Skip to content

Commit 6f8c237

Browse files
nikpivkinnikpivkin
authored
update tests (#334)
* update tests * rename trivy images * rename workflow steps
1 parent 7088d18 commit 6f8c237

File tree

26 files changed

+1990
-1556
lines changed

26 files changed

+1990
-1556
lines changed

‎.github/workflows/build.yaml

-28
This file was deleted.

‎.github/workflows/sync-trivy-checks.yaml

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
name: Sync Trivy Checks
2+
3+
on:
4+
workflow_dispatch:
5+
env:
6+
IMAGE_NAME: ${{ github.repository_owner }}/trivy-checks-act
7+
REGISTRY: ghcr.io
8+
9+
jobs:
10+
sync-trivy-checks:
11+
runs-on: ubuntu-latest
12+
steps:
13+
- uses: actions/checkout@v4
14+
15+
- name: Login to GitHub Packages Container registry
16+
uses: docker/login-action@v3
17+
with:
18+
registry: ${{ env.REGISTRY }}
19+
username: ${{ github.actor }}
20+
password: ${{ secrets.GITHUB_TOKEN }}
21+
22+
- name: Copy Trivy Checks
23+
run: |
24+
oras cp ghcr.io/aquasecurity/trivy-checks:0 ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest

‎.github/workflows/sync-trivy-db.yaml

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
name: Sync Trivy DB
2+
3+
on:
4+
workflow_dispatch:
5+
env:
6+
IMAGE_NAME: ${{ github.repository_owner }}/trivy-db-act
7+
REGISTRY: ghcr.io
8+
9+
jobs:
10+
sync-trivy-db:
11+
runs-on: ubuntu-latest
12+
steps:
13+
- uses: actions/checkout@v4
14+
15+
- name: Login to GitHub Packages Container registry
16+
uses: docker/login-action@v3
17+
with:
18+
registry: ${{ env.REGISTRY }}
19+
username: ${{ github.actor }}
20+
password: ${{ secrets.GITHUB_TOKEN }}
21+
22+
- name: Copy Trivy DB
23+
run: |
24+
oras cp ghcr.io/aquasecurity/trivy-db:2 ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest

‎.github/workflows/sync-trivy-java-db.yaml

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
name: Sync Trivy Java DB
2+
3+
on:
4+
workflow_dispatch:
5+
env:
6+
IMAGE_NAME: ${{ github.repository_owner }}/trivy-java-db-act
7+
REGISTRY: ghcr.io
8+
9+
jobs:
10+
sync-trivy-db:
11+
runs-on: ubuntu-latest
12+
steps:
13+
- uses: actions/checkout@v4
14+
15+
- name: Login to GitHub Packages Container registry
16+
uses: docker/login-action@v3
17+
with:
18+
registry: ${{ env.REGISTRY }}
19+
username: ${{ github.actor }}
20+
password: ${{ secrets.GITHUB_TOKEN }}
21+
22+
- name: Copy Trivy Java DB
23+
run: |
24+
oras cp ghcr.io/aquasecurity/trivy-java-db:1 ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest

‎.github/workflows/test.yaml

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
name: Test
2+
3+
on:
4+
push:
5+
pull_request:
6+
workflow_dispatch:
7+
8+
env:
9+
TRIVY_VERSION: 0.50.2
10+
BATS_LIB_PATH: '/usr/lib/'
11+
12+
jobs:
13+
test:
14+
runs-on: ubuntu-latest
15+
steps:
16+
- uses: actions/checkout@v4
17+
18+
- name: Setup Bats and bats libs
19+
uses: bats-core/[email protected]
20+
21+
- name: Install Trivy
22+
run: |
23+
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v${{ env.TRIVY_VERSION }}
24+
trivy --version
25+
26+
- name: Test
27+
run: |
28+
chmod +x entrypoint.sh
29+
bats -r -T .

‎test/data/main.tf ‎test/data/config-sarif-report/main.tf

File renamed without changes.

‎test/data/config-sarif-report/report.sarif

+512
Large diffs are not rendered by default.

‎test/data/config-sarif.test

-620
This file was deleted.

