Skip to content

Commit f73ed5b

Browse files
anthony-nhsanthony-nhs
authored
Chore: [AEA-0000] - remove trivy (#66)
## Summary - Routine Change ### Details - remove trivy
1 parent 25fb477 commit f73ed5b

File tree

4 files changed

+161
-152
lines changed

4 files changed

+161
-152
lines changed

‎.github/workflows/build_multi_arch_image.yml‎

Lines changed: 31 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -63,13 +63,13 @@ jobs:
6363
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
6464
with:
6565
fetch-depth: 0
66-
- name: setup trivy
67-
run: |
68-
mkdir -p "$RUNNER_TEMP/bin"
69-
docker build --output="$RUNNER_TEMP/bin" -f "src/base/.devcontainer/Dockerfile.trivy.${ARCH}" .
70-
echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
71-
env:
72-
ARCH: '${{ matrix.arch }}'
66+
# - name: setup trivy
67+
# run: |
68+
# mkdir -p "$RUNNER_TEMP/bin"
69+
# docker build --output="$RUNNER_TEMP/bin" -f "src/base/.devcontainer/Dockerfile.trivy.${ARCH}" .
70+
# echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
71+
# env:
72+
# ARCH: '${{ matrix.arch }}'
7373
- name: setup node
7474
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f
7575
with:
@@ -101,30 +101,30 @@ jobs:
101101
IMAGE_TAG: "${{ inputs.docker_tag }}-${{ matrix.arch }}"
102102
EXIT_CODE: 0
103103
EXTRA_COMMON: "${{ inputs.extra_common }}"
104-
- uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
105-
name: Upload scan results
106-
with:
107-
name: "scan_results_docker_${{ inputs.container_name }}_${{ matrix.arch }}.json"
108-
path: .out/scan_results_docker.json
109-
- name: Check docker vulnerabilities - table output
110-
run: |
111-
make scan-image
112-
env:
113-
CONTAINER_NAME: '${{ inputs.container_name }}'
114-
BASE_FOLDER: "${{ inputs.base_folder }}"
115-
IMAGE_TAG: "${{ inputs.docker_tag }}-${{ matrix.arch }}"
116-
EXIT_CODE: "1"
117-
EXTRA_COMMON: "${{ inputs.extra_common }}"
118-
- name: Show docker vulnerability output
119-
if: always()
120-
run: |
121-
echo "Scan output for ghcr.io/nhsdigital/eps-devcontainers/base:${DOCKER_TAG}-${ARCHITECTURE}"
122-
if [ -f .out/scan_results_docker.txt ]; then
123-
cat .out/scan_results_docker.txt
124-
fi
125-
env:
126-
ARCHITECTURE: '${{ matrix.arch }}'
127-
DOCKER_TAG: '${{ inputs.docker_tag }}'
104+
# - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
105+
# name: Upload scan results
106+
# with:
107+
# name: "scan_results_docker_${{ inputs.container_name }}_${{ matrix.arch }}.json"
108+
# path: .out/scan_results_docker.json
109+
# - name: Check docker vulnerabilities - table output
110+
# run: |
111+
# make scan-image
112+
# env:
113+
# CONTAINER_NAME: '${{ inputs.container_name }}'
114+
# BASE_FOLDER: "${{ inputs.base_folder }}"
115+
# IMAGE_TAG: "${{ inputs.docker_tag }}-${{ matrix.arch }}"
116+
# EXIT_CODE: "1"
117+
# EXTRA_COMMON: "${{ inputs.extra_common }}"
118+
# - name: Show docker vulnerability output
119+
# if: always()
120+
# run: |
121+
# echo "Scan output for ghcr.io/nhsdigital/eps-devcontainers/base:${DOCKER_TAG}-${ARCHITECTURE}"
122+
# if [ -f .out/scan_results_docker.txt ]; then
123+
# cat .out/scan_results_docker.txt
124+
# fi
125+
# env:
126+
# ARCHITECTURE: '${{ matrix.arch }}'
127+
# DOCKER_TAG: '${{ inputs.docker_tag }}'
128128
- name: Push tagged image and rebuild for github actions
129129
run: |
130130
echo "Pushing image..."

