libre.sh/keycloak-scim
4
0
Fork 0
Code Issues 15 Pull requests Releases 1 Activity Actions

Automatic scan Keycloak docker image for vulnerabilities (#10777)

Browse source 
* Automatic scan Keycloak docker image for vulnerabilities

The changes proposed here will run Trivy scanner twice a day to search
vulnerabilities into our main images.

Resolves #10764

Co-authored-by: Václav Muzikář <vaclav@muzikari.cz>

* Update .github/workflows/trivy-analysis.yml

Co-authored-by: Václav Muzikář <vaclav@muzikari.cz>
Co-authored-by: Stian Thorgersen <stian@redhat.com>
This commit is contained in:
Bruno Oliveira da Silva 2022-03-29 11:17:20 -03:00 committed by GitHub
parent e58e8ef252
commit 19e55650a2
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 64 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

64
.github/workflows/trivy-analysis.yml vendored Normal file
View file

@ -0,0 +1,64 @@
name: Trivy
on:
workflow_dispatch:
# Run the job twice a day
schedule:
- cron: "0 0 * * *"
jobs:
quarkus-dist:
name: Vulnerability scanner for Quarkus distribution images
runs-on: "ubuntu-18.04"
steps:
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@296212627a1e693efa09c00adc3e03b2ba8edf18
with:
image-ref: 'quay.io/keycloak/keycloak:nightly'
format: 'template'
template: '@/contrib/sarif.tpl'
output: 'trivy-results.sarif'
severity: 'MEDIUM,CRITICAL,HIGH'
ignore-unfixed: true
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v1
with:
sarif_file: 'trivy-results.sarif'
legacy-dist:
name: Vulnerability scanner for WildFly distribution images
runs-on: "ubuntu-18.04"
steps:
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@296212627a1e693efa09c00adc3e03b2ba8edf18
with:
image-ref: 'quay.io/keycloak/keycloak:legacy'
format: 'template'
template: '@/contrib/sarif.tpl'
output: 'legacy-results.sarif'
severity: 'MEDIUM,CRITICAL,HIGH'
ignore-unfixed: true
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v1
with:
sarif_file: 'legacy-results.sarif'
keycloak-operator:
name: Vulnerability scanner for Keycloak Operator distribution images
runs-on: "ubuntu-18.04"
steps:
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@296212627a1e693efa09c00adc3e03b2ba8edf18
with:
image-ref: 'quay.io/keycloak/keycloak-operator:nightly'
format: 'template'
template: '@/contrib/sarif.tpl'
output: 'operator-results.sarif'
severity: 'MEDIUM,CRITICAL,HIGH'
ignore-unfixed: true
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v1
with:
sarif_file: 'operator-results.sarif'