Dockerスキャン（Trivy）

name: FutureVuls Docker Image Scan
on:
  push
defaults:
  run:
      shell: bash
jobs:
  container-scan:
    name: FutureVuls Docker Image Scan
    env:
      FVULS_GROUP_ID: xxx
      FVULS_TOKEN: xxxxxxxxx
      FVULS_AUTH_URL: "https://auth.vuls.biz/one-time-auth"
      DOCKERFILE_PATH: "path/to/dockerfile"
      IMAGE_NAME: "image-name"
      FVULS_SERVER_UUID: xxxxxxxxx
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v1
    - name: cached scan db
      uses: actions/cache@v2
      with:
        path: vulndb/
        key: trivy-vulndb
    - name: Build dockerfile
      run: docker build . -f ${{ env.DOCKERFILE_PATH }} -t ${{ env.IMAGE_NAME }}
    - name: Scan the image and upload to FutureVuls
      uses: docker://vuls/fvuls
      with:
        entrypoint: '/bin/sh'
        args: |-
          -c "\
          set -eo pipefail
          trivy -q --cache-dir vulndb/ image -f json --list-all-pkgs ${{ env.IMAGE_NAME }} | \
          trivy-to-vuls parse --stdin | \
          future-vuls upload --stdin --url ${{ env.FVULS_AUTH_URL }} --group-id ${{ env.FVULS_GROUP_ID }} --token ${{ env.FVULS_TOKEN }} --uuid ${{ env.FVULS_SERVER_UUID }} \
          "          

name: FutureVuls Docker Image Scan
on:
  push
defaults:
  run:
      shell: bash
jobs:
  docker-test:
    name: FutureVuls Docker Image Scan
    env:
      FVULS_GROUP_ID: xxx
      FVULS_TOKEN: "xxxxxxxx"
      FVULS_AUTH_URL: "https://auth.vuls.biz/one-time-auth"
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v1
    - name: cached scan db
      uses: actions/cache@v2
      with:
        path: vulndb/
        key: trivy-vulndb
    - name: install trivy
      run: |
        curl -s https://api.github.com/repos/aquasecurity/trivy/releases/latest | \
        grep "browser_download_url.*_Linux-64bit.tar.gz" | \
        cut -d : -f 2-3 | \
        xargs wget
        tar zxvf trivy_*        
    - name: install trivy-to-vuls
      run: |
        curl -s https://api.github.com/repos/future-architect/vuls/releases/latest | \
        grep "browser_download_url.*trivy-to-vuls.*_linux_amd64.tar.gz" | \
        cut -d : -f 2-3 | \
        xargs wget
        tar zxvf trivy-to-vuls*        
    - name: install future-vuls
      run: |
        curl -s https://api.github.com/repos/future-architect/vuls/releases/latest | \
        grep "browser_download_url.*future-vuls.*_linux_amd64.tar.gz" | \
        cut -d : -f 2-3 | \
        xargs wget
        tar zxvf future-vuls*        
    - name: scan core-rpc-server by trivy
      env: 
        DOCKERFILE_PATH: "docker/anything/Dockerfile"
        IMAGE_NAME: "fvuls/trivy-scan"
        FVULS_SERVER_UUID: "xxxxxxxx"
      run: |
        docker build . -f ${DOCKERFILE_PATH} -t ${IMAGE_NAME}
        set -eo pipefail
        ./trivy -q --cache-dir vulndb/ image -f json --list-all-pkgs ${IMAGE_NAME} | \
        ./trivy-to-vuls parse --stdin | \
        ./future-vuls upload --stdin --url ${FVULS_AUTH_URL} --group-id ${FVULS_GROUP_ID}  --token ${FVULS_TOKEN}  --uuid ${FVULS_SERVER_UUID}