‎Makefile‎

Lines changed: 36 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -81,42 +81,44 @@ build-githubactions-image: guard-BASE_IMAGE_NAME guard-BASE_IMAGE_TAG guard-IMAG
8181
.
8282

8383
scan-image: guard-CONTAINER_NAME guard-BASE_FOLDER
84-
mkdir -p .out
85-
@combined="src/$${BASE_FOLDER}/$${CONTAINER_NAME}/.trivyignore_combined.yaml"; \
86-
common="src/common/.trivyignore.yaml"; \
87-
extra_common="src/$${EXTRA_COMMON}/.trivyignore.yaml"; \
88-
specific="src/$${BASE_FOLDER}/$${CONTAINER_NAME}/.trivyignore.yaml"; \
89-
exit_code="$${EXIT_CODE:-1}"; \
90-
echo "vulnerabilities:" > "$$combined"; \
91-
if [ -f "$$common" ]; then sed -n '2,$$p' "$$common" >> "$$combined"; fi; \
92-
if [ -f "$$extra_common" ]; then sed -n '2,$$p' "$$extra_common" >> "$$combined"; fi; \
93-
if [ -f "$$specific" ]; then sed -n '2,$$p' "$$specific" >> "$$combined"; fi; \
94-
trivy image \
95-
--severity HIGH,CRITICAL \
96-
--config src/${BASE_FOLDER}/${CONTAINER_NAME}/trivy.yaml \
97-
--scanners vuln \
98-
--exit-code $$exit_code \
99-
--format table \
100-
--output .out/scan_results_docker.txt "${CONTAINER_PREFIX}$${CONTAINER_NAME}:$${IMAGE_TAG}"
84+
echo "Not implemented"
85+
# mkdir -p .out
86+
# @combined="src/$${BASE_FOLDER}/$${CONTAINER_NAME}/.trivyignore_combined.yaml"; \
87+
# common="src/common/.trivyignore.yaml"; \
88+
# extra_common="src/$${EXTRA_COMMON}/.trivyignore.yaml"; \
89+
# specific="src/$${BASE_FOLDER}/$${CONTAINER_NAME}/.trivyignore.yaml"; \
90+
# exit_code="$${EXIT_CODE:-1}"; \
91+
# echo "vulnerabilities:" > "$$combined"; \
92+
# if [ -f "$$common" ]; then sed -n '2,$$p' "$$common" >> "$$combined"; fi; \
93+
# if [ -f "$$extra_common" ]; then sed -n '2,$$p' "$$extra_common" >> "$$combined"; fi; \
94+
# if [ -f "$$specific" ]; then sed -n '2,$$p' "$$specific" >> "$$combined"; fi; \
95+
# trivy image \
96+
# --severity HIGH,CRITICAL \
97+
# --config src/${BASE_FOLDER}/${CONTAINER_NAME}/trivy.yaml \
98+
# --scanners vuln \
99+
# --exit-code $$exit_code \
100+
# --format table \
101+
# --output .out/scan_results_docker.txt "${CONTAINER_PREFIX}$${CONTAINER_NAME}:$${IMAGE_TAG}"
101102

