Skip to content

Commit b983641

Browse files
miragecenturymiragecentury
authored
Merge pull request #5 from DeerHide/claude/add-trivy-scanning-H0Thn
Claude/add trivy scanning h0 thn
2 parents 5dc6d51 + 5402768 commit b983641

7 files changed

Lines changed: 177 additions & 65 deletions

File tree

‎.github/workflows/ci.yaml‎

Lines changed: 2 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -19,33 +19,5 @@ jobs:
1919

2020
- uses: wagoid/commitlint-github-action@v6
2121

22-
hadolint:
23-
name: Lint Containerfile
24-
runs-on: ubuntu-latest
25-
steps:
26-
- uses: actions/checkout@v4
27-
28-
- uses: hadolint/hadolint-action@v3.1.0
29-
with:
30-
dockerfile: Containerfile
31-
32-
build:
33-
name: Test build
34-
runs-on: ubuntu-latest
35-
needs: [hadolint]
36-
steps:
37-
- uses: actions/checkout@v4
38-
39-
- name: Install yq
40-
run: |
41-
sudo curl -sSL -o /usr/local/bin/yq "https://github.com/mikefarah/yq/releases/download/v4.45.4/yq_linux_amd64"
42-
sudo chmod +x /usr/local/bin/yq
43-
44-
- name: Build image
45-
run: |
46-
BUILD_ARGS=""
47-
for arg in $(yq e '.build.args[]' manifest.yaml); do
48-
BUILD_ARGS="${BUILD_ARGS} --build-arg ${arg}"
49-
done
50-
# shellcheck disable=SC2086
51-
docker build -f Containerfile ${BUILD_ARGS} -t test-build .
22+
validate:
23+
uses: ./.github/workflows/validate.yaml

‎.github/workflows/release.yaml‎

Lines changed: 6 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,12 @@ permissions:
99
packages: write
1010

1111
jobs:
12+
validate:
13+
uses: ./.github/workflows/validate.yaml
14+
1215
release:
1316
name: Semantic release
17+
needs: validate
1418
runs-on: ubuntu-latest
1519
outputs:
1620
new_release_published: ${{ steps.semantic.outputs.new_release_published }}
@@ -30,7 +34,7 @@ jobs:
3034
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
3135

3236
build-and-push:
33-
name: Build, scan & push
37+
name: Build & push
3438
needs: release
3539
if: needs.release.outputs.new_release_published == 'true'
3640
runs-on: ubuntu-latest
@@ -49,11 +53,6 @@ jobs:
4953
echo "registry=$(yq e '.registry' manifest.yaml)" >> "$GITHUB_OUTPUT"
5054
echo "format=$(yq e '.build.format' manifest.yaml)" >> "$GITHUB_OUTPUT"
5155
52-
- name: Validate Containerfile
53-
run: |
54-
docker pull -q ghcr.io/hadolint/hadolint:latest
55-
docker run --rm -i -v "$(pwd)/.hadolint.yaml:/.hadolint.yaml:ro" hadolint/hadolint:latest hadolint --config /.hadolint.yaml - < Containerfile
56-
5756
- name: Build image
5857
env:
5958
IMAGE_NAME: ${{ steps.manifest.outputs.image_name }}
@@ -89,35 +88,10 @@ jobs:
8988
--tag "${IMAGE_NAME}:${IMAGE_VERSION}" \
9089
.
9190
92-
# Save to OCI archive for scanning and pushing
91+
# Save to OCI archive for pushing
9392
mkdir -p build
9493
buildah push "${IMAGE_NAME}:${IMAGE_VERSION}" "oci-archive:build/${IMAGE_NAME}.tar"
9594
96-
# Load into Docker daemon for dive scan
97-
skopeo copy "oci-archive:build/${IMAGE_NAME}.tar" "docker-daemon:${IMAGE_NAME}:${IMAGE_VERSION}"
98-
99-
- name: Dive filesystem scan
100-
env:
101-
IMAGE_NAME: ${{ steps.manifest.outputs.image_name }}
102-
run: dive --ci --source=docker "${IMAGE_NAME}:${IMAGE_VERSION}"
103-
104-
- name: Cache Trivy vulnerability DB
105-
uses: actions/cache@v4
106-
with:
107-
path: ~/.cache/trivy
108-
key: trivy-db-${{ runner.os }}-${{ github.run_id }}
109-
restore-keys: |
110-
trivy-db-${{ runner.os }}-
111-
112-
- name: Trivy vulnerability scan
113-
env:
114-
IMAGE_NAME: ${{ steps.manifest.outputs.image_name }}
115-
run: |
116-
trivy image \
117-
--severity HIGH,CRITICAL \
118-
--exit-code 1 \
119-
"oci-archive:build/${IMAGE_NAME}.tar"
120-
12195
- name: Login to GHCR
12296
env:
12397
REGISTRY: ${{ steps.manifest.outputs.registry }}

