From 9243dce0678ce37ca1ef7c7c1bb97f885547d2f4 Mon Sep 17 00:00:00 2001
From: Maksim Nabokikh <maksim.nabokikh@flant.com>
Date: Thu, 31 Oct 2024 23:31:18 +0100
Subject: [PATCH] Update trivydb cache on the begging of each day (#3821)
Signed-off-by: maksim.nabokikh <max.nabokih@gmail.com>
---
.github/workflows/artifacts.yaml | 2 +-
.github/workflows/trivydb-cache.yaml | 39 ++++++++++++++++++++++++++++
2 files changed, 40 insertions(+), 1 deletion(-)
create mode 100644 .github/workflows/trivydb-cache.yaml
diff --git a/.github/workflows/artifacts.yaml b/.github/workflows/artifacts.yaml
index 54e96445..6cc5c39b 100644
--- a/.github/workflows/artifacts.yaml
+++ b/.github/workflows/artifacts.yaml
@@ -199,7 +199,7 @@ jobs:
run: echo "date=$(date +%Y-%m-%d)" >> $GITHUB_OUTPUT
- name: Restore trivy cache
- uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # 4.1.2
+ uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
with:
path: cache/db
key: trivy-cache-${{ steps.date.outputs.date }}
diff --git a/.github/workflows/trivydb-cache.yaml b/.github/workflows/trivydb-cache.yaml
new file mode 100644
index 00000000..e99b4170
--- /dev/null
+++ b/.github/workflows/trivydb-cache.yaml
@@ -0,0 +1,39 @@
+# Note: This workflow only updates the cache. You should create a separate workflow for your actual Trivy scans.
+# In your scan workflow, set TRIVY_SKIP_DB_UPDATE=true and TRIVY_SKIP_JAVA_DB_UPDATE=true.
+name: Update Trivy Cache
+
+on:
+ schedule:
+ - cron: '0 0 * * *' # Run daily at midnight UTC
+ workflow_dispatch: # Allow manual triggering
+
+jobs:
+ update-trivy-db:
+ runs-on: ubuntu-latest
+ steps:
+ - name: Setup oras
+ uses: oras-project/setup-oras@9c92598691bfef1424de2f8fae81941568f5889c # v1.2.1
+
+ - name: Get current date
+ id: date
+ run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
+
+ - name: Download and extract the vulnerability DB
+ run: |
+ mkdir -p $GITHUB_WORKSPACE/.cache/trivy/db
+ oras pull ghcr.io/aquasecurity/trivy-db:2
+ tar -xzf db.tar.gz -C $GITHUB_WORKSPACE/.cache/trivy/db
+ rm db.tar.gz
+
+ - name: Download and extract the Java DB
+ run: |
+ mkdir -p $GITHUB_WORKSPACE/.cache/trivy/java-db
+ oras pull ghcr.io/aquasecurity/trivy-java-db:1
+ tar -xzf javadb.tar.gz -C $GITHUB_WORKSPACE/.cache/trivy/java-db
+ rm javadb.tar.gz
+
+ - name: Cache DBs
+ uses: actions/cache/save@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
+ with:
+ path: ${{ github.workspace }}/.cache/trivy
+ key: cache-trivy-${{ steps.date.outputs.date }}
--
GitLab