102103
scan-image-json: guard-CONTAINER_NAME guard-BASE_FOLDER guard-IMAGE_TAG
103-
mkdir -p .out
104-
@combined="src/$${BASE_FOLDER}/$${CONTAINER_NAME}/.trivyignore_combined.yaml"; \
105-
common="src/common/.trivyignore.yaml"; \
106-
extra_common="src/$${EXTRA_COMMON}/.trivyignore.yaml"; \
107-
specific="src/$${BASE_FOLDER}/$${CONTAINER_NAME}/.trivyignore.yaml"; \
108-
exit_code="$${EXIT_CODE:-1}"; \
109-
echo "vulnerabilities:" > "$$combined"; \
110-
if [ -f "$$common" ]; then sed -n '2,$$p' "$$common" >> "$$combined"; fi; \
111-
if [ -f "$$extra_common" ]; then sed -n '2,$$p' "$$extra_common" >> "$$combined"; fi; \
112-
if [ -f "$$specific" ]; then sed -n '2,$$p' "$$specific" >> "$$combined"; fi; \
113-
trivy image \
114-
--severity HIGH,CRITICAL \
115-
--config src/${BASE_FOLDER}/${CONTAINER_NAME}/trivy.yaml \
116-
--scanners vuln \
117-
--exit-code "$$exit_code" \
118-
--format json \
119-
--output .out/scan_results_docker.json "${CONTAINER_PREFIX}$${CONTAINER_NAME}:$${IMAGE_TAG}"
104+
echo "Not implemented"
105+
# mkdir -p .out
106+
# @combined="src/$${BASE_FOLDER}/$${CONTAINER_NAME}/.trivyignore_combined.yaml"; \
107+
# common="src/common/.trivyignore.yaml"; \
108+
# extra_common="src/$${EXTRA_COMMON}/.trivyignore.yaml"; \
109+
# specific="src/$${BASE_FOLDER}/$${CONTAINER_NAME}/.trivyignore.yaml"; \
110+
# exit_code="$${EXIT_CODE:-1}"; \
111+
# echo "vulnerabilities:" > "$$combined"; \
112+
# if [ -f "$$common" ]; then sed -n '2,$$p' "$$common" >> "$$combined"; fi; \
113+
# if [ -f "$$extra_common" ]; then sed -n '2,$$p' "$$extra_common" >> "$$combined"; fi; \
114+
# if [ -f "$$specific" ]; then sed -n '2,$$p' "$$specific" >> "$$combined"; fi; \
115+
# trivy image \
116+
# --severity HIGH,CRITICAL \
117+
# --config src/${BASE_FOLDER}/${CONTAINER_NAME}/trivy.yaml \
118+
# --scanners vuln \
119+
# --exit-code "$$exit_code" \
120+
# --format json \
121+
# --output .out/scan_results_docker.json "${CONTAINER_PREFIX}$${CONTAINER_NAME}:$${IMAGE_TAG}"
120122

121123
shell-image: guard-CONTAINER_NAME guard-IMAGE_TAG
122124
docker run -it \

‎src/base/.devcontainer/Dockerfile‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
1-
FROM alpine:3.23.3 AS build
2-
ARG TARGETARCH
3-
RUN apk add --no-cache cosign bash curl jq
4-
COPY --chmod=755 scripts/install_trivy.sh /tmp/install_trivy.sh
5-
RUN case "${TARGETARCH}" in \
6-
x86_64|amd64) TRIVY_ARCH=64bit ;; \
7-
aarch64|arm64) TRIVY_ARCH=ARM64 ;; \
8-
*) echo "Unsupported TARGETARCH: ${TARGETARCH}" && exit 1 ;; \
9-
esac \
10-
&& INSTALL_DIR=/tmp/trivy/ ARCH="${TRIVY_ARCH}" /tmp/install_trivy.sh
1+
# FROM alpine:3.23.3 AS build
2+
# ARG TARGETARCH
3+
# RUN apk add --no-cache cosign bash curl jq
4+
# COPY --chmod=755 scripts/install_trivy.sh /tmp/install_trivy.sh
5+
# RUN case "${TARGETARCH}" in \
6+
# x86_64|amd64) TRIVY_ARCH=64bit ;; \
7+
# aarch64|arm64) TRIVY_ARCH=ARM64 ;; \
8+
# *) echo "Unsupported TARGETARCH: ${TARGETARCH}" && exit 1 ;; \
9+
# esac \
10+
# && INSTALL_DIR=/tmp/trivy/ ARCH="${TRIVY_ARCH}" /tmp/install_trivy.sh
1111

1212
FROM mcr.microsoft.com/devcontainers/base:ubuntu-22.04
1313

@@ -27,7 +27,7 @@ COPY --chmod=755 Mk ${SCRIPTS_DIR}/Mk
2727
WORKDIR ${SCRIPTS_DIR}/${CONTAINER_NAME}
2828
RUN ./root_install.sh
2929

