulncount
/root/.cache/trivy run: |
key: trivy-db echo "VULNCOUNT=$(jq '.Results[0].Vulnerabilities|length' trivy-results.json)" >> ${GITHUB_OUTPUT}
if [ $(jq '.Results[0].Vulnerabilities|length' trivy-results.json) -ne "0" ] ; then exit 1 ; fi
# if some vulnerability is found, we fail
- name: check output - name: send telegram notification
id: vulncount if: failure()
run: | uses: appleboy/telegram-action@master
echo "VULNCOUNT=$(jq '.Results[0].Vulnerabilities|length' trivy-results.json)" >> ${GITHUB_OUTPUT} with:
if [ $(jq '.Results[0].Vulnerabilities|length' trivy-results.json) -ne "0" ] ; then exit 1 ; fi to: ${{ secrets.TELEGRAM_TO }}
token: ${{ secrets.TELEGRAM_TOKEN }}
- name: send telegram notification format: markdown
if: failure() message: |
uses: appleboy/telegram-action@master Found **${{ steps.vulncount.outputs.VULNCOUNT }}** vulnerabilities in `${{ github.repository }}`
with:
to: ${{ secrets.TELEGRAM_TO }}
token: ${{ secrets.TELEGRAM_TOKEN }}
format: markdown
message: |
Found **${{ steps.vulncount.outputs.VULNCOUNT }}** vulnerabilities in `${{ github.repository }}`