action.yml

name: 'Trivy CVE Scan'
description: 'Scan container images for CVEs and licenses and upload reports to DefectDojo'
inputs:
  prod_registry:
    description: 'Prod registry host (e.g., registry.deckhouse.io)'
    required: true
  prod_registry_user:
    description: 'Username for prod registry authentication'
    required: true
  prod_registry_password:
    description: 'Password for prod registry authentication'
    required: true
  dev_registry:
    description: 'Dev-registry host (e.g., dev-registry.deckhouse.io)'
    required: true
  dev_registry_user:
    description: 'Username for dev-registry authentication'
    required: true
  dev_registry_password:
    description: 'Password for dev-registry authentication'
    required: true
  source_tag:
    description: 'Tag to scan (e.g., main, v1.74.3, pr123, release-1.73)'
    required: true
  case:
    description: 'Scan type: deckhouse | External Modules | CSE'
    required: true
  external_module_name:
    description: 'External module name (required when case=External Modules)'
    required: false
    default: ''
  scan_several_latest_releases:
    description: 'Scan multiple latest releases (True/False)'
    required: false
    default: 'False'
  latest_releases_amount:
    description: 'Number of latest releases to scan when scan_several_latest_releases=true'
    required: false
    default: '3'
  module_prod_registry_custom_path:
    description: 'Custom path for external modules in production registry'
    required: false
    default: 'deckhouse/fe/modules'
  module_dev_registry_custom_path:
    description: 'Custom path for external modules in development registry'
    required: false
    default: 'sys/deckhouse-oss/modules'
  release_in_dev:
    description: 'If true, release tag will be searched in dev registry instead of prod'
    required: false
    default: 'False'
  digest_from_werf:
    description: 'Prefix of Werf image digest files (for CSE external modules)'
    required: false
    default: 'images_tags_werf'
  scan_users:
    description: 'Enable user validation scan for CSE (True/False)'
    required: false
    default: 'False'
  workdir:
    description: 'Working directory for temporary files'
    required: false
    default: 'cve-scan'
  trivy_reports_log_output:
    description: 'Trivy log output level (0=off, 1=CVE report, 2=license report)'
    required: false
    default: '1'
  role_name:
    description: 'Repository name'
    required: true

runs:
  using: "composite"
  steps:
    - name: Import secrets
      id: secrets
      uses: hashicorp/vault-action@v2
      with:
        url: https://seguro.flant.com
        path: github
        role: "${{ inputs.role_name }}"
        method: jwt
        jwtGithubAudience: github-access-aud
        secrets: |
          projects/data/24cb1d7c-717a-4f92-8547-26f632916a7a/Trivy_CVE_Scan_CI_Secrets DD_TOKEN | DD_TOKEN ;
          projects/data/24cb1d7c-717a-4f92-8547-26f632916a7a/Trivy_CVE_Scan_CI_Secrets DD_URL | DD_URL ;
          projects/data/24cb1d7c-717a-4f92-8547-26f632916a7a/Trivy_CVE_Scan_CI_Secrets CVE_TEST_SSH_PRIVATE_KEY | CVE_TEST_SSH_PRIVATE_KEY ;
          projects/data/24cb1d7c-717a-4f92-8547-26f632916a7a/Trivy_CVE_Scan_CI_Secrets CVE_TEST_REPO_GIT | CVE_TEST_REPO_GIT ;
          projects/data/24cb1d7c-717a-4f92-8547-26f632916a7a/Trivy_CVE_Scan_CI_Secrets DECKHOUSE_PRIVATE_REPO | DECKHOUSE_PRIVATE_REPO ;
          projects/data/b050f3bd-733f-4746-9640-9df80d484074/CODEOWNERS_REPO_TOKEN CODEOWNERS_REPO_TOKEN | CODEOWNERS_REPO_TOKEN ;

    - name: Start ssh-agent
      uses: webfactory/ssh-agent@v0.9.0
      with:
        ssh-private-key: ${{ steps.secrets.outputs.CVE_TEST_SSH_PRIVATE_KEY }}

