Ci/trivy json reports - #361
Draft
karannathamd wants to merge 4 commits into
Draft
Conversation
Add JSON-format Trivy scan reports alongside existing SARIF output in both CI and nightly workflows. The JSON reports match the format expected by the internal security pipeline (Jira PSIRT, MongoDB cve_uber, Minio archival). Each scan produces: - Trivy JSON vulnerability report (vuln + misconfig + secret + license) - SPDX SBOM in spdx-json format - scan-manifest.json with vulnerability summary and metadata Reports are uploaded as a `security-scan-reports` artifact with 30-day retention. Existing SARIF → GitHub Security tab flow is unchanged. Co-Authored-By: Claude Opus 4 (1M context) <noreply@anthropic.com>
Trivy does not create parent directories for its output file. Add mkdir -p before the JSON scan step in both CI and nightly workflows. Co-Authored-By: Claude Opus 4 (1M context) <noreply@anthropic.com>
karannathamd
requested review from
powderluv,
sajmera-pensando,
sgopinath1,
shiv-tyagi and
yansun1996
as code owners
June 29, 2026 08:56
Match the Trivy version used on Jenkins (trivy-artifact-scan-archive) to ensure identical JSON report format across both scan paths. Co-Authored-By: Claude Opus 4 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Adds additional Trivy security outputs (JSON report + SPDX SBOM + a small manifest) to CI and nightly workflows so internal integrations can consume scan artifacts, while keeping existing SARIF upload behavior.
Changes:
- Extend Trivy image scans to also produce JSON reports and SPDX SBOMs and upload them as workflow artifacts.
- Add a generated
scan-manifest.jsonsummarizing the scan and embedding CI metadata. - Gate the nightly Trivy rescan job on the
buildjob outputs (skipflag).
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.
| File | Description |
|---|---|
| .github/workflows/nightly.yml | Gate nightly Trivy job on build outputs; generate/upload JSON + SBOM + manifest artifacts. |
| .github/workflows/ci.yml | Generate/upload JSON + SBOM + manifest artifacts alongside SARIF upload. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+317
to
+321
|
|
||
| manifest = { | ||
| "scan_id": f"{os.environ.get('GITHUB_RUN_ID', 'unknown')}-{datetime.now(timezone.utc).strftime('%Y%m%d%H%M%S')}", | ||
| "generated_at": datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ"), | ||
| "ci": { |
Comment on lines
+286
to
+290
|
|
||
| manifest = { | ||
| "scan_id": f"{os.environ.get('GITHUB_RUN_ID', 'unknown')}-{datetime.now(timezone.utc).strftime('%Y%m%d%H%M%S')}", | ||
| "generated_at": datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ"), | ||
| "ci": { |
| "successful": 1 if scan_status == "success" else 0, | ||
| "failed": 0 if scan_status == "success" else 1, | ||
| "sbom_generated": 1 if os.path.isfile(os.path.join(reports_dir, sbom_file)) else 0, | ||
| "total_vulnerabilities": vuln_summary, |
| "successful": 1 if scan_status == "success" else 0, | ||
| "failed": 0 if scan_status == "success" else 1, | ||
| "sbom_generated": 1 if os.path.isfile(os.path.join(reports_dir, sbom_file)) else 0, | ||
| "total_vulnerabilities": vuln_summary, |
Comment on lines
+298
to
+302
| "release": { | ||
| "repo_name": "spur", | ||
| "branch": "main", | ||
| "release_tag": release_tag, | ||
| }, |
shiv-tyagi
marked this pull request as draft
June 29, 2026 10:07
Member
Integrate GitHub Advanced Security with Jira | Atlassian Support Given that, I believe we are quite covered on Spur side with cargo-deny, dependabot and trivy. Also about JIRA, my personal opinion is that security issues are always P0 issues. We should aggressively fix them. We do not need time tracking for those, rather we need to ship fixes the fastest. Any open alert is equally urgent. So if time tracking on JIRA is the only reason for us to get into all this hassle, I would avoid it. |
Add workflow that syncs GitHub Code Scanning alerts (Trivy SARIF) to Jira PSIRT project using github/ghas-jira-integration. Triggers after CI completion and on a daily schedule. Creates/updates/closes Jira issues to match alert state. Requires JIRA_USER and JIRA_TOKEN secrets to be configured. Co-Authored-By: Claude Opus 4 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
DO NOT MERGE. WIP