‎test/data/config-scan/main.tf

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# test data for trivy config with terraform variables
2+
3+
variable "bucket_versioning_enabled" {
4+
type = string
5+
default = "Disabled"
6+
}
7+
8+
resource "aws_s3_bucket" "bucket" {
9+
bucket = "trivy-action-bucket"
10+
}
11+
12+
resource "aws_s3_bucket_versioning" "bucket_versioning" {
13+
bucket = aws_s3_bucket.bucket.id
14+
15+
versioning_configuration {
16+
status = var.bucket_versioning_enabled
17+
}
18+
}

‎test/data/config.test ‎test/data/config-scan/report.json

+6-70
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"SchemaVersion": 2,
3-
"CreatedAt": "2024-01-02T23:40:12.036390742Z",
4-
"ArtifactName": ".",
3+
"CreatedAt": "2024-04-12T16:53:35.5567541+03:00",
4+
"ArtifactName": "test/data/config-scan",
55
"ArtifactType": "filesystem",
66
"Metadata": {
77
"ImageConfig": {
@@ -17,71 +17,7 @@
1717
},
1818
"Results": [
1919
{
20-
"Target": "Dockerfile",
21-
"Class": "config",
22-
"Type": "dockerfile",
23-
"MisconfSummary": {
24-
"Successes": 24,
25-
"Failures": 2,
26-
"Exceptions": 0
27-
},
28-
"Misconfigurations": [
29-
{
30-
"Type": "Dockerfile Security Check",
31-
"ID": "DS002",
32-
"AVDID": "AVD-DS-0002",
33-
"Title": "Image user should not be 'root'",
34-
"Description": "Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.",
35-
"Message": "Specify at least 1 USER command in Dockerfile with non-root user as argument",
36-
"Namespace": "builtin.dockerfile.DS002",
37-
"Query": "data.builtin.dockerfile.DS002.deny",
38-
"Resolution": "Add 'USER \u003cnon root user name\u003e' line to the Dockerfile",
39-
"Severity": "HIGH",
40-
"PrimaryURL": "https://avd.aquasec.com/misconfig/ds002",
41-
"References": [
42-
"https://docs.docker.com/develop/develop-images/dockerfile_best-practices/",
43-
"https://avd.aquasec.com/misconfig/ds002"
44-
],
45-
"Status": "FAIL",
46-
"Layer": {},
47-
"CauseMetadata": {
48-
"Provider": "Dockerfile",
49-
"Service": "general",
50-
"Code": {
51-
"Lines": null
52-
}
53-
}
54-
},
55-
{
56-
"Type": "Dockerfile Security Check",
57-
"ID": "DS026",
58-
"AVDID": "AVD-DS-0026",
59-
"Title": "No HEALTHCHECK defined",
60-
"Description": "You should add HEALTHCHECK instruction in your docker container images to perform the health check on running containers.",
61-
"Message": "Add HEALTHCHECK instruction in your Dockerfile",
62-
"Namespace": "builtin.dockerfile.DS026",
63-
"Query": "data.builtin.dockerfile.DS026.deny",
64-
"Resolution": "Add HEALTHCHECK instruction in Dockerfile",
65-
"Severity": "LOW",
66-
"PrimaryURL": "https://avd.aquasec.com/misconfig/ds026",
67-
"References": [
68-
"https://blog.aquasec.com/docker-security-best-practices",
69-
"https://avd.aquasec.com/misconfig/ds026"
70-
],
71-
"Status": "FAIL",
72-
"Layer": {},
73-
"CauseMetadata": {
74-
"Provider": "Dockerfile",
75-
"Service": "general",
76-
"Code": {
77-
"Lines": null
78-
}
79-
}
80-
}
81-
]
82-
},
83-
{
84-
"Target": "test/data",
20+
"Target": ".",
8521
"Class": "config",
8622
"Type": "terraform",
8723
"MisconfSummary": {
@@ -91,7 +27,7 @@
9127
}
9228
},
9329
{
94-
"Target": "test/data/main.tf",
30+
"Target": "main.tf",
9531
"Class": "config",
9632
"Type": "terraform",
9733
"MisconfSummary": {
@@ -436,15 +372,15 @@
436372
"Occurrences": [
437373
{
438374
"Resource": "versioning_configuration",
439-
"Filename": "test/data/main.tf",
375+
"Filename": "main.tf",
440376
"Location": {
441377
"StartLine": 15,
442378
"EndLine": 17
443379
}
444380
},
445381
{
446382
"Resource": "aws_s3_bucket_versioning.bucket_versioning",
447-
"Filename": "test/data/main.tf",
383+
"Filename": "main.tf",
448384
"Location": {
449385
"StartLine": 12,
450386
"EndLine": 18

‎test/data/fs.test ‎test/data/fs-scan/report

File renamed without changes.

0 commit comments

Comments
 (0)