trivy-secret-scan.yml

name: "Trivy secret scanning"
on:
  push:
    branches:
    - "**"
  pull_request:
jobs:
  scan:
    name: "Trivy scan in fs mode"
    runs-on: ubuntu-22.04
    steps:
    - name: Checkout code
      uses: actions/checkout@v4

    - name: Run Trivy vulnerability scanner in fs mode
      uses: aquasecurity/trivy-action@0.21.0
      with:
        scan-type: 'fs'
        scan-ref: '.'
        scanners: 'secret'
        exit-code: '1'
      env:
        TRIVY_SECRET_CONFIG: 'trivy/trivy-secret.yaml'
        TRIVY_DB_REPOSITORY: 'europe-west3-docker.pkg.dev/fdc-public-docker-registry/kuberpult/aquasecurity/trivy-db'
  send-alert:
    name: "Send alert in case secret is detected"
    if: ${{ failure() }}
    needs: scan
    runs-on: ubuntu-22.04
    steps:
    - name: Run curl to the Slack webhook
      run: |
        curl \
        --request POST \
        --header "Content-Type: application/json" \
        --data '{"text": ":warning::warning::warning: *SECRET LEAK ALERT *:warning::warning::warning:\n\nTrivy detected a secret pushed to the Kuberpult repository. Navigate to the <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|failing run> page to inspect the alert.\n\nIf the alert is a false positive, then make sure to add an allow rule for it under <https://github.com/freiheit-com/kuberpult/blob/main/trivy/trivy-secret.yaml|`trivy/trivy-secret.yaml`>."}' \
        --fail \
        ${{ secrets.SLACK_WEBHOOK_SRE_ALERTS_INTERNAL }}