From 01b429f91d599125e5919ded655137603f8f4f03 Mon Sep 17 00:00:00 2001 From: micoferdinand98 Date: Thu, 27 Jul 2023 14:23:36 +0800 Subject: [PATCH] fix(security): vulnerabilities found in example-carbon-accounting Fixes #2062 Signed-off-by: micoferdinand98 --- .github/workflows/trivy-container-scan.yaml | 42 +++++++++++++++++++++ 1 file changed, 42 insertions(+) create mode 100644 .github/workflows/trivy-container-scan.yaml diff --git a/.github/workflows/trivy-container-scan.yaml b/.github/workflows/trivy-container-scan.yaml new file mode 100644 index 0000000000..2bf59e0c95 --- /dev/null +++ b/.github/workflows/trivy-container-scan.yaml @@ -0,0 +1,42 @@ +name: trivy-container-image-scan + + + +on: + push: + pull_request: + # Publish `main` as Docker `latest` image. + branches: + - main + + + + # Publish `v1.2.3` tags as releases. + tags: + - v* + + + + +jobs: + + + + build: + name: Scan cactus-example-carbon-accounting image + runs-on: ubuntu-20.04 + steps: + - name: Checkout code + uses: actions/checkout@v2 + - name: Build an image from Dockerfile + run: | + DOCKER_BUILDKIT=1 docker build ./ -f ./examples/carbon-accounting/Dockerfile -t cactus-example-carbon-accounting + - name: Run Trivy vulnerability scanner + uses: aquasecurity/trivy-action@0.11.2 + with: + image-ref: 'cactus-connector-besu' + format: 'table' + exit-code: '0' + ignore-unfixed: true + vuln-type: 'os,library' + severity: 'CRITICAL,HIGH' \ No newline at end of file