Skip to content

Commit f9424c1

Browse files
nikpivkinnikpivkin
authored
Merge pull request #481 from aquasecurity/bump-trivy-1755898251
2 parents 644762e + 85abccb commit f9424c1

File tree

12 files changed

+56
-77
lines changed

12 files changed

+56
-77
lines changed

‎.github/workflows/bump-trivy.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,9 @@ jobs:
2222
- name: Update Trivy versions
2323
run: make bump-trivy
2424

25+
- name: Update golden files
26+
run: make update-golden
27+
2528
- name: Create PR
2629
id: create-pr
2730
uses: peter-evans/create-pull-request@v5

‎.github/workflows/test.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ on:
66
workflow_dispatch:
77

88
env:
9-
TRIVY_VERSION: 0.64.1
9+
TRIVY_VERSION: 0.65.0
1010
BATS_LIB_PATH: '/usr/lib/'
1111

1212
jobs:

‎Makefile‎

Lines changed: 18 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,26 @@ SED = gsed
77
BATS_LIB_PATH = /opt/homebrew/lib
88
endif
99

10+
BATS_ENV := BATS_LIB_PATH=$(BATS_LIB_PATH) \
11+
GITHUB_REPOSITORY_OWNER=aquasecurity \
12+
TRIVY_CACHE_DIR=.cache \
13+
TRIVY_DISABLE_VEX_NOTICE=true \
14+
TRIVY_DEBUG=true
15+
16+
BATS_FLAGS := --recursive --timing --verbose-run .
17+
1018
.PHONY: test
11-
test:
19+
test: init-cache
20+
$(BATS_ENV) bats $(BATS_FLAGS)
21+
22+
.PHONY: update-golden
23+
update-golden: init-cache
24+
UPDATE_GOLDEN=1 $(BATS_ENV) bats $(BATS_FLAGS)
25+
26+
.PHONY: init-cache
27+
init-cache:
1228
mkdir -p .cache
13-
BATS_LIB_PATH=$(BATS_LIB_PATH) GITHUB_REPOSITORY_OWNER=aquasecurity\
14-
TRIVY_CACHE_DIR=.cache TRIVY_DISABLE_VEX_NOTICE=true TRIVY_DEBUG=true\
15-
bats --recursive --timing --verbose-run .
29+
rm -f .cache/fanal/fanal.db
1630

1731
bump-trivy:
1832
@[ $$NEW_VERSION ] || ( echo "env 'NEW_VERSION' is not set"; exit 1 )

‎README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -215,7 +215,7 @@ jobs:
215215
uses: aquasecurity/setup-trivy@v0.2.0
216216
with:
217217
cache: true
218-
version: v0.64.1
218+
version: v0.65.0
219219
220220
- name: Run Trivy vulnerability scanner in repo mode
221221
uses: aquasecurity/trivy-action@master
@@ -847,7 +847,7 @@ Following inputs can be used as `step.with` keys:
847847
| `github-pat` | String | | Authentication token to enable sending SBOM scan results to GitHub Dependency Graph. Can be either a GitHub Personal Access Token (PAT) or GITHUB_TOKEN |
848848
| `limit-severities-for-sarif` | Boolean | false | By default *SARIF* format enforces output of all vulnerabilities regardless of configured severities. To override this behavior set this parameter to **true** |
849849
| `docker-host` | String | | By default it is set to `unix://var/run/docker.sock`, but can be updated to help with containerized infrastructure values (`unix:/` or other prefix is required) |
850-
| `version` | String | `v0.64.1` | Trivy version to use, e.g. `latest` or `v0.64.1` |
850+
| `version` | String | `v0.65.0` | Trivy version to use, e.g. `latest` or `v0.65.0` |
851851
| `skip-setup-trivy` | Boolean | false | Skip calling the `setup-trivy` action to install `trivy` |
852852
| `token-setup-trivy` | Boolean | | Overwrite `github.token` used by `setup-trivy` to checkout the `trivy` repository |
853853

‎action.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,7 @@ inputs:
9898
version:
9999
description: 'Trivy version to use'
100100
required: false
101-
default: 'v0.64.1'
101+
default: 'v0.65.0'
102102
cache:
103103
description: 'Used to specify whether caching is needed. Set to false, if you would like to disable caching.'
104104
required: false

‎test/data/config-scan/report.json‎

Lines changed: 8 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -2,18 +2,6 @@
22
"SchemaVersion": 2,
33
"ArtifactName": "test/data/config-scan",
44
"ArtifactType": "filesystem",
5-
"Metadata": {
6-
"ImageConfig": {
7-
"architecture": "",
8-
"created": "0001-01-01T00:00:00Z",
9-
"os": "",
10-
"rootfs": {
11-
"type": "",
12-
"diff_ids": null
13-
},
14-
"config": {}
15-
}
16-
},
175
"Results": [
186
{
197
"Target": ".",
@@ -50,7 +38,6 @@
5038
"https://avd.aquasec.com/misconfig/avd-aws-0086"
5139
],
5240
"Status": "FAIL",
53-
"Layer": {},
5441
"CauseMetadata": {
5542
"Resource": "aws_s3_bucket.bucket",
5643
"Provider": "AWS",
@@ -90,8 +77,7 @@
9077
"LastCause": true
9178
}
9279
]
93-
},
94-
"RenderedCause": {}
80+
}
9581
}
9682
},
9783
{
@@ -111,7 +97,6 @@
11197
"https://avd.aquasec.com/misconfig/avd-aws-0087"
11298
],
11399
"Status": "FAIL",
114-
"Layer": {},
115100
"CauseMetadata": {
116101
"Resource": "aws_s3_bucket.bucket",
117102
"Provider": "AWS",
@@ -151,8 +136,7 @@
151136
"LastCause": true
152137
}
153138
]
154-
},
155-
"RenderedCause": {}
139+
}
156140
}
157141
},
158142
{
@@ -172,7 +156,6 @@
172156
"https://avd.aquasec.com/misconfig/avd-aws-0088"
173157
],
174158
"Status": "FAIL",
175-
"Layer": {},
176159
"CauseMetadata": {
177160
"Resource": "aws_s3_bucket.bucket",
178161
"Provider": "AWS",
@@ -212,8 +195,7 @@
212195
"LastCause": true
213196
}
214197
]
215-
},
216-
"RenderedCause": {}
198+
}
217199
}
218200
},
219201
{
@@ -234,7 +216,6 @@
234216
"https://avd.aquasec.com/misconfig/s3-bucket-logging"
235217
],
236218
"Status": "FAIL",
237-
"Layer": {},
238219
"CauseMetadata": {
239220
"Resource": "aws_s3_bucket.bucket",
240221
"Provider": "AWS",
@@ -274,8 +255,7 @@
274255
"LastCause": true
275256
}
276257
]
277-
},
278-
"RenderedCause": {}
258+
}
279259
}
280260
},
281261
{
@@ -295,7 +275,6 @@
295275
"https://avd.aquasec.com/misconfig/avd-aws-0090"
296276
],
297277
"Status": "FAIL",
298-
"Layer": {},
299278
"CauseMetadata": {
300279
"Resource": "aws_s3_bucket_versioning.bucket_versioning",
301280
"Provider": "AWS",
@@ -416,7 +395,6 @@
416395
"https://avd.aquasec.com/misconfig/avd-aws-0091"
417396
],
418397
"Status": "FAIL",
419-
"Layer": {},
420398
"CauseMetadata": {
421399
"Resource": "aws_s3_bucket.bucket",
422400
"Provider": "AWS",
@@ -456,8 +434,7 @@
456434
"LastCause": true
457435
}
458436
]
459-
},
460-
"RenderedCause": {}
437+
}
461438
}
462439
},
463440
{
@@ -477,7 +454,6 @@
477454
"https://avd.aquasec.com/misconfig/avd-aws-0093"
478455
],
479456
"Status": "FAIL",
480-
"Layer": {},
481457
"CauseMetadata": {
482458
"Resource": "aws_s3_bucket.bucket",
483459
"Provider": "AWS",
@@ -517,8 +493,7 @@
517493
"LastCause": true
518494
}
519495
]
520-
},
521-
"RenderedCause": {}
496+
}
522497
}
523498
},
524499
{
@@ -538,7 +513,6 @@
538513
"https://avd.aquasec.com/misconfig/avd-aws-0094"
539514
],
540515
"Status": "FAIL",
541-
"Layer": {},
542516
"CauseMetadata": {
543517
"Resource": "aws_s3_bucket.bucket",
544518
"Provider": "AWS",
@@ -578,8 +552,7 @@
578552
"LastCause": true
579553
}
580554
]
581-
},
582-
"RenderedCause": {}
555+
}
583556
}
584557
},
585558
{
@@ -599,7 +572,6 @@
599572
"https://avd.aquasec.com/misconfig/avd-aws-0132"
600573
],
601574
"Status": "FAIL",
602-
"Layer": {},
603575
"CauseMetadata": {
604576
"Resource": "aws_s3_bucket.bucket",
605577
"Provider": "AWS",
@@ -639,8 +611,7 @@
639611
"LastCause": true
640612
}
641613
]
642-
},
643-
"RenderedCause": {}
614+
}
644615
}
645616
}
646617
]

