From f3529307ac59b01825c567cf59f5300c86d1cc36 Mon Sep 17 00:00:00 2001 From: Michael Povel Date: Thu, 13 Aug 2026 06:47:10 +0000 Subject: [PATCH 1/6] Added skip parameter --- .github/workflows/check-trivy.yaml | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/.github/workflows/check-trivy.yaml b/.github/workflows/check-trivy.yaml index 497f3f7..4712c4d 100644 --- a/.github/workflows/check-trivy.yaml +++ b/.github/workflows/check-trivy.yaml @@ -42,6 +42,16 @@ on: required: false default: 'image' type: string + skip_dirs: + description: 'comma separated list of directories where traversal is skipped' + required: false + default: '' + type: string + skip_files: + description: 'comma separated list of files to be skipped' + required: false + default: '' + type: string jobs: trivy_scan: @@ -63,7 +73,7 @@ jobs: uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3 - name: Run Trivy vulnerability scanner on image or filesystem - uses: aquasecurity/trivy-action@84384bd6e777ef152729993b8145ea352e9dd3ef #v0.17.0 + uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 with: scan-type: ${{ inputs.scan_type }} image-ref: ${{ steps.image_ref_lower.outputs.output }} # if scan is for image, will be ignored for filesystem scan @@ -75,6 +85,8 @@ jobs: ignore-unfixed: ${{ inputs.ignore-unfixed }} limit-severities-for-sarif: ${{ inputs.limit-severities-for-sarif }} trivyignores: ${{ inputs.trivyignores }} + skip-dirs: ${{ inputs.skip_dirs }} + skip-files: ${{ inputs.skip_files }} env: TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db From 5a8c2c562fe8930133ca98404a145a509b77f30d Mon Sep 17 00:00:00 2001 From: Michael Povel Date: Thu, 13 Aug 2026 06:49:54 +0000 Subject: [PATCH 2/6] Support Skip parameter --- .github/workflows/image-publish-trivy.yaml | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/.github/workflows/image-publish-trivy.yaml b/.github/workflows/image-publish-trivy.yaml index 039e73d..5ae3d79 100644 --- a/.github/workflows/image-publish-trivy.yaml +++ b/.github/workflows/image-publish-trivy.yaml @@ -100,6 +100,16 @@ on: required: false default: checkout type: string + skip_dirs: + description: 'comma separated list of directories where traversal is skipped' + required: false + default: '' + type: string + skip_files: + description: 'comma separated list of files to be skipped' + required: false + default: '' + type: string secrets: DOCKER_USERNAME: required: false @@ -231,7 +241,7 @@ jobs: permissions: packages: read security-events: write - uses: dBildungsplattform/dbp-github-workflows/.github/workflows/check-trivy.yaml@8 + uses: dBildungsplattform/dbp-github-workflows/.github/workflows/check-trivy.yaml@OPS-11677_CronToolsAuto with: image_ref: ${{ needs.pre_scan.outputs.registry_and_owner }}/${{ inputs.image_name }}@${{ needs.build_and_upload_image.outputs.digest }} severity: ${{ inputs.trivy_severity }} @@ -239,6 +249,8 @@ jobs: ignore-unfixed: ${{ inputs.ignore-unfixed }} report_location: ${{ inputs.report_location }} limit-severities-for-sarif: ${{ inputs.limit-severities-for-sarif }} + skip_dirs: ${{ inputs.skip_dirs }} + skip_files: ${{ inputs.skip_files }} clamav_scan: name: ClamAV scan of uploaded image From d193a4efef52062babadb33926c36e3683a22d43 Mon Sep 17 00:00:00 2001 From: Michael Povel Date: Thu, 13 Aug 2026 07:32:14 +0000 Subject: [PATCH 3/6] Update CodeQL --- .github/workflows/check-trivy.