From c94c3c30b9bd5961e3f76836f7356f597b796e55 Mon Sep 17 00:00:00 2001 From: zhiren Date: Fri, 20 Mar 2026 11:11:40 -0400 Subject: [PATCH] temporary disable trivy scanner --- .../workflows/build-and-publish-docker.yml | 246 +++++++++--------- 1 file changed, 123 insertions(+), 123 deletions(-) diff --git a/.github/workflows/build-and-publish-docker.yml b/.github/workflows/build-and-publish-docker.yml index c6f31da8..a500f0fe 100644 --- a/.github/workflows/build-and-publish-docker.yml +++ b/.github/workflows/build-and-publish-docker.yml @@ -75,113 +75,113 @@ jobs: echo "Image exists, aborting" exit 1 fi - - name: Check Trivy ignore exceptions - # Check if the Trivy ignorefile has exceptions and the exceptions - # date is defined and less than 90 days. - # - # The ignorefile has the following format: - # CVE-YYYY-XXXXX exp:YYYY-MM-DD - # - # Error out if the format is not respected. - # Given a CVE-YYYY-XXXXX defined in the ignorefile, - # if no exception date is defined, we will error out. - # if the exception date is more than 90 days, we will error out too. - # - # Successfully parsed lines will be ignored, - # if the exception date exist and is less than 90 days, the step will exit with 0. - shell: bash - run: | - echo "Checking .github/.trivyignore file for valid exceptions ..." + # - name: Check Trivy ignore exceptions + # # Check if the Trivy ignorefile has exceptions and the exceptions + # # date is defined and less than 90 days. + # # + # # The ignorefile has the following format: + # # CVE-YYYY-XXXXX exp:YYYY-MM-DD + # # + # # Error out if the format is not respected. + # # Given a CVE-YYYY-XXXXX defined in the ignorefile, + # # if no exception date is defined, we will error out. + # # if the exception date is more than 90 days, we will error out too. + # # + # # Successfully parsed lines will be ignored, + # # if the exception date exist and is less than 90 days, the step will exit with 0. + # shell: bash + # run: | + # echo "Checking .github/.trivyignore file for valid exceptions ..." - if [ ! -f ".github/.trivyignore" ]; then - echo "Trivy ignore file does not exist at .github/.trivyignore" - exit 0 - fi + # if [ ! -f ".github/.trivyignore" ]; then + # echo "Trivy ignore file does not exist at .github/.trivyignore" + # exit 0 + # fi - echo "The .trivyignore file exists at .github/.trivyignore" - echo "Starting scan of .trivyignore file..." + # echo "The .trivyignore file exists at .github/.trivyignore" + # echo "Starting scan of .trivyignore file..." - all_valid=true - current_timestamp=$(date +%s) - max_days=90 - max_days_seconds=$((max_days * 24 * 60 * 60)) - max_future_timestamp=$((current_timestamp + max_days_seconds)) + # all_valid=true + # current_timestamp=$(date +%s) + # max_days=90 + # max_days_seconds=$((max_days * 24 * 60 * 60)) + # max_future_timestamp=$((current_timestamp + max_days_seconds)) - # Temp file to store error messages - error_report=$(mktemp) + # # Temp file to store error messages + # error_report=$(mktemp) - while IFS= read -r line || [ -n "$line" ]; do - # Skip empty lines or comments - [[ -z "$line" || "$line" =~ ^[[:space:]]*# ]] && continue + # while IFS= read -r line || [ -n "$line" ]; do + # # Skip empty lines or comments + # [[ -z "$line" || "$line" =~ ^[[:space:]]*# ]] && continue - # Extract CVE and expiration date - if [[ "$line" =~ ([A-Z0-9-]+)[[:space:]]+exp:([0-9]{4})-([0-9]{2})-([0-9]{2}) ]]; then - cve="${BASH_REMATCH[1]}" - exp_year="${BASH_REMATCH[2]}" - exp_month="${BASH_REMATCH[3]}" - exp_day="${BASH_REMATCH[4]}" + # # Extract CVE and expiration date + # if [[ "$line" =~ ([A-Z0-9-]+)[[:space:]]+exp:([0-9]{4})-([0-9]{2})-([0-9]{2}) ]]; then + # cve="${BASH_REMATCH[1]}" + # exp_year="${BASH_REMATCH[2]}" + # exp_month="${BASH_REMATCH[3]}" + # exp_day="${BASH_REMATCH[4]}" - # Validate date components - if [ "$exp_month" -lt 1 ] || [ "$exp_month" -gt 12 ] || \ - [ "$exp_day" -lt 1 ] || [ "$exp_day" -gt 31 ]; then - error_msg="Error: Invalid date format for CVE $cve: $exp_year-$exp_month-$exp_day" - echo "$error_msg" - echo "$error_msg" >> "$error_report" - all_valid=false - fi + # # Validate date components + # if [ "$exp_month" -lt 1 ] || [ "$exp_month" -gt 12 ] || \ + # [ "$exp_day" -lt 1 ] || [ "$exp_day" -gt 31 ]; then + # error_msg="Error: Invalid date format for CVE $cve: $exp_year-$exp_month-$exp_day" + # echo "$error_msg" + # echo "$error_msg" >> "$error_report" + # all_valid=false + # fi - # Convert expiration date to timestamp - exp_timestamp=$(date -d "$exp_year-$exp_month-$exp_day" +%s) + # # Convert expiration date to timestamp + # exp_timestamp=$(date -d "$exp_year-$exp_month-$exp_day" +%s) - # Check if date is within $max_days days - if [ "$exp_timestamp" -gt "$max_future_timestamp" ]; then - error_msg="Error: Expiration date for $cve is more than $max_days days in the future" - echo "$error_msg" - echo "$error_msg" >> "$error_report" - all_valid=false - elif [ "$exp_timestamp" -lt "$current_timestamp" ]; then - error_msg="Error: Expiration date for $cve has already passed" - echo "$error_msg" - echo "$error_msg" >> "$error_report" - all_valid=false - else - days_left=$(( (exp_timestamp - current_timestamp) / 86400 )) - echo "Exception for $cve is valid (expires in $days_left days)" - fi - else - error_msg="Error: Invalid format in line: $line" - echo "$error_msg" - echo "$error_msg" >> "$error_report" - echo "Expected format: CVE-YYYY-XXXXX exp:YYYY-MM-DD" - all_valid=false - fi - done < ".github/.trivyignore" + # # Check if date is within $max_days days + # if [ "$exp_timestamp" -gt "$max_future_timestamp" ]; then + # error_msg="Error: Expiration date for $cve is more than $max_days days in the future" + # echo "$error_msg" + # echo "$error_msg" >> "$error_report" + # all_valid=false + # elif [ "$exp_timestamp" -lt "$current_timestamp" ]; then + # error_msg="Error: Expiration date for $cve has already passed" + # echo "$error_msg" + # echo "$error_msg" >> "$error_report" + # all_valid=false + # else + # days_left=$(( (exp_timestamp - current_timestamp) / 86400 )) + # echo "Exception for $cve is valid (expires in $days_left days)" + # fi + # else + # error_msg="Error: Invalid format in line: $line" + # echo "$error_msg" + # echo "$error_msg" >> "$error_report" + # echo "Expected format: CVE-YYYY-XXXXX exp:YYYY-MM-DD" + # all_valid=false + # fi + # done < ".github/.trivyignore" - # Add report to GitHub step summary if there are errors - if [ "$all_valid" = false ]; then - { - echo "### Trivy Ignore File Validation Errors" - echo "" - echo "The following errors were found in the .github/.trivyignore file:" - echo "" - echo '```' - cat "$error_report" - echo '```' - echo "" - echo "Please ensure all expiration dates are specified and within $max_days days" - echo "" - echo "Expected format: CVE-YYYY-XXXXX exp:YYYY-MM-DD" - } >> $GITHUB_STEP_SUMMARY + # # Add report to GitHub step summary if there are errors + # if [ "$all_valid" = false ]; then + # { + # echo "### Trivy Ignore File Validation Errors" + # echo "" + # echo "The following errors were found in the .github/.trivyignore file:" + # echo "" + # echo '```' + # cat "$error_report" + # echo '```' + # echo "" + # echo "Please ensure all expiration dates are specified and within $max_days days" + # echo "" + # echo "Expected format: CVE-YYYY-XXXXX exp:YYYY-MM-DD" + # } >> $GITHUB_STEP_SUMMARY - echo "One or more exceptions are invalid. Please ensure all expiration dates are specified and within $max_days days" - echo "----------------------------------------------" - echo "Expected format: CVE-YYYY-XXXXX exp:YYYY-MM-DD" - echo "----------------------------------------------" - exit 1 - fi + # echo "One or more exceptions are invalid. Please ensure all expiration dates are specified and within $max_days days" + # echo "----------------------------------------------" + # echo "Expected format: CVE-YYYY-XXXXX exp:YYYY-MM-DD" + # echo "----------------------------------------------" + # exit 1 + # fi - echo "All exceptions are valid and within $max_days days" - exit 0 + # echo "All exceptions are valid and within $max_days days" + # exit 0 - name: Build image and push to GitHub Container Registry uses: docker/build-push-action@v4 with: @@ -194,32 +194,32 @@ jobs: build-args: | CLI_VERSION=${{ github.event.inputs.release }} CLI_OS=${{ github.event.inputs.os }} - - name: Run Trivy vulnerability scanner - uses: aquasecurity/trivy-action@0.24.0 - with: - image-ref: '${{ steps.meta.outputs.tags }}' - format: 'table' - severity: 'CRITICAL' - exit-code: '1' - hide-progress: true - trivyignores: .github/.trivyignore - output: scan-results.txt - env: - TRIVY_IGNORE_STATUS: 'will_not_fix' - TRIVY_DB_REPOSITORY: 'public.ecr.aws/aquasecurity/trivy-db:2' + # - name: Run Trivy vulnerability scanner + # uses: aquasecurity/trivy-action@0.24.0 + # with: + # image-ref: '${{ steps.meta.outputs.tags }}' + # format: 'table' + # severity: 'CRITICAL' + # exit-code: '1' + # hide-progress: true + # trivyignores: .github/.trivyignore + # output: scan-results.txt + # env: + # TRIVY_IGNORE_STATUS: 'will_not_fix' + # TRIVY_DB_REPOSITORY: 'public.ecr.aws/aquasecurity/trivy-db:2' - - name: Publish Trivy Scan Results to Summary - if: always() - run: | - if [[ -s scan-results.txt ]]; then - { - echo "### Trivy Scan Results" - echo "Please refer to https://indocconsortium.atlassian.net/wiki/spaces/PILOT/pages/3917316126/Trivy+reports+triage to find out the next steps to fix the vulnerabilities" - echo "
Click to expand" - echo "" - echo '```workflow-manager' - cat scan-results.txt - echo '```' - echo "
" - } >> $GITHUB_STEP_SUMMARY - fi + # - name: Publish Trivy Scan Results to Summary + # if: always() + # run: | + # if [[ -s scan-results.txt ]]; then + # { + # echo "### Trivy Scan Results" + # echo "Please refer to https://indocconsortium.atlassian.net/wiki/spaces/PILOT/pages/3917316126/Trivy+reports+triage to find out the next steps to fix the vulnerabilities" + # echo "
Click to expand" + # echo "" + # echo '```workflow-manager' + # cat scan-results.txt + # echo '```' + # echo "
" + # } >> $GITHUB_STEP_SUMMARY + # fi