Skip to content

Commit 58e95bc

Browse files
sidnhsjamesthompson26-nhs
sidnhs
and
jamesthompson26-nhs
authored
CCM-15550: Disable trivy in CI (#481)
* CCM-15550: Disable Trivy in CI * CCM-15550: Disable Trivy in CI --------- Co-authored-by: jamesthompson26-nhs <115219893+jamesthompson26-nhs@users.noreply.github.com>
1 parent c861af7 commit 58e95bc

File tree

6 files changed

+104
-63
lines changed

6 files changed

+104
-63
lines changed

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
- [ ] I have added tests to cover my changes
2626
- [ ] I have updated the documentation accordingly
2727
- [ ] This PR is a result of pair or mob programming
28-
- [ ] If I have used the 'skip-trivy-package' label I have done so responsibly and in the knowledge that this is being fixed as part of a separate ticket/PR.
28+
<!-- - [ ] If I have used the 'skip-trivy-package' label I have done so responsibly and in the knowledge that this is being fixed as part of a separate ticket/PR. TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549 -->
2929

3030
---
3131

‎.github/actions/trivy-iac/action.yaml‎

Lines changed: 19 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,20 @@
1-
name: "Trivy IaC Scan"
2-
description: "Scan Terraform IaC using Trivy"
3-
runs:
4-
using: "composite"
5-
steps:
6-
- name: "Trivy Terraform IaC Scan"
7-
shell: bash
8-
run: |
9-
components_exit_code=0
10-
modules_exit_code=0
11-
asdf plugin add trivy || true
12-
asdf install trivy || true
13-
./scripts/terraform/trivy-scan.sh --mode iac ./infrastructure/terraform/components || components_exit_code=$?
14-
./scripts/terraform/trivy-scan.sh --mode iac ./infrastructure/terraform/modules || modules_exit_code=$?
1+
# TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
2+
# name: "Trivy IaC Scan"
3+
# description: "Scan Terraform IaC using Trivy"
4+
# runs:
5+
# using: "composite"
6+
# steps:
7+
# - name: "Trivy Terraform IaC Scan"
8+
# shell: bash
9+
# run: |
10+
# components_exit_code=0
11+
# modules_exit_code=0
12+
# asdf plugin add trivy || true
13+
# asdf install trivy || true
14+
# ./scripts/terraform/trivy-scan.sh --mode iac ./infrastructure/terraform/components || components_exit_code=$?
15+
# ./scripts/terraform/trivy-scan.sh --mode iac ./infrastructure/terraform/modules || modules_exit_code=$?
1516

16-
if [ $components_exit_code -ne 0 ] || [ $modules_exit_code -ne 0 ]; then
17-
echo "Trivy misconfigurations detected."
18-
exit 1
19-
fi
17+
# if [ $components_exit_code -ne 0 ] || [ $modules_exit_code -ne 0 ]; then
18+
# echo "Trivy misconfigurations detected."
19+
# exit 1
20+
# fi

‎.github/actions/trivy-package/action.yaml‎

Lines changed: 17 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,18 @@
1-
name: "Trivy Package Scan"
2-
description: "Scan project packages using Trivy"
3-
runs:
4-
using: "composite"
5-
steps:
6-
- name: "Trivy Package Scan"
7-
shell: bash
8-
run: |
9-
exit_code=0
10-
asdf plugin add trivy || true
11-
asdf install trivy || true
12-
./scripts/terraform/trivy-scan.sh --mode package . || exit_code=$?
1+
# TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
2+
# name: "Trivy Package Scan"
3+
# description: "Scan project packages using Trivy"
4+
# runs:
5+
# using: "composite"
6+
# steps:
7+
# - name: "Trivy Package Scan"
8+
# shell: bash
9+
# run: |
10+
# exit_code=0
11+
# asdf plugin add trivy || true
12+
# asdf install trivy || true
13+
# ./scripts/terraform/trivy-scan.sh --mode package . || exit_code=$?
1314