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/check-trivy.yaml b/.github/workflows/check-trivy.yaml index 4712c4d..31a1a66 100644 --- a/.github/workflows/check-trivy.yaml +++ b/.github/workflows/check-trivy.yaml @@ -99,7 +99,7 @@ jobs: - name: Upload Trivy scan results to GitHub Security tab if: ${{ always() }} - uses: github/codeql-action/upload-sarif@02c5e83432fe5497fd85b873b6c9f16a8578e1d9 #v3.37.0 + uses: github/codeql-action/init@fe4161a26a8629af62121b670040955b330f9af2 #v4.31.6 with: sarif_file: 'trivy-results.sarif' category: 'trivy-${{ inputs.scan_type }}-scan' From 5a7706c955dccbb7ec3c8410502954c6fb328cba Mon Sep 17 00:00:00 2001 From: Michael Povel Date: Thu, 13 Aug 2026 09:38:47 +0000 Subject: [PATCH 4/6] Fix Sarif Upload action --- .github/workflows/check-trivy.yaml | 2 +- .github/workflows/image-publish-trivy.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/check-trivy.yaml b/.github/workflows/check-trivy.yaml index 31a1a66..3eb08bb 100644 --- a/.github/workflows/check-trivy.yaml +++ b/.github/workflows/check-trivy.yaml @@ -99,7 +99,7 @@ jobs: - name: Upload Trivy scan results to GitHub Security tab if: ${{ always() }} - uses: github/codeql-action/init@fe4161a26a8629af62121b670040955b330f9af2 #v4.31.6 + uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6 with: sarif_file: 'trivy-results.sarif' category: 'trivy-${{ inputs.scan_type }}-scan' diff --git a/.github/workflows/image-publish-trivy.yaml b/.github/workflows/image-publish-trivy.yaml index 5ae3d79..ed61870 100644 --- a/.github/workflows/image-publish-trivy.yaml +++ b/.github/workflows/image-publish-trivy.yaml @@ -241,7 +241,7 @@ jobs: permissions: packages: read security-events: write - uses: dBildungsplattform/dbp-github-workflows/.github/workflows/check-trivy.yaml@OPS-11677_CronToolsAuto + uses: dBildungsplattform/dbp-github-workflows/.github/workflows/check-trivy.yaml@OPS-11677_CronToolsAuto # To be changed to @8 --- IGNORE --- with: image_ref: ${{ needs.pre_scan.outputs.registry_and_owner }}/${{ inputs.image_name }}@${{ needs.build_and_upload_image.outputs.digest }} severity: ${{ inputs.trivy_severity }} From 7d412267b4a7e52870c6d017f44d08b577a80438 Mon Sep 17 00:00:00 2001 From: Michael Povel Date: Thu, 13 Aug 2026 11:37:37 +0000 Subject: [PATCH 5/6] Removed trailing white space --- .github/workflows/check-trivy.yaml | 2 +- .github/workflows/image-publish-trivy.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/check-trivy.yaml b/.github/workflows/check-trivy.yaml index 3eb08bb..c030994 100644 --- a/.github/workflows/check-trivy.yaml +++ b/.github/workflows/check-trivy.yaml @@ -45,7 +45,7 @@ on: skip_dirs: description: 'comma separated list of directories where traversal is skipped' required: false - default: '' + default: '' type: string skip_files: description: 'comma separated list of files to be skipped' diff --git a/.github/workflows/image-publish-trivy.yaml b/.github/workflows/image-publish-trivy.yaml index ed61870..3a12be9 100644 --- a/.github/workflows/image-publish-trivy.yaml +++ b/.github/workflows/image-publish-trivy.yaml @@ -103,7 +103,7 @@ on: skip_dirs: description: 'comma separated list of directories where traversal is skipped' required: false - default: '' + default: '' type: string skip_files: description: 'comma separated list of files to be skipped' From 85fdb135dc7dff80e3e485886bbaf7be4b4e64fd Mon Sep 17 00:00:00 2001 From: Michael Povel Date: Thu, 13 Aug 2026 11:39:22 +0000 Subject: [PATCH 6/6] Missed line with trailing white spaces --- .github/workflows/image-publish-trivy.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/image-publish-trivy.yaml b/.github/workflows/image-publish-trivy.yaml index 3a12be9..96c09ed 100644 --- a/.github/workflows/image-publish-trivy.yaml +++ b/.github/workflows/image-publish-trivy.yaml @@ -250,7 +250,7 @@ jobs: report_location: ${{ inputs.report_location }} limit-severities-for-sarif: ${{ inputs.limit-severities-for-sarif }} skip_dirs: ${{ inputs.skip_dirs }} - skip_files: ${{ inputs.skip_files }} + skip_files: ${{ inputs.skip_files }} clamav_scan: name: ClamAV scan of uploaded image