‎test/data/image-scan/report‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,8 @@ Total: 19 (CRITICAL: 19)
5151
│ │ │ │ │ │ │ Windows Subsystem for... │
5252
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-1353 │
5353
├─────────────┼────────────────┤ │ ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
54-
│ libbz2 │ CVE-2019-12900 │ │ │ 1.0.6-r6 │ 1.0.6-r7 │ bzip2: out-of-bounds write in function BZ2_decompress │
54+
│ libbz2 │ CVE-2019-12900 │ │ │ 1.0.6-r6 │ 1.0.6-r7 │ bzip2: bzip2: Data integrity error when decompressing (with │
55+
│ │ │ │ │ │ │ data integrity tests fail).... │
5556
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-12900 │
5657
├─────────────┼────────────────┤ │ ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
5758
│ libcurl │ CVE-2018-16839 │ │ │ 7.61.1-r0 │ 7.61.1-r1 │ curl: Integer overflow leading to heap-based buffer overflow │

‎test/data/secret-scan/report.json‎

Lines changed: 7 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -3,16 +3,12 @@
33
"ArtifactName": "https://github.com/krol3/demo-trivy/",
44
"ArtifactType": "repository",
55
"Metadata": {
6-
"ImageConfig": {
7-
"architecture": "",
8-
"created": "0001-01-01T00:00:00Z",
9-
"os": "",
10-
"rootfs": {
11-
"type": "",
12-
"diff_ids": null
13-
},
14-
"config": {}
15-
}
6+
"RepoURL": "https://github.com/krol3/demo-trivy/",
7+
"Branch": "main",
8+
"Commit": "547db823c73fdb3385871f6235e946c72291f734",
9+
"CommitMsg": "chore: add gitignore",
10+
"Author": "carolina valencia <krol3@users.noreply.github.com>",
11+
"Committer": "carolina valencia <krol3@users.noreply.github.com>"
1612
},
1713
"Results": [
1814
{
@@ -68,8 +64,7 @@
6864
}
6965
]
7066
},
71-
"Match": "export GITHUB_PAT=****************************************",
72-
"Layer": {}
67+
"Match": "export GITHUB_PAT=****************************************"
7368
}
7469
]
7570
}

‎test/data/with-ignore-files/report‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,8 @@ Total: 19 (CRITICAL: 19)
5151
│ │ │ │ │ │ │ Windows Subsystem for... │
5252
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-1353 │
5353
├─────────────┼────────────────┤ │ ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
54-
│ libbz2 │ CVE-2019-12900 │ │ │ 1.0.6-r6 │ 1.0.6-r7 │ bzip2: out-of-bounds write in function BZ2_decompress │
54+
│ libbz2 │ CVE-2019-12900 │ │ │ 1.0.6-r6 │ 1.0.6-r7 │ bzip2: bzip2: Data integrity error when decompressing (with │
55+
│ │ │ │ │ │ │ data integrity tests fail).... │
5556
│ │ │ │ │ │ │ https://avd.aquasec.com/nvd/cve-2019-12900 │
5657
├─────────────┼────────────────┤ │ ├───────────────────┼───────────────┼──────────────────────────────────────────────────────────────┤
5758
│ libcurl │ CVE-2018-16839 │ │ │ 7.61.1-r0 │ 7.61.1-r1 │ curl: Integer overflow leading to heap-based buffer overflow │

‎test/data/with-tf-vars/report.json‎

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -2,18 +2,6 @@
22
"SchemaVersion": 2,
33
"ArtifactName": "test/data/with-tf-vars/main.tf",
44
"ArtifactType": "filesystem",
5-
"Metadata": {
6-
"ImageConfig": {
7-
"architecture": "",
8-
"created": "0001-01-01T00:00:00Z",
9-
"os": "",
10-
"rootfs": {
11-
"type": "",
12-
"diff_ids": null
13-
},
14-
"config": {}
15-
}
16-
},
175
"Results": [
186
{
197
"Target": ".",

0 commit comments

Comments
 (0)