29 lines
959 B
YAML
29 lines
959 B
YAML
|
name: Trivy Vulnerability Scan
|
||
|
|
on: [push]
|
||
|
|
jobs:
|
||
|
|
trivy:
|
||
|
|
runs-on: docker
|
||
|
|
steps:
|
||
|
|
- uses: actions/checkout@v4
|
||
|
|
- name: Run Trivy vulnerability scanner
|
||
|
|
uses: aquasecurity/trivy-action@master
|
||
|
|
with:
|
||
|
|
scan-type: 'fs'
|
||
|
|
scan-ref: '.'
|
||
|
|
format: 'json'
|
||
|
|
output: 'trivy-results.json'
|
||
|
|
severity: 'CRITICAL,HIGH,MEDIUM,LOW'
|
||
|
|
exit-code: '0'
|
||
|
|
- name: Upload results to DefectDojo
|
||
|
|
run: |
|
||
|
|
curl -s -X POST "${{ secrets.DEFECTDOJO_URL }}/api/v2/import-scan/" \
|
||
|
|
-H "Authorization: Token ${{ secrets.DEFECTDOJO_API_KEY }}" \
|
||
|
|
-F "scan_type=Trivy Scan" \
|
||
|
|
-F "file=@trivy-results.json" \
|
||
|
|
-F "product_name=${{ github.repository }}" \
|
||
|
|
-F "engagement_name=CI Scans" \
|
||
|
|
-F "auto_create_context=true" \
|
||
|
|
-F "active=true" \
|
||
|
|
-F "verified=false" \
|
||
|
|
-F "minimum_severity=Low"
|