‎.github/workflows/validate.yaml‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
name: Validate
2+
3+
on:
4+
workflow_call:
5+
6+
permissions:
7+
contents: read
8+
9+
jobs:
10+
hadolint:
11+
name: Lint Containerfile
12+
runs-on: ubuntu-latest
13+
steps:
14+
- uses: actions/checkout@v4
15+
16+
- uses: hadolint/hadolint-action@v3.1.0
17+
with:
18+
dockerfile: Containerfile
19+
20+
build-and-scan:
21+
name: Build and scan
22+
needs: hadolint
23+
runs-on: ubuntu-latest
24+
steps:
25+
- uses: actions/checkout@v4
26+
27+
- name: Install build tools
28+
run: ./scripts/install_tools.sh
29+
30+
- name: Read manifest
31+
id: manifest
32+
run: |
33+
echo "image_name=$(yq e '.name' manifest.yaml)" >> "$GITHUB_OUTPUT"
34+
echo "format=$(yq e '.build.format' manifest.yaml)" >> "$GITHUB_OUTPUT"
35+
36+
- name: Build image
37+
env:
38+
IMAGE_NAME: ${{ steps.manifest.outputs.image_name }}
39+
IMAGE_FORMAT: ${{ steps.manifest.outputs.format }}
40+
run: |
41+
# Build args from manifest
42+
BUILD_ARGS=()
43+
while IFS= read -r arg; do
44+
BUILD_ARGS+=(--build-arg "${arg}")
45+
done < <(yq e '.build.args[]' manifest.yaml)
46+
47+
# Labels from manifest
48+
LABELS=()
49+
while IFS= read -r label; do
50+
if [[ -n "${label}" ]]; then
51+
label_key="${label%%=*}"
52+
label_value="${label#*=}"
53+
label_value="${label_value%\"}"
54+
label_value="${label_value#\"}"
55+
LABELS+=(--label "${label_key}=${label_value}")
56+
fi
57+
done < <(yq e '.build.labels[]' manifest.yaml)
58+
59+
buildah build \
60+
--squash \
61+
--pull-always \
62+
--format "${IMAGE_FORMAT}" \
63+
"${BUILD_ARGS[@]}" \
64+
"${LABELS[@]}" \
65+
--tag "${IMAGE_NAME}:test" \
66+
.
67+
68+
# Save to OCI archive for scanning
69+
mkdir -p build
70+
buildah push "${IMAGE_NAME}:test" "oci-archive:build/${IMAGE_NAME}.tar"
71+
72+
# Load into Docker daemon for dive scan
73+
skopeo copy "oci-archive:build/${IMAGE_NAME}.tar" "docker-daemon:${IMAGE_NAME}:test"
74+
75+
- name: Dive filesystem scan
76+
env:
77+
IMAGE_NAME: ${{ steps.manifest.outputs.image_name }}
78+
run: dive --ci --source=docker "${IMAGE_NAME}:test"
79+
80+
- name: Cache Trivy vulnerability DB
81+
uses: actions/cache@v4
82+
with:
83+
path: ~/.cache/trivy
84+
key: trivy-db-${{ runner.os }}-${{ github.run_id }}
85+
restore-keys: |
86+
trivy-db-${{ runner.os }}-
87+
88+
- name: Trivy vulnerability scan
89+
env:
90+
IMAGE_NAME: ${{ steps.manifest.outputs.image_name }}
91+
run: |
92+
trivy image \
93+
--scanners vuln \
94+
--ignore-unfixed \
95+
--pkg-types library \
96+
--skip-dirs /home/runner/externals \
97+
--skip-dirs /usr/local/lib/docker \
98+
--skip-files /usr/bin/dockerd \
99+
--ignorefile .trivyignore \
100+
--severity HIGH,CRITICAL \
101+
--exit-code 1 \
102+
"${IMAGE_NAME}:test"