30-
COPY --from=build /tmp/trivy/trivy /usr/local/bin/trivy
30+
# COPY --from=build /tmp/trivy/trivy /usr/local/bin/trivy
3131

3232
COPY --chmod=755 scripts/vscode_install.sh ${SCRIPTS_DIR}/${CONTAINER_NAME}/vscode_install.sh
3333
USER vscode

‎src/base/.devcontainer/Mk/trivy.mk‎

Lines changed: 83 additions & 76 deletions
Original file line numberDiff line numberDiff line change
@@ -1,91 +1,98 @@
11
.PHONY: trivy-license-check trivy-generate-sbom trivy-scan-python trivy-scan-node trivy-scan-go trivy-scan-java
22

33
trivy-license-check:
4-
mkdir -p .trivy_out/
5-
@if [ -f poetry.lock ]; then \
6-
poetry self add poetry-plugin-export; \
7-
poetry export -f requirements.txt --with dev --without-hashes --output=requirements.txt; \
8-
fi
9-
@if [ -f src/go.sum ]; then \
10-
cd src && go mod vendor; \
11-
fi
12-
VIRTUAL_ENV=./.venv/ trivy fs . \
13-
--scanners license \
14-
--severity HIGH,CRITICAL \
15-
--config trivy.yaml \
16-
--include-dev-deps \
17-
--pkg-types library \
18-
--exit-code 1 \
19-
--output .trivy_out/license_scan.txt \
20-
--format table
21-
@if [ -f poetry.lock ]; then rm -f requirements.txt; fi
22-
@if [ -f src/go.sum ]; then rm -rf src/vendor; fi
4+
echo "Not implemented"
5+
# mkdir -p .trivy_out/
6+
# @if [ -f poetry.lock ]; then \
7+
# poetry self add poetry-plugin-export; \
8+
# poetry export -f requirements.txt --with dev --without-hashes --output=requirements.txt; \
9+
# fi
10+
# @if [ -f src/go.sum ]; then \
11+
# cd src && go mod vendor; \
12+
# fi
13+
# VIRTUAL_ENV=./.venv/ trivy fs . \
14+
# --scanners license \
15+
# --severity HIGH,CRITICAL \
16+
# --config trivy.yaml \
17+
# --include-dev-deps \
18+
# --pkg-types library \
19+
# --exit-code 1 \
20+
# --output .trivy_out/license_scan.txt \
21+
# --format table
22+
# @if [ -f poetry.lock ]; then rm -f requirements.txt; fi
23+
# @if [ -f src/go.sum ]; then rm -rf src/vendor; fi
2324

2425
trivy-generate-sbom:
25-
mkdir -p .trivy_out/
26-
trivy fs . \
27-
--scanners vuln \
28-
--config trivy.yaml \
29-
--include-dev-deps \
30-
--exit-code 0 \
31-
--output .trivy_out/sbom.cdx.json \
32-
--format cyclonedx
26+
echo "Not implemented"
27+
# mkdir -p .trivy_out/
28+
# trivy fs . \
29+
# --scanners vuln \
30+
# --config trivy.yaml \
31+
# --include-dev-deps \
32+
# --exit-code 0 \
33+
# --output .trivy_out/sbom.cdx.json \
34+
# --format cyclonedx
3335

3436
trivy-scan-python:
35-
mkdir -p .trivy_out/
36-
trivy fs . \
37-
--scanners vuln \
38-
--severity HIGH,CRITICAL \
39-
--config trivy.yaml \
40-
--include-dev-deps \
41-
--exit-code 1 \
42-
--skip-files "**/package-lock.json,**/go.mod,**/pom.xml" \
43-
--output .trivy_out/dependency_results_python.txt \
44-
--format table
37+
echo "Not implemented"
38+
# mkdir -p .trivy_out/
39+
# trivy fs . \
40+
# --scanners vuln \
41+
# --severity HIGH,CRITICAL \
42+
# --config trivy.yaml \
43+
# --include-dev-deps \
44+
# --exit-code 1 \
45+
# --skip-files "**/package-lock.json,**/go.mod,**/pom.xml" \
46+
# --output .trivy_out/dependency_results_python.txt \
47+
# --format table
4548