14-
if [ $exit_code -ne 0 ]; then
15-
echo "Trivy has detected package vulnerablilites. Please refer to https://nhsd-confluence.digital.nhs.uk/spaces/RIS/pages/1257636917/PLAT-KOP-012+-+Trivy+Pipeline+Vulnerability+Scanning+Exemption"
16-
exit 1
17-
fi
15+
# if [ $exit_code -ne 0 ]; then
16+
# echo "Trivy has detected package vulnerablilites. Please refer to https://nhsd-confluence.digital.nhs.uk/spaces/RIS/pages/1257636917/PLAT-KOP-012+-+Trivy+Pipeline+Vulnerability+Scanning+Exemption"
17+
# exit 1
18+
# fi

‎.github/workflows/cicd-1-pull-request.yaml‎

Lines changed: 23 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,8 @@ jobs:
2828
is_version_prerelease: ${{ steps.variables.outputs.is_version_prerelease }}
2929
does_pull_request_exist: ${{ steps.pr_exists.outputs.does_pull_request_exist }}
3030
pr_number: ${{ steps.pr_exists.outputs.pr_number }}
31-
skip_trivy_package: ${{ steps.skip_trivy.outputs.skip_trivy_package }}
31+
# TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
32+
# skip_trivy_package: ${{ steps.skip_trivy.outputs.skip_trivy_package }}
3233
deploy_proxy: ${{ steps.deploy_proxy.outputs.deploy_proxy }}
3334
steps:
3435
- name: "Checkout code"
@@ -68,26 +69,27 @@ jobs:
6869
echo "does_pull_request_exist=false" >> $GITHUB_OUTPUT
6970
echo "pr_number=" >> $GITHUB_OUTPUT
7071
fi
71-
- name: "Determine if Trivy package scan should be skipped"
72-
id: skip_trivy
73-
env:
74-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
75-
PR_NUMBER: ${{ steps.pr_exists.outputs.pr_number }}
76-
run: |
77-
if [[ -z "$PR_NUMBER" ]]; then
78-
echo "No pull request detected; Trivy package scan will run."
79-
echo "skip_trivy_package=false" >> $GITHUB_OUTPUT
80-
exit 0
81-
fi
72+
# TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
73+
# - name: "Determine if Trivy package scan should be skipped"
74+
# id: skip_trivy
75+
# env:
76+
# GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
77+
# PR_NUMBER: ${{ steps.pr_exists.outputs.pr_number }}
78+
# run: |
79+
# if [[ -z "$PR_NUMBER" ]]; then
80+
# echo "No pull request detected; Trivy package scan will run."
81+
# echo "skip_trivy_package=false" >> $GITHUB_OUTPUT
82+
# exit 0
83+
# fi
8284

83-
labels=$(gh pr view "$PR_NUMBER" --json labels --jq '.labels[].name')
84-
echo "Labels on PR #$PR_NUMBER: $labels"
85+
# labels=$(gh pr view "$PR_NUMBER" --json labels --jq '.labels[].name')
86+
# echo "Labels on PR #$PR_NUMBER: $labels"
8587

86-
if echo "$labels" | grep -Fxq 'skip-trivy-package'; then
87-
echo "skip_trivy_package=true" >> $GITHUB_OUTPUT
88-
else
89-
echo "skip_trivy_package=false" >> $GITHUB_OUTPUT
90-
fi
88+
# if echo "$labels" | grep -Fxq 'skip-trivy-package'; then
89+
# echo "skip_trivy_package=true" >> $GITHUB_OUTPUT
90+
# else
91+
# echo "skip_trivy_package=false" >> $GITHUB_OUTPUT
92+
# fi
9193
- name: "Determine if proxy should be deployed"
9294
id: deploy_proxy
9395
env:
@@ -131,7 +133,8 @@ jobs:
131133
build_epoch: "${{ needs.metadata.outputs.build_epoch }}"
132134
nodejs_version: "${{ needs.metadata.outputs.nodejs_version }}"
133135
python_version: "${{ needs.metadata.outputs.python_version }}"
134-
skip_trivy_package: ${{ needs.metadata.outputs.skip_trivy_package == 'true' }}
136+
# TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
137+
# skip_trivy_package: ${{ needs.metadata.outputs.skip_trivy_package == 'true' }}
135138
terraform_version: "${{ needs.metadata.outputs.terraform_version }}"
136139
version: "${{ needs.metadata.outputs.version }}"
137140
secrets: inherit

