mirror of
https://github.com/katanemo/plano.git
synced 2026-04-25 00:36:34 +02:00
38646fdac2
* Add Trivy Docker image security scan workflow Scans the Docker image for CRITICAL and HIGH vulnerabilities using Trivy. Blocks PRs on failures; runs non-blocking on main for visibility. Results are uploaded to the GitHub Security tab via SARIF. * Add explicit permissions to Docker security scan workflow Set minimal permissions: contents read for checkout, security-events write for SARIF upload to the GitHub Security tab. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Fix 27 HIGH vulnerabilities found by Trivy Docker scan - Install supervisor via pip instead of apt to eliminate 22 Debian python3.13 package vulnerabilities - Pin urllib3>=2.6.3 to fix CVE-2025-66418, CVE-2025-66471, CVE-2026-21441 - Add ignore-unfixed to Trivy scan to suppress unfixable glibc CVE-2026-0861 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
56 lines
1.4 KiB
YAML
56 lines
1.4 KiB
YAML
name: Docker Security Scan
|
|
|
|
env:
|
|
DOCKER_IMAGE: katanemo/plano
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
pull_request:
|
|
|
|
permissions:
|
|
contents: read
|
|
security-events: write
|
|
|
|
jobs:
|
|
scan:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Checkout Repository
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Build Docker Image
|
|
uses: docker/build-push-action@v5
|
|
with:
|
|
context: .
|
|
file: ./Dockerfile
|
|
platforms: linux/amd64
|
|
push: false
|
|
tags: ${{ env.DOCKER_IMAGE }}:scan
|
|
|
|
- name: Run Trivy vulnerability scanner
|
|
uses: aquasecurity/trivy-action@master
|
|
with:
|
|
image-ref: ${{ env.DOCKER_IMAGE }}:scan
|
|
format: table
|
|
# Fail on PRs so vulnerabilities block merge; on main just report
|
|
exit-code: ${{ github.event_name == 'pull_request' && '1' || '0' }}
|
|
ignore-unfixed: true
|
|
severity: CRITICAL,HIGH
|
|
|
|
- name: Run Trivy scanner (SARIF for GitHub Security tab)
|
|
if: always()
|
|
uses: aquasecurity/trivy-action@master
|
|
with:
|
|
image-ref: ${{ env.DOCKER_IMAGE }}:scan
|
|
format: sarif
|
|
output: trivy-results.sarif
|
|
ignore-unfixed: true
|
|
severity: CRITICAL,HIGH
|
|
|
|
- name: Upload Trivy results to GitHub Security tab
|
|
if: always()
|
|
uses: github/codeql-action/upload-sarif@v3
|
|
with:
|
|
sarif_file: trivy-results.sarif
|