4649
trivy-scan-node:
47-
mkdir -p .trivy_out/
48-
trivy fs . \
49-
--scanners vuln \
50-
--severity HIGH,CRITICAL \
51-
--config trivy.yaml \
52-
--include-dev-deps \
53-
--exit-code 1 \
54-
--skip-files "**/poetry.lock,**/go.mod,**/pom.xml" \
55-
--output .trivy_out/dependency_results_node.txt \
56-
--format table
50+
echo "Not implemented"
51+
# mkdir -p .trivy_out/
52+
# trivy fs . \
53+
# --scanners vuln \
54+
# --severity HIGH,CRITICAL \
55+
# --config trivy.yaml \
56+
# --include-dev-deps \
57+
# --exit-code 1 \
58+
# --skip-files "**/poetry.lock,**/go.mod,**/pom.xml" \
59+
# --output .trivy_out/dependency_results_node.txt \
60+
# --format table
5761

5862
trivy-scan-go:
59-
mkdir -p .trivy_out/
60-
trivy fs . \
61-
--scanners vuln \
62-
--severity HIGH,CRITICAL \
63-
--config trivy.yaml \
64-
--include-dev-deps \
65-
--exit-code 1 \
66-
--skip-files "**/poetry.lock,**/package-lock.json,**/pom.xml" \
67-
--output .trivy_out/dependency_results_go.txt \
68-
--format table
63+
echo "Not implemented"
64+
# mkdir -p .trivy_out/
65+
# trivy fs . \
66+
# --scanners vuln \
67+
# --severity HIGH,CRITICAL \
68+
# --config trivy.yaml \
69+
# --include-dev-deps \
70+
# --exit-code 1 \
71+
# --skip-files "**/poetry.lock,**/package-lock.json,**/pom.xml" \
72+
# --output .trivy_out/dependency_results_go.txt \
73+
# --format table
6974

7075
trivy-scan-java:
71-
mkdir -p .trivy_out/
72-
trivy fs . \
73-
--scanners vuln \
74-
--severity HIGH,CRITICAL \
75-
--config trivy.yaml \
76-
--include-dev-deps \
77-
--exit-code 1 \
78-
--skip-files "**/poetry.lock,**/package-lock.json,**/go.mod" \
79-
--output .trivy_out/dependency_results_java.txt \
80-
--format table
76+
echo "Not implemented"
77+
# mkdir -p .trivy_out/
78+
# trivy fs . \
79+
# --scanners vuln \
80+
# --severity HIGH,CRITICAL \
81+
# --config trivy.yaml \
82+
# --include-dev-deps \
83+
# --exit-code 1 \
84+
# --skip-files "**/poetry.lock,**/package-lock.json,**/go.mod" \
85+
# --output .trivy_out/dependency_results_java.txt \
86+
# --format table
8187

8288
trivy-scan-docker: guard-DOCKER_IMAGE
83-
mkdir -p .trivy_out/
84-
trivy image $${DOCKER_IMAGE} \
85-
--scanners vuln \
86-
--severity HIGH,CRITICAL \
87-
--config trivy.yaml \
88-
--exit-code 1 \
89-
--pkg-types os,library \
90-
--output .trivy_out/dependency_results_docker.txt \
91-
--format table
89+
echo "Not implemented"
90+
# mkdir -p .trivy_out/
91+
# trivy image $${DOCKER_IMAGE} \
92+
# --scanners vuln \
93+
# --severity HIGH,CRITICAL \
94+
# --config trivy.yaml \
95+
# --exit-code 1 \
96+
# --pkg-types os,library \
97+
# --output .trivy_out/dependency_results_docker.txt \
98+
# --format table

0 commit comments

Comments
 (0)