From 1720ebb66515aa4e29e64b3c3ad8ed57f2ef4025 Mon Sep 17 00:00:00 2001 From: Knut Ahlers Date: Sun, 11 Jun 2023 15:27:59 +0200 Subject: [PATCH] Configure and utilize trivy scan also fix detected issue with Dockerfile Signed-off-by: Knut Ahlers --- .github/workflows/test-and-build.yml | 4 ++++ Dockerfile | 2 ++ Dockerfile.minimal | 2 ++ Makefile | 15 ++++++++++++++- 4 files changed, 22 insertions(+), 1 deletion(-) diff --git a/.github/workflows/test-and-build.yml b/.github/workflows/test-and-build.yml index 596eff5..130977e 100644 --- a/.github/workflows/test-and-build.yml +++ b/.github/workflows/test-and-build.yml @@ -40,6 +40,7 @@ jobs: nodejs-lts-hydrogen \ npm \ tar \ + trivy \ unzip \ which \ zip @@ -53,6 +54,9 @@ jobs: run: | go test -v ./... + - name: Execute Trivy scan + run: make trivy + - name: Build release run: make publish env: diff --git a/Dockerfile b/Dockerfile index fda31d6..27a9c83 100644 --- a/Dockerfile +++ b/Dockerfile @@ -34,6 +34,8 @@ COPY --from=builder /go/bin/ots /usr/local/bin/ots EXPOSE 3000 +USER 1000:1000 + ENTRYPOINT ["/usr/local/bin/ots"] CMD ["--"] diff --git a/Dockerfile.minimal b/Dockerfile.minimal index 14b2d42..301f0b9 100644 --- a/Dockerfile.minimal +++ b/Dockerfile.minimal @@ -30,6 +30,8 @@ COPY --from=builder /go/bin/ots /usr/local/bin/ots EXPOSE 3000 +USER 1000:1000 + ENTRYPOINT ["/usr/local/bin/ots"] CMD ["--"] diff --git a/Makefile b/Makefile index aca2244..144d18c 100644 --- a/Makefile +++ b/Makefile @@ -1,4 +1,4 @@ -VER_FONTAWESOME=6.4.0 +VER_FONTAWESOME:=6.4.0 default: generate download_libs @@ -33,3 +33,16 @@ download_libs: fontawesome fontawesome: curl -sSfL https://github.com/FortAwesome/Font-Awesome/archive/$(VER_FONTAWESOME).tar.gz | \ tar -vC frontend -xz --strip-components=1 --wildcards --exclude='*/js-packages' '*/css' '*/webfonts' + +# -- Vulnerability scanning -- + +trivy: + trivy fs . \ + --dependency-tree \ + --exit-code 1 \ + --format table \ + --ignore-unfixed \ + --quiet \ + --scanners config,license,secret,vuln \ + --severity HIGH,CRITICAL \ + --skip-dirs docs