ci: add Trivy security scan to PR pipeline - #1634
Conversation
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughThe pull-request workflow now runs a local Trivy composite action. The action resolves Maven dependencies, scans repository files and Dockerfile base images, reports deduplicated HIGH and CRITICAL findings, and fails when findings exist. ChangesTrivy scanning
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant PullRequestWorkflow
participant TrivyAction
participant Maven
participant Trivy
PullRequestWorkflow->>TrivyAction: Run local scan
TrivyAction->>Maven: Resolve dependencies offline
TrivyAction->>Trivy: Scan files and Dockerfile base images
Trivy-->>TrivyAction: Return vulnerability findings
TrivyAction-->>PullRequestWorkflow: Report findings and fail on HIGH or CRITICAL results
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
.github/workflows/test.yml (1)
49-51: 🩺 Stability & Availability | 🔵 Trivial | 💤 Low valueConsider a job-level timeout.
No
timeout-minutesis set fortrivy_scan.trivy imagepulls a variable number of base images per PR with no explicit timeout on the pull; a stalled registry request could hold the runner for the default GitHub Actions limit. Add atimeout-minutesbound to fail fast instead.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/test.yml around lines 49 - 51, Add a job-level timeout-minutes setting to the trivy_scan job containing the Trivy scan step, using a finite bound that fails stalled image pulls promptly while allowing normal scans to complete..github/steps/trivy/action.yml (1)
70-86: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueReport loses per-module version detail on dedup.
group_by([.s, .ty, .p, .id]) | map(.[0] + {n: length})keeps only the first grouped element'sInstalledVersion/FixedVersion. If the same package and CVE appear with different installed versions across Maven modules, the printed report shows only one version pair and the occurrence count, without indicating which modules use which version. This does not affect the pass/fail gate, but it makes it harder to know which module needs the version bump.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/steps/trivy/action.yml around lines 70 - 86, Update the report-generation jq pipeline in the Trivy reporting block so deduplicated findings retain and display each distinct InstalledVersion/FixedVersion pair, rather than selecting only the first grouped record via `map(.[0] + {n: length})`. Keep the existing uniqueness key and occurrence counts, while including enough per-version detail in each output row to identify which module/version requires the upgrade.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/steps/trivy/action.yml:
- Around line 47-68: Update the base-image loop around the unresolved-variable
case and the trivy image failure branch to emit distinguishable warnings
identifying the skipped image and reason; do not silently continue. Preserve
existing exclusions for aliases and scratch, and consider propagating a nonzero
status from trivy image failures so the security job fails closed rather than
treating an unscanned image as clean.
In @.github/workflows/test.yml:
- Around line 44-47: Update the actions/checkout@v4 step in the Checkout
workflow block to set persist-credentials to false, while preserving the
existing pull request head SHA ref.
---
Nitpick comments:
In @.github/steps/trivy/action.yml:
- Around line 70-86: Update the report-generation jq pipeline in the Trivy
reporting block so deduplicated findings retain and display each distinct
InstalledVersion/FixedVersion pair, rather than selecting only the first grouped
record via `map(.[0] + {n: length})`. Keep the existing uniqueness key and
occurrence counts, while including enough per-version detail in each output row
to identify which module/version requires the upgrade.
In @.github/workflows/test.yml:
- Around line 49-51: Add a job-level timeout-minutes setting to the trivy_scan
job containing the Trivy scan step, using a finite bound that fails stalled
image pulls promptly while allowing normal scans to complete.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 754b8697-97bd-4d0f-871b-3f705e0a441b
📒 Files selected for processing (3)
.github/steps/trivy/action.yml.github/workflows/test.yml.trivyignore
…s for skipped scans
1a8b5cc to
7071174
Compare
…enframe-oss-lib into security/trivy # Conflicts: # .github/steps/trivy/action.yml # .github/workflows/test.yml
1 participant
Adds a Trivy-based PR security gate:
Summary by CodeRabbit
New Features
Documentation
.trivyignore.