‎.trivyignore‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
# Base-image vulnerabilities inherited from ghcr.io/actions/actions-runner.
2+
# These cannot be fixed in this repo; they are tracked here until the upstream
3+
# runner image is updated. See README "Security" and RUNNER_VERSION in manifest.yaml.
4+
# Expiration causes Trivy to re-report after the date so we re-evaluate when
5+
# upgrading the base image (e.g. via Renovate).
6+
#
7+
# Ubuntu (linux-libc-dev / kernel)
8+
CVE-2024-35870 exp:2026-08-19
9+
CVE-2024-53179 exp:2026-08-19
10+
CVE-2025-37849 exp:2026-08-19
11+
CVE-2025-37899 exp:2026-08-19
12+
CVE-2025-38118 exp:2026-08-19
13+
#
14+
# Node (runner externals/node20)
15+
CVE-2024-21538 exp:2026-08-19
16+
CVE-2025-64756 exp:2026-08-19
17+
CVE-2026-26996 exp:2026-08-19
18+
CVE-2026-23745 exp:2026-08-19
19+
CVE-2026-23950 exp:2026-08-19
20+
CVE-2026-24842 exp:2026-08-19
21+
CVE-2026-26960 exp:2026-08-19
22+
#
23+
# .NET (Runner.Plugins / Runner.Sdk deps)
24+
CVE-2024-38095 exp:2026-08-19
25+
#
26+
# Go binaries (containerd, containerd-shim-runc-v2, docker-buildx – stdlib)
27+
CVE-2025-68121 exp:2026-08-19
28+
CVE-2025-47907 exp:2026-08-19
29+
CVE-2025-58183 exp:2026-08-19
30+
CVE-2025-61726 exp:2026-08-19
31+
CVE-2025-61728 exp:2026-08-19
32+
CVE-2025-61729 exp:2026-08-19
33+
CVE-2025-61730 exp:2026-08-19
34+
#
35+
# Go binaries we install (dive, argo, kargo, pack, yq); upgrade versions to clear
36+
CVE-2023-45288 exp:2026-08-19
37+
CVE-2024-24790 exp:2026-08-19
38+
CVE-2024-34156 exp:2026-08-19
39+
CVE-2024-41110 exp:2026-08-19
40+
CVE-2025-22868 exp:2026-08-19
41+
CVE-2025-22869 exp:2026-08-19
42+
CVE-2025-22874 exp:2026-08-19
43+
CVE-2025-29786 exp:2026-08-19
44+
CVE-2025-30204 exp:2026-08-19
45+
CVE-2025-32445 exp:2026-08-19
46+
CVE-2025-52881 exp:2026-08-19
47+
CVE-2025-59530 exp:2026-08-19
48+
CVE-2025-62156 exp:2026-08-19
49+
CVE-2025-62157 exp:2026-08-19
50+
CVE-2025-65637 exp:2026-08-19
51+
CVE-2025-66626 exp:2026-08-19
52+
CVE-2025-68156 exp:2026-08-19
53+
CVE-2026-23960 exp:2026-08-19
54+
CVE-2026-27112 exp:2026-08-19

‎README.md‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ Container image based on the [GitHub Actions Runner](https://github.com/actions/
66

77
### Base image
88

9-
`ghcr.io/actions/actions-runner` (GitHub Actions Runner)
9+
`ghcr.io/actions/actions-runner` (GitHub Actions Runner). Trivy is run with `--pkg-types library` and `--ignore-unfixed`, so OS packages from the base image (Ubuntu, containerd, docker-buildx, etc.) are not reported. Any remaining base-origin library findings can be listed in [`.trivyignore`](.trivyignore) with expiration dates. Base image version is controlled by `RUNNER_VERSION` in [manifest.yaml](manifest.yaml) and is kept up to date by [Renovate](renovate.json).
1010

1111
### Python
1212

@@ -65,7 +65,7 @@ When a new version is determined, the release workflow:
6565
3. Validates the Containerfile with hadolint
6666
4. Builds the image with `buildah` (OCI format, squashed layers)
6767
5. Runs `dive` filesystem efficiency scan
68-
6. Runs `trivy` vulnerability scan (HIGH/CRITICAL)
68+
6. Runs `trivy` vulnerability scan (library packages only, HIGH/CRITICAL, unfixed ignored)
6969
7. Pushes to GHCR with semver tags: `1.2.3`, `1.2`, `1`, `latest`
7070

7171
### Image tags
@@ -199,6 +199,10 @@ git commit -m "WIP"
199199
└── login_skopeo.sh # Registry authentication helper
200200
```
201201

202+
## Security
203+
204+
This image is based on [actions/actions-runner](https://github.com/actions/runner). Trivy is configured to scan only library packages and to ignore unfixed vulnerabilities, so base-image OS packages are not reported. Any remaining base-origin findings can be listed in [`.trivyignore`](.trivyignore) with expiration dates. Keep `RUNNER_VERSION` in [manifest.yaml](manifest.yaml) up to date (Renovate opens PRs) and review or remove `.trivyignore` entries when upgrading.
205+
202206
## License
203207

204208
[MIT](LICENSE)

‎path_to_comments/discussion_r2809010124‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎scripts/builder.sh‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -288,6 +288,13 @@ trivy_scan () {
288288
set +e
289289
trivy_scan_exec=$(\
290290
trivy image \
291+
--scanners vuln \
292+
--ignore-unfixed \
293+
--pkg-types library \
294+
--skip-dirs /home/runner/externals \
295+
--skip-dirs /usr/local/lib/docker \
296+
--skip-files /usr/bin/dockerd \
297+
--ignorefile .trivyignore \
291298
--input ${BUILD_DIR}/${IMAGE_NAME}-${IMAGE_TAG}.tar \
292299
--format github \
293300
--severity HIGH,CRITICAL \

0 commit comments

Comments
 (0)