fix(tests): fix TestHealthReporterRetry, TestValidateTokenStatic #4500
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
name: "Trivy secret scanning" | |
on: | |
push: | |
branches: | |
- "**" | |
pull_request: | |
jobs: | |
scan: | |
name: "Trivy scan in fs mode" | |
runs-on: ubuntu-22.04 | |
steps: | |
- name: Checkout code | |
uses: actions/checkout@v4 | |
- name: Run Trivy vulnerability scanner in fs mode | |
uses: aquasecurity/trivy-action@0.21.0 | |
with: | |
scan-type: 'fs' | |
scan-ref: '.' | |
scanners: 'secret' | |
exit-code: '1' | |
env: | |
TRIVY_SECRET_CONFIG: 'trivy/trivy-secret.yaml' | |
send-alert: | |
name: "Send alert in case secret is detected" | |
if: ${{ failure() }} | |
needs: scan | |
runs-on: ubuntu-22.04 | |
steps: | |
- name: Run curl to the Slack webhook | |
run: | | |
curl \ | |
--request POST \ | |
--header "Content-Type: application/json" \ | |
--data '{"text": ":warning::warning::warning: *SECRET LEAK ALERT *:warning::warning::warning:\n\nTrivy detected a secret pushed to the Kuberpult repository. Navigate to the <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|failing run> page to inspect the alert.\n\nIf the alert is a false positive, then make sure to add an allow rule for it under <https://github.com/freiheit-com/kuberpult/blob/main/trivy/trivy-secret.yaml|`trivy/trivy-secret.yaml`>."}' \ | |
--fail \ | |
${{ secrets.SLACK_WEBHOOK_SRE_ALERTS_INTERNAL }} |