diff --git a/.github/workflows/build-test-push.yml b/.github/workflows/build-test-push.yml index 8a9c4d9..3fbf343 100644 --- a/.github/workflows/build-test-push.yml +++ b/.github/workflows/build-test-push.yml @@ -29,9 +29,6 @@ jobs: vuln-type: os timeout: 10m0s skip-files: "/root/.pdk/cache/ruby/*/gems/aws-sdk-core-*/lib/aws-sdk-ssooidc/client.rb" - env: - TRIVY_SKIP_DB_UPDATE: true - TRIVY_SKIP_JAVA_DB_UPDATE: true - name: Run tests run: cd tests; ./run_tests.sh - name: Tag Docker images diff --git a/.github/workflows/build-test.yml b/.github/workflows/build-test.yml index 576524e..9233c84 100644 --- a/.github/workflows/build-test.yml +++ b/.github/workflows/build-test.yml @@ -28,9 +28,6 @@ jobs: vuln-type: os timeout: 10m0s skip-files: "/root/.pdk/cache/ruby/*/gems/aws-sdk-core-*/lib/aws-sdk-ssooidc/client.rb" - env: - TRIVY_SKIP_DB_UPDATE: true - TRIVY_SKIP_JAVA_DB_UPDATE: true - name: Run tests working-directory: ${{ github.workspace }}/tests run: ./run_tests.sh diff --git a/.github/workflows/publish-4x-image.yml b/.github/workflows/publish-4x-image.yml index 772e22c..4e2b077 100644 --- a/.github/workflows/publish-4x-image.yml +++ b/.github/workflows/publish-4x-image.yml @@ -33,9 +33,6 @@ jobs: vuln-type: os timeout: 10m0s skip-files: "/root/.pdk/cache/ruby/*/gems/aws-sdk-core-*/lib/aws-sdk-ssooidc/client.rb" - env: - TRIVY_SKIP_DB_UPDATE: true - TRIVY_SKIP_JAVA_DB_UPDATE: true - name: Publish standard image to 4.x env: IMAGE_TAG: ${{ github.event.inputs.image_tag }} diff --git a/.github/workflows/update-trivy-cache.yml b/.github/workflows/update-trivy-cache.yml deleted file mode 100644 index b017a9e..0000000 --- a/.github/workflows/update-trivy-cache.yml +++ /dev/null @@ -1,43 +0,0 @@ -# https://github.com/aquasecurity/trivy-action?tab=readme-ov-file#updating-caches-in-the-default-branch -# This workflow is needed to get around rate limiting on ghcr. This will update the trivy DBs in the -# github cache to allow the trivy scans themselves to run without pulling the DB. This will allow the -# scans to run without running into rate limit issues. This workflow could run into those issues when -# downloading the cache, but as long as it succeeds more often than it fails, we will have our bases -# covered. -name: Update Trivy DB Caches - -on: - workflow_dispatch: - schedule: - - cron: '17 2 * * *' # Daily at random time (2:17am UTC) - -jobs: - update-caches: - runs-on: ubuntu-latest - steps: - - name: Setup oras - uses: oras-project/setup-oras@v1 - - - name: Get current date - id: date - run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT - - - name: Download and extract the vulnerability DB - run: | - mkdir -p $GITHUB_WORKSPACE/.cache/trivy/db - oras pull ghcr.io/aquasecurity/trivy-db:2 - tar -xzf db.tar.gz -C $GITHUB_WORKSPACE/.cache/trivy/db - rm db.tar.gz - - - name: Download and extract the Java DB - run: | - mkdir -p $GITHUB_WORKSPACE/.cache/trivy/java-db - oras pull ghcr.io/aquasecurity/trivy-java-db:1 - tar -xzf javadb.tar.gz -C $GITHUB_WORKSPACE/.cache/trivy/java-db - rm javadb.tar.gz - - - name: Cache DBs - uses: actions/cache/save@v4 - with: - path: ${{ github.workspace }}/.cache/trivy - key: cache-trivy-${{ steps.date.outputs.date }} \ No newline at end of file