Create trivy-all-slack.yml

.github/workflows/trivy-all.yml

@@ -1,15 +1,12 @@
-name: Trivy Analysis (indy_node:latest)
-
 on:
   schedule:
     # run every Wednesday at 23:20
     - cron: '20 23 * * 3'
   workflow_dispatch:
-
-
+​
 jobs:
   workflow_setup:
-    name: Setup variables 
+    name: Setup variables
     runs-on: ubuntu-latest
     outputs:
       repo_owner: ${{ steps.repo_owner.outputs.lowercase }}
@@ -19,7 +16,7 @@ jobs:
         id: repo_owner
         run: echo "::set-output name=lowercase::$(echo ${{ github.repository_owner }} | tr \"[:upper:]\" \"[:lower:]\")"
         shell: bash
-
+​
   trivy_analysis:
     name: Trivy Analysis of Indy Node Images
     runs-on: "ubuntu-20.04"
@@ -30,30 +27,61 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v2
-
-      - name: Run Trivy on indy_node:${{ matrix.os_version }}
+​
+      - name: Run Trivy vulnerability scanner for Slack messages on indy_node:${{ matrix.os_version }}
         uses: aquasecurity/trivy-action@master
         with:
-          image-ref: 'ghcr.io/${{ needs.workflow_setup.outputs.repo_owner }}/indy-node-container/indy_node:latest-${{ matrix.os_version }}'
-          format: 'template'
-          template: '@/contrib/sarif.tpl'
-          output: 'trivy-indy-node-${{ matrix.os_version }}.sarif'
+          #image-ref: 'ghcr.io/idunion/indy-node-container/indy_node:latest-ubuntu18'
+          image-ref: 'ghcr.io/zickau/indy_node:latest-${{ matrix.os_version }}'
+          scan-type: 'image'
+          severity: 'HIGH,CRITICAL'
           ignore-unfixed: true
-          severity: 'CRITICAL,HIGH'
-
-      - name: Patch tool name for ${{ matrix.os_version }} scan
-        run: |
-          sed -i 's/"name": "Trivy",/"name": "Trivy${{ matrix.os_version }}Latest",/g' trivy-indy-node-${{ matrix.os_version }}.sarif
-
-      - name: 'Safe trivy-indy-node-${{ matrix.os_version }}.sarif'
-        uses: actions/upload-artifact@v2
+          format: json
+          #output: 'results.json'
+          output: 'trivy-indy-node-${{ matrix.os_version }}.json'
+          # Ignoring the go.sum file as it may contain the older dependencies entries which are not being used now.
+          skip-dirs: 'go.sum'
+​
+      - name: Read file contents
+        id: read_file
+        uses: andstor/file-reader-action@v1.0.0
         with:
-          name: trivy-indy-node-${{ matrix.os_version }}.sarif
-          path: trivy-indy-node-${{ matrix.os_version }}.sarif
-          retention-days: 8
-
-      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v1
+          path: "trivy-indy-node-${{ matrix.os_version }}.json"
+​
+      - name: Create Issues Summary
+        run: |
+          summary1=$(grep -o '"VulnerabilityID": "[^"]*' trivy-indy-node-${{ matrix.os_version }}.json | grep -o '[^"]*$' | tr '\n' ',')
+          summary2=$(echo $summary1 | sed 's/.$//')
+          if [ -z $summary1 ]
+          then
+            summary2="0 Issues"
+          fi
+          echo "SUMMARY=$summary2" >> $GITHUB_ENV
+​
+      - name: Send custom JSON data to Slack workflow
+        id: slack
+        uses: slackapi/slack-github-action@v1.18.0
         with:
-          sarif_file: 'trivy-indy-node-${{ matrix.os_version }}.sarif'
-
+          payload: |
+            {
+              "text": "CVE found: ",
+              "blocks": [
+                {
+                  "type": "section",
+                  "text": {
+                    "type": "mrkdwn",
+                    "text": "*CVEs (HIGH,CRITICAL)* found in indy_node_container:${{ matrix.os_version }}: "
+                }
+              },
+              {
+                  "type": "section",
+                  "text": {
+                    "type": "mrkdwn",
+                    "text": "${{ env.SUMMARY }}"
+                }
+              }
+            ]
+            }
+        env:
+           SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL_IDU }}
+           SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK