Container with trivy for Woodpecker CI

This is a plugin for Woodpecker CI that check vulnerabilities with trivy utility. This can be used in two mode:

• Using in pipeline to validate the code itself
• Using as a cron trigger to scan the repository and belonging container images

In case of repo_scan mode, it open a vulnerability dashboard ticket and update it accordingly. It makes a "ping comment" then a critical one was detected.

In case of scan_file_list each line must contains a fully qualified image name. They will be scanned. The non-vulnerable images are put into an output file.

Usage

It can be used at any event.

Example to use from a release workflow to scan image and local project.

steps:
  - name: Build image locally
    image: code.thinkaboutit.tech/pandora/container-builder.woodpecker
    settings:
      debug: true
      registry_push: false
  - name: Check built image.tar.gz for vulnerabilities
    image: code.thinkaboutit.tech/pandora/trivy.woodpecker
    settings:
      debug: true
  - name: Scan the code of the project
    image: code.thinkaboutit.tech/pandora/trivy.woodpecker
    settings:
      mode: local_fs_scan
      debug: true
  - name: Push the verified image to the repository
    image: code.thinkaboutit.tech/pandora/container-builder.woodpecker
    settings:
      debug: true
      registry_push: true
      registry_push_latest: true
      registry_owner: pandora
      registry_user: bot-ci
      registry_pwd:
        from_secret: gitea-bot-ci

Example to use to scan repository:

steps:
  - name: Check built image.tar.gz for vulnerabilities
    image: code.thinkaboutit.tech/pandora/trivy.woodpecker
    settings:
      mode: repo_scan
      forgejo_user:
        from_secret: ci-user
      forgejo_token:
        from_secret: ci-password
      debug: true

Settings

Base settings

Name	Default value	Description
mode	local_image_scan	It can be local_image_scan, local_fs_scan, scan_file_list or repo_scan
repo_name	CI_REPO_NAME	Name of repository
repo_owner	CI_REPO_OWNER	Owner of the repository
forgejo_url	CI_FORGE_URL	Address of Forgejo

File system scan settings

Name	Default value	Description
file	root directory	File or directory wants to be scanned

Authentication settings

They are needed when repo_scan is specified.

Name	Default value	Description
forgejo_user		User to handle issues
forgejo_token		Access token for CI user

File list settings

They are need when scan_file_list is specified.

Name	Default value	Description
file_name	image_list	Name of the file that is read
file_output	ok_image_list	Images that are not vulnerable
forgejo_user		(optional) User to handle issues
forgejo_token		(optional) Access token for CI user