Skip to content

Commit ec4d9cc

Browse files
pau-hedgehogpau-hedgehog
committed
ci: fix trivy scans
Signed-off-by: Pau Capdevila <pau@githedgehog.com>
1 parent 45720b6 commit ec4d9cc

6 files changed

Lines changed: 40 additions & 11 deletions

File tree

‎hack/README_Trivy_Scans.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
|------|---------|
77
| `hack/vlab-trivy-runner.sh` | Main orchestration script |
88
| `hack/sarif-consolidator.sh` | SARIF processing and deduplication |
9+
| `hack/trivy-version.sh` | Centralized Trivy version (override with `TRIVY_VERSION` env var) |
910
| `hack/trivy-setup.sh` | Online mode setup (control-1) |
1011
| `hack/trivy-setup-airgapped.sh` | Airgapped mode setup (gateway-1) |
1112
| `hack/trivy-setup-sonic-airgapped.sh` | SONiC switch setup |

‎hack/trivy-setup-airgapped.sh‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,14 @@
77

88
set -e
99

10+
# Source centralized version configuration
11+
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
12+
source "${SCRIPT_DIR}/trivy-version.sh"
13+
1014
GREEN='\033[0;32m'
1115
YELLOW='\033[1;33m'
1216
RED='\033[0;31m'
1317
NC='\033[0m' # No Color
14-
15-
TRIVY_VERSION="0.65.0"
1618
HOST_DOWNLOAD_DIR="/tmp/trivy-airgapped-$(date +%s)"
1719
SHOW_USAGE=false
1820

@@ -130,6 +132,8 @@ CACHE_DIR="${TRIVY_DIR}/cache"
130132
TIMESTAMP=$(date +"%Y%m%d-%H%M%S")
131133
CONTAINERD_ADDRESS="/run/k3s/containerd/containerd.sock"
132134
TEMP_DIR="/tmp/trivy-export-$"
135+
# Get installed Trivy version for SARIF reports
136+
TRIVY_INSTALLED_VERSION=$(sudo ${TRIVY_DIR}/trivy --version 2>/dev/null | head -1 | awk '{print $2}' || echo "unknown")
133137
134138
# Ensure directories exist
135139
mkdir -p ${REPORTS_DIR}
@@ -226,7 +230,7 @@ scan_image_directly() {
226230
echo "✓ SARIF report saved"
227231
else
228232
echo "WARNING: SARIF vulnerability scan failed for $image"
229-
echo "{\"$schema\":\"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json\",\"version\":\"2.1.0\",\"runs\":[{\"tool\":{\"driver\":{\"name\":\"Trivy\",\"informationUri\":\"https://github.com/aquasecurity/trivy\",\"rules\":[],\"version\":\"0.65.0\"}},\"results\":[]}]}" > "${output_base}_critical.sarif"
233+
echo "{\"\$schema\":\"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json\",\"version\":\"2.1.0\",\"runs\":[{\"tool\":{\"driver\":{\"name\":\"Trivy\",\"informationUri\":\"https://github.com/aquasecurity/trivy\",\"rules\":[],\"version\":\"${TRIVY_INSTALLED_VERSION}\"}},\"results\":[]}]}" > "${output_base}_critical.sarif"
230234
fi
231235
232236
echo "Reports saved to:"
@@ -281,7 +285,7 @@ scan_image_tarball() {
281285
echo "✓ SARIF report saved"
282286
else
283287
echo "WARNING: SARIF vulnerability scan failed for $image"
284-
echo "{\"$schema\":\"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json\",\"version\":\"2.1.0\",\"runs\":[{\"tool\":{\"driver\":{\"name\":\"Trivy\",\"informationUri\":\"https://github.com/aquasecurity/trivy\",\"rules\":[],\"version\":\"0.65.0\"}},\"results\":[]}]}" > "${output_base}_critical.sarif"
288+
echo "{\"\$schema\":\"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json\",\"version\":\"2.1.0\",\"runs\":[{\"tool\":{\"driver\":{\"name\":\"Trivy\",\"informationUri\":\"https://github.com/aquasecurity/trivy\",\"rules\":[],\"version\":\"${TRIVY_INSTALLED_VERSION}\"}},\"results\":[]}]}" > "${output_base}_critical.sarif"
285289
fi
286290
287291
echo "Reports saved to:"

‎hack/trivy-setup-sonic-airgapped.sh‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,12 +7,14 @@
77

88
set -e
99

10+
# Source centralized version configuration
11+
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
12+
source "${SCRIPT_DIR}/trivy-version.sh"
13+
1014
GREEN='\033[0;32m'
1115
YELLOW='\033[1;33m'
1216
RED='\033[0;31m'
1317
NC='\033[0m' # No Color
14-
15-
TRIVY_VERSION="0.65.0"
1618
HOST_DOWNLOAD_DIR="/tmp/trivy-sonic-airgapped-$(date +%s)"
1719
LEAF_NODE="leaf-01" # Default leaf node name
1820
SHOW_USAGE=false
@@ -139,6 +141,8 @@ TRIVY_DIR="/var/lib/trivy"
139141
REPORTS_DIR="${TRIVY_DIR}/reports"
140142
CACHE_DIR="${TRIVY_DIR}/cache"
141143
TIMESTAMP=$(date +"%Y%m%d-%H%M%S")
144+
# Get installed Trivy version for SARIF reports
145+
TRIVY_INSTALLED_VERSION=$(sudo ${TRIVY_DIR}/trivy --version 2>/dev/null | head -1 | awk '{print $2}' || echo "unknown")
142146
143147
# Ensure directories exist
144148
mkdir -p ${REPORTS_DIR}
@@ -199,7 +203,7 @@ scan_image() {
199203
echo "✓ SARIF report saved"
200204
else
201205
echo "WARNING: SARIF vulnerability scan failed for $image"
202-
echo '{"$schema":"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"Trivy","informationUri":"https://github.com/aquasecurity/trivy","rules":[],"version":"0.65.0"}},"results":[]}]}' > "${output_base}_critical.sarif"
206+
echo '{"$schema":"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"Trivy","informationUri":"https://github.com/aquasecurity/trivy","rules":[],"version":"'"${TRIVY_INSTALLED_VERSION}"'"}},"results":[]}]}' > "${output_base}_critical.sarif"
203207
fi
204208
205209
echo "Reports saved to:"

‎hack/trivy-setup.sh‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,11 @@
77

88
set -e
99

10+
# Use TRIVY_VERSION from environment (set by caller via vlab-trivy-runner.sh)
11+
# This script runs on remote VMs, so it can't source local files
12+
# Default should match hack/trivy-version.sh
13+
TRIVY_VERSION="${TRIVY_VERSION:-0.69.2}"
14+
1015
GREEN='\033[0;32m'
1116
YELLOW='\033[1;33m'
1217
RED='\033[0;31m'
@@ -49,8 +54,8 @@ if ! sudo curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/co
4954
exit 1
5055
fi
5156

52-
echo "Running Trivy installer..."
53-
if ! sudo sh /tmp/trivy-install.sh -b /var/lib/trivy; then
57+
echo "Running Trivy installer (v${TRIVY_VERSION})..."
58+
if ! sudo sh /tmp/trivy-install.sh -b /var/lib/trivy "v${TRIVY_VERSION}"; then
5459
echo -e "${RED}Trivy installation failed${NC}"
5560
echo "Installation script failed. Debug info:"
5661
echo "Installer script contents:"
@@ -134,6 +139,8 @@ REPORTS_DIR="${TRIVY_DIR}/reports"
134139
DOCKER_CONFIG="${TRIVY_DIR}/.docker"
135140
TIMESTAMP=$(date +"%Y%m%d-%H%M%S")
136141
CONTAINERD_ADDRESS="/run/k3s/containerd/containerd.sock"
142+
# Get installed Trivy version for SARIF reports
143+
TRIVY_INSTALLED_VERSION=$(sudo ${TRIVY_DIR}/trivy --version 2>/dev/null | head -1 | awk '{print $2}' || echo "unknown")
137144
138145
mkdir -p ${REPORTS_DIR}
139146
@@ -182,7 +189,7 @@ scan_image() {
182189
echo "✓ SARIF report saved"
183190
else
184191
echo "WARNING: SARIF vulnerability scan failed for $image"
185-
echo "{\"$schema\":\"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json\",\"version\":\"2.1.0\",\"runs\":[{\"tool\":{\"driver\":{\"name\":\"Trivy\",\"informationUri\":\"https://github.com/aquasecurity/trivy\",\"rules\":[],\"version\":\"0.65.0\"}},\"results\":[]}]}" > "${output_base}_critical.sarif"
192+
echo "{\"\$schema\":\"https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json\",\"version\":\"2.1.0\",\"runs\":[{\"tool\":{\"driver\":{\"name\":\"Trivy\",\"informationUri\":\"https://github.com/aquasecurity/trivy\",\"rules\":[],\"version\":\"${TRIVY_INSTALLED_VERSION}\"}},\"results\":[]}]}" > "${output_base}_critical.sarif"
186193
fi
187194
188195
echo "Reports saved to:"

‎hack/trivy-version.sh‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
#!/bin/bash
2+
# Copyright 2025 Hedgehog
3+
# SPDX-License-Identifier: Apache-2.0
4+
5+
# Centralized Trivy version configuration
6+
# Update this single file when bumping Trivy version
7+
# Can be overridden via environment variable: TRIVY_VERSION=x.y.z ./script.sh
8+
9+
export TRIVY_VERSION="${TRIVY_VERSION:-0.69.2}"

‎hack/vlab-trivy-runner.sh‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,10 @@
44

55
set -e
66

7+
# Source centralized version configuration
8+
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
9+
source "${SCRIPT_DIR}/trivy-version.sh"
10+
711
# Parse command line arguments
812
RUN_CONTROL=true
913
RUN_GATEWAY=true
@@ -400,7 +404,7 @@ setup_control_vm() {
400404
fi
401405

402406
echo "Installing Trivy on Control VM (online mode)..."
403-
if ! $HHFAB_BIN vlab ssh -b -n "$CONTROL_VM" -- 'chmod +x /tmp/trivy-setup.sh && sudo /tmp/trivy-setup.sh'; then
407+
if ! $HHFAB_BIN vlab ssh -b -n "$CONTROL_VM" -- "chmod +x /tmp/trivy-setup.sh && sudo TRIVY_VERSION=${TRIVY_VERSION} /tmp/trivy-setup.sh"; then
404408
echo -e "${RED}Failed to setup Trivy on Control VM${NC}"
405409
return 1
406410
fi

0 commit comments

Comments
 (0)