From edffba4ec4484ad240805bb17516144777ba3bb1 Mon Sep 17 00:00:00 2001 From: Konstantin Tursunov Date: Fri, 17 Jul 2026 20:39:12 +0300 Subject: [PATCH] ci(security): add Trivy misconfig + fs scan gate, report-only (#1796) New .github/workflows/security-trivy.yml runs trivy config (IaC + Dockerfile misconfig) and trivy fs (filesystem vulns, ignore-unfixed) at CRITICAL,HIGH on PRs to main + a nightly schedule + workflow_dispatch, aquasecurity/trivy-action pinned by SHA (v0.36.0), findings in the job summary. New .trivyignore carries 4 documented, tracked waivers (AVD-DS-0002, AVD-DS-0029, AVD-KSV-0118, AVD-KSV-0014) per #1340. Report-only first per the #1796 ratchet; a local baseline triage found all config misconfigs waived and the fs scan clean, so a follow-up flip to blocking + required checks is expected to be zero-disruption. Part of #1478; split from closed PR #1463. Signed-off-by: Konstantin Tursunov Co-authored-by: Constructor Studio <291158726+constructor-studio[bot]@users.noreply.github.com> Studio-Generated-By: Constructor Studio Studio-Source-Repo: https://github.com/constructorfabric/studio Constructor-Fabric: https://github.com/constructorfabric Studio-Version: skill=1.5.9, cli=1.5.9 Studio-Workflows: cf-plan,cf-analyze,cf-write-skills --- .github/workflows/security-trivy.yml | 83 ++++++++++++++++++++++++++++ .trivyignore | 28 ++++++++++ 2 files changed, 111 insertions(+) create mode 100644 .github/workflows/security-trivy.yml create mode 100644 .trivyignore diff --git a/.github/workflows/security-trivy.yml b/.github/workflows/security-trivy.yml new file mode 100644 index 000000000..b0108782e --- /dev/null +++ b/.github/workflows/security-trivy.yml @@ -0,0 +1,83 @@ +# Security — Trivy (issue #1796, part of security-scanner umbrella #1478). +# +# Two scans over the whole repo at CRITICAL,HIGH severity: +# - trivy-config: IaC + Dockerfile misconfiguration (Trivy `config`). +# - trivy-fs: filesystem vulnerabilities (Trivy `fs`, unfixed suppressed). +# +# STATUS: REPORT-ONLY (both jobs, exit-code "0") — findings are surfaced in the +# job summary but never fail the build. This is the first stage of the #1796 +# ratchet: report-only first, then flip to blocking once the team agrees on the +# baseline. A local baseline triage (#1796) found all config misconfigs covered +# by .trivyignore waivers and the fs scan clean, so the follow-up flip to +# exit-code "1" on CRITICAL,HIGH is expected to be zero-disruption. When flipping, +# also add "Trivy config (IaC + Dockerfile misconfig)" and "Trivy fs (filesystem +# vulnerabilities)" as REQUIRED status checks on main (branch protection). +# Waivers live in .trivyignore (tracked in #1340). +name: Security — Trivy + +on: + pull_request: + branches: [main] + schedule: + - cron: "0 3 * * *" # nightly, 03:00 UTC + workflow_dispatch: + +# A new push obsoletes any run still in flight for the same ref — cancel it. +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +# Read-only: report-only scanning needs no write scopes. Add security-events: +# write only if a SARIF upload to code-scanning is introduced later. +permissions: + contents: read + +jobs: + trivy-config: + name: Trivy config (IaC + Dockerfile misconfig) + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v5 + - name: Trivy config scan (report-only) + uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 + with: + scan-type: config + scan-ref: . + severity: CRITICAL,HIGH + exit-code: "0" # report-only; flip to "1" once the baseline is agreed (#1796) + format: table + output: trivy-config.txt + - name: Job summary + if: always() + run: | + { + echo "## Trivy config findings (report-only)" + echo '```' + cat trivy-config.txt 2>/dev/null || echo "(no output produced)" + echo '```' + } >> "$GITHUB_STEP_SUMMARY" + + trivy-fs: + name: Trivy fs (filesystem vulnerabilities) + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v5 + - name: Trivy fs scan (report-only) + uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 + with: + scan-type: fs + scan-ref: . + severity: CRITICAL,HIGH + ignore-unfixed: true + exit-code: "0" # report-only; flip to "1" once the baseline is agreed (#1796) + format: table + output: trivy-fs.txt + - name: Job summary + if: always() + run: | + { + echo "## Trivy fs findings (report-only)" + echo '```' + cat trivy-fs.txt 2>/dev/null || echo "(no output produced)" + echo '```' + } >> "$GITHUB_STEP_SUMMARY" diff --git a/.trivyignore b/.trivyignore new file mode 100644 index 000000000..499f2e2c4 --- /dev/null +++ b/.trivyignore @@ -0,0 +1,28 @@ +# .trivyignore — Trivy misconfiguration waivers. +# +# POLICY: every entry below MUST be a documented, tracked waiver. No undocumented +# suppressions. Each waiver is tracked in constructorfabric/insight#1340 and MUST +# be removed as its underlying issue is fixed. See issue #1796 for context. + +# AVD-DS-0002 — image runs as root (build/test/tooling images that set no USER): +# deploy/seed/Dockerfile +# src/ingestion/tools/toolbox/Dockerfile +# src/ingestion/tools/declarative-connector/Dockerfile +# src/ingestion/tests/e2e/compose/Dockerfile.runner +# Tracked: #1340. Remove once these images drop to a non-root USER. +AVD-DS-0002 + +# AVD-DS-0029 — apt-get install without --no-install-recommends +# (src/ingestion/tools/toolbox/Dockerfile: the `apt-get install -y nodejs` line). +# Tracked: #1340. Remove once that line adds --no-install-recommends. +AVD-DS-0029 + +# AVD-KSV-0118 — Deployment missing securityContext +# (src/frontend/helm/templates/deployment.yaml). Tracked: #1340. +# Remove once a securityContext is set on the pod/containers. +AVD-KSV-0118 + +# AVD-KSV-0014 — root filesystem not read-only +# (src/frontend/helm/templates/deployment.yaml). Tracked: #1340. +# Remove once readOnlyRootFilesystem: true is set. +AVD-KSV-0014