‎.github/workflows/stage-1-commit.yaml‎

Lines changed: 39 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -26,10 +26,11 @@ on:
2626
description: "Python version, set by the CI/CD pipeline workflow"
2727
required: true
2828
type: string
29-
skip_trivy_package:
30-
description: "Skip Trivy package scan when true"
31-
type: boolean
32-
default: false
29+
# TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
30+
# skip_trivy_package:
31+
# description: "Skip Trivy package scan when true"
32+
# type: boolean
33+
# default: false
3334
terraform_version:
3435
description: "Terraform version, set by the CI/CD pipeline workflow"
3536
required: true
@@ -155,6 +156,40 @@ jobs:
155156
uses: asdf-vm/actions/setup@1902764435ca0dd2f3388eea723a4f92a4eb8302
156157
- name: "Lint Terraform"
157158
uses: ./.github/actions/lint-terraform
159+
# TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
160+
# trivy-iac:
161+
# name: "Trivy IaC Scan"
162+
# permissions:
163+
# contents: read
164+
# packages: read
165+
# runs-on: ubuntu-latest
166+
# timeout-minutes: 10
167+
# needs: detect-terraform-changes
168+
# if: needs.detect-terraform-changes.outputs.terraform_changed == 'true'
169+
# env:
170+
# NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
171+
# steps:
172+
# - name: "Checkout code"
173+
# uses: actions/checkout@v4
174+
# - name: "Setup ASDF"
175+
# uses: asdf-vm/actions/setup@b7bcd026f18772e44fe1026d729e1611cc435d47
176+
# - name: "Trivy IaC Scan"
177+
# uses: ./.github/actions/trivy-iac
178+
# trivy-package:
179+
# if: ${{ !inputs.skip_trivy_package }}
180+
# name: "Trivy Package Scan"
181+
# permissions:
182+
# contents: read
183+
# packages: read
184+
# runs-on: ubuntu-latest
185+
# timeout-minutes: 10
186+
# steps:
187+
# - name: "Checkout code"
188+
# uses: actions/checkout@v4
189+
# - name: "Setup ASDF"
190+
# uses: asdf-vm/actions/setup@b7bcd026f18772e44fe1026d729e1611cc435d47
191+
# - name: "Trivy Package Scan"
192+
# uses: ./.github/actions/trivy-package
158193
count-lines-of-code:
159194
name: "Count lines of code"
160195
runs-on: ubuntu-latest

‎scripts/terraform/terraform.mk‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -118,9 +118,10 @@ terraform-validate-all: # Validate all Terraform components @Quality
118118
fi; \
119119
done
120120

121-
terraform-sec: # Run Trivy IaC security scanning on Terraform code @Quality
122-
# Example: make terraform-sec
123-
# ./scripts/terraform/trivy-scan.sh --mode iac infrastructure/terraform
121+
# TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
122+
# terraform-sec: # Run Trivy IaC security scanning on Terraform code @Quality
123+
# # Example: make terraform-sec
124+
# # ./scripts/terraform/trivy-scan.sh --mode iac infrastructure/terraform
124125

125126
terraform-docs: # Generate Terraform documentation - optional: component=[specific component, or all if omitted] @Quality
126127
# Example: make terraform-docs component=mycomp
@@ -168,6 +169,6 @@ ${VERBOSE}.SILENT: \
168169
terraform-output \
169170
terraform-plan \
170171
terraform-plan-destroy \
171-
terraform-sec \
172+
# terraform-sec \
172173
terraform-validate \
173174
terraform-validate-all \

0 commit comments

Comments
 (0)