From f6da0366193080696bd2d3e32987f0e1791ddd92 Mon Sep 17 00:00:00 2001 From: dotasek Date: Mon, 7 Oct 2024 13:03:46 -0400 Subject: [PATCH] Workaround for ghcr rate limiting of trivy db downloads (#1770) * Workaround for ghcr rate limiting of trivy db downloads * Use env for settings + bump codeql action * Update checkout action * Better doc --- .github/workflows/trivy.yml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml index e94900bd3..40b850d2d 100644 --- a/.github/workflows/trivy.yml +++ b/.github/workflows/trivy.yml @@ -14,10 +14,14 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout code - uses: actions/checkout@v3 + uses: actions/checkout@v4 - name: Run static analysis uses: aquasecurity/trivy-action@master + env: + # Workaround for rate limiting on ghcr. Use these two entries for ghcr related TOOMANYREQUESTS errors. + TRVIY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db + TRVIY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db with: scan-type: 'fs' vuln-type: 'library' @@ -28,8 +32,10 @@ jobs: severity: 'MEDIUM,HIGH,CRITICAL' + + - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v2 + uses: github/codeql-action/upload-sarif@v3 with: sarif_file: 'trivy-results.sarif' category: 'Trivy-security-scan'