Skip to content

Trivy

Trivy #127

Workflow file for this run

name: Trivy
on: workflow_dispatch
jobs:
trivy:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Set up JDK
uses: actions/setup-java@v3
with:
java-version: '17'
distribution: 'temurin'
cache: 'gradle'
- name: Build all projects without running tests
run: ./gradlew --build-cache build -x test -x spotlessCheck
- name: Construct docker image name and tag
id: image-name
run: |
echo "name=trivy-local-testing-image" >> $GITHUB_OUTPUT
- name: Build image locally with jib
run: |
DOCKER_IMAGE_NAME_AND_TAG=${{ steps.image-name.outputs.name }} \
./scripts/build docker
- name: Run Trivy vulnerability scanner
uses: broadinstitute/dsp-appsec-trivy-action@v1
with:
image: ${{ steps.image-name.outputs.name }}
# report workflow status in slack
# see https://docs.google.com/document/d/1G6-whnNJvON6Qq1b3VvRJFC7M9M-gu2dAVrQHDyp9Us/edit?usp=sharing
report-workflow:
uses: broadinstitute/sherlock/.github/workflows/client-report-workflow.yaml@main
with:
# Channels to notify upon workflow success or failure
notify-slack-channels-upon-workflow-completion: '#dsp-app-manager-builds'
# Channels to notify upon workflow success only
# notify-slack-channels-upon-workflow-success: "#channel-here"
# Channels to notify upon workflow failure only
# notify-slack-channels-upon-workflow-failure: "#channel-here"
permissions:
id-token: 'write'