    - name: Add host to known_hosts
      shell: bash
      run: |
        HOST=$(echo "${{ steps.secrets.outputs.CVE_TEST_REPO_GIT }}" | sed -E 's/.*@([^:]+).*/\1/')
        mkdir -p ~/.ssh
        ssh-keyscan -H "$HOST" >> ~/.ssh/known_hosts 2>/dev/null

    - name: Clone repository
      shell: bash
      run: |
        rm -rf /tmp/cve-scripts
        git clone --depth 1 --branch v2.0 "${{ steps.secrets.outputs.CVE_TEST_REPO_GIT }}" /tmp/cve-scripts
        cp /tmp/cve-scripts/*.sh /tmp/cve-scripts/*.py ./
        chmod +x *.sh *.py

    - name: Run Trivy CVE Scan
      shell: bash
      env:
        CS_TRIVY_BIN_VERSION: "v0.67.2"
        CS_TRIVY_REPO_ID: "2181"
        CS_TRIVY_PROD_REGISTRY: "${{ inputs.prod_registry }}"
        CS_TRIVY_DB_URL: "${{ inputs.prod_registry }}/deckhouse/ee/security/trivy-db:2"
        CS_TRIVY_JAVA_DB_URL: "${{ inputs.prod_registry }}/deckhouse/ee/security/trivy-java-db:1"
        CS_TRIVY_POLICY_URL: "${{ inputs.prod_registry }}/deckhouse/ee/security/trivy-bdu:1"
        CS_TRIVY_REPORTS_LOG_OUTPUT: "${{ inputs.trivy_reports_log_output }}"
        CS_PROD_REGISTRY: "${{ inputs.prod_registry }}"
        CS_PROD_REGISTRY_USER: "${{ inputs.prod_registry_user }}"
        CS_PROD_REGISTRY_PASSWORD: "${{ inputs.prod_registry_password }}"
        CS_DEV_REGISTRY: "${{ inputs.dev_registry }}"
        CS_DEV_REGISTRY_USER: "${{ inputs.dev_registry_user }}"
        CS_DEV_REGISTRY_PASSWORD: "${{ inputs.dev_registry_password }}"
        CS_SOURCE_TAG: "${{ inputs.source_tag }}"
        CS_CASE: "${{ inputs.case }}"
        CS_EXTERNAL_MODULE_NAME: "${{ inputs.external_module_name }}"
        CS_RELEASE_IN_DEV: "${{ inputs.release_in_dev }}"
        CS_SCAN_USERS: "${{ inputs.scan_users }}"
        CS_SCAN_SEVERAL_LATEST_RELEASES: "${{ inputs.scan_several_latest_releases }}"
        CS_LATEST_RELEASES_AMOUNT: "${{ inputs.latest_releases_amount }}"
        CS_MODULE_PROD_REGISTRY_CUSTOM_PATH: "${{ inputs.module_prod_registry_custom_path }}"
        CS_MODULE_DEV_REGISTRY_CUSTOM_PATH: "${{ inputs.module_dev_registry_custom_path }}"
        CS_DIGEST_FROM_WERF: "${{ inputs.digest_from_werf }}"
        CS_DD_URL: "${{ steps.secrets.outputs.DD_URL }}"
        CS_DD_TOKEN: "${{ steps.secrets.outputs.DD_TOKEN }}"
        CS_CODEOWNERS_REPO_TOKEN: "${{ steps.secrets.outputs.CODEOWNERS_REPO_TOKEN }}"
        CS_DECKHOUSE_PRIVATE_REPO: "${{ steps.secrets.outputs.DECKHOUSE_PRIVATE_REPO }}"
        CS_CONFIGMAP_PROJECT_ID: "4352"
        CS_WORKDIR: "${{ github.workspace }}/${{ inputs.workdir }}"
      run: |
        ./cve_scan.sh