Skip to content

Commit d2a392a

Browse files
DmitriyLewensimar7
DmitriyLewen
and
simar7
authored
fix: bump setup-trivy and add new contrib directory path info (#424)
* chore(deps): use fork for setup-trivy * docs: add info about templates * refactor: use `setup-trivy` v0.2.2 * docs: remove `./` prefix * Merge branch 'main' into 'fix/contrib-dir' * docs: fix link * docs: fix typo Co-authored-by: simar7 <[email protected]> --------- Co-authored-by: simar7 <[email protected]>
1 parent ee89346 commit d2a392a

File tree

1 file changed

+63
-2
lines changed

1 file changed

+63
-2
lines changed

‎README.md

+63-2
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
* [Cache](#cache)
1717
* [Trivy Setup](#trivy-setup)
1818
* [Scanning a Tarball](#scanning-a-tarball)
19+
* [Using Trivy with templates](#using-trivy-with-templates)
1920
* [Using Trivy with GitHub Code Scanning](#using-trivy-with-github-code-scanning)
2021
* [Using Trivy to scan your Git repo](#using-trivy-to-scan-your-git-repo)
2122
* [Using Trivy to scan your rootfs directories](#using-trivy-to-scan-your-rootfs-directories)
@@ -323,6 +324,64 @@ jobs:
323324
severity: 'CRITICAL,HIGH'
324325
```
325326

327+
### Using Trivy with templates
328+
The action supports [Trivy templates][trivy-templates].
329+
330+
Use `template` input to specify path (remember to prefix the path with `@`) to template file.
331+
332+
```yaml
333+
name: build
334+
on:
335+
push:
336+
branches:
337+
- main
338+
pull_request:
339+
jobs:
340+
build:
341+
name: Build
342+
runs-on: ubuntu-24.04
343+
steps:
344+
- name: Checkout code
345+
uses: actions/checkout@v3
346+
347+
- name: Run Trivy vulnerability scanner
348+
uses: aquasecurity/[email protected]
349+
with:
350+
scan-type: "fs"
351+
scan-ref: .
352+
format: 'template'
353+
template: "@path/to/my_template.tpl"
354+
```
355+
356+
#### Default templates
357+
Trivy has [default templates][trivy-default-templates].
358+
359+
By default, `setup-trivy` installs them into the `$HOME/.local/bin/trivy-bin/contrib` directory.
360+
361+
```yaml
362+
name: build
363+
on:
364+
push:
365+
branches:
366+
- main
367+
pull_request:
368+
jobs:
369+
build:
370+
name: Build
371+
runs-on: ubuntu-24.04
372+
steps:
373+
- name: Checkout code
374+
uses: actions/checkout@v3
375+
376+
- name: Run Trivy vulnerability scanner
377+
uses: aquasecurity/[email protected]
378+
with:
379+
scan-type: "fs"
380+
scan-ref: .
381+
format: 'template'
382+
template: "@$HOME/.local/bin/trivy-bin/contrib/html.tpl"
383+
```
384+
326385
### Using Trivy with GitHub Code Scanning
327386
If you have [GitHub code scanning](https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/about-code-scanning) available you can use Trivy as a scanning tool as follows:
328387
```yaml
@@ -771,7 +830,7 @@ Following inputs can be used as `step.with` keys:
771830
| `image-ref` | String | | Image reference, e.g. `alpine:3.10.2` |
772831
| `scan-ref` | String | `/github/workspace/` | Scan reference, e.g. `/github/workspace/` or `.` |
773832
| `format` | String | `table` | Output format (`table`, `json`, `template`, `sarif`, `cyclonedx`, `spdx`, `spdx-json`, `github`, `cosign-vuln`) |
774-
| `template` | String | | Output template (`@/contrib/gitlab.tpl`, `@/contrib/junit.tpl`) |
833+
| `template` | String | | Output template (`@$HOME/.local/bin/trivy-bin/contrib/gitlab.tpl`, `@$HOME/.local/bin/trivy-bin/contrib/junit.tpl`) |
775834
| `tf-vars` | String | | path to Terraform variables file |
776835
| `output` | String | | Save results to a file |
777836
| `exit-code` | String | `0` | Exit code when specified vulnerabilities are found |
@@ -791,7 +850,7 @@ Following inputs can be used as `step.with` keys:
791850
| `github-pat` | String | | Authentication token to enable sending SBOM scan results to GitHub Dependency Graph. Can be either a GitHub Personal Access Token (PAT) or GITHUB_TOKEN |
792851
| `limit-severities-for-sarif` | Boolean | false | By default *SARIF* format enforces output of all vulnerabilities regardless of configured severities. To override this behavior set this parameter to **true** |
793852
| `docker-host` | String | | By default it is set to `unix://var/run/docker.sock`, but can be updated to help with containerized infrastructure values |
794-
| `version` | String | `v0.56.1` | Trivy version to use, e.g. `latest` or `v0.56.1` |
853+
| `version` | String | `v0.56.2` | Trivy version to use, e.g. `latest` or `v0.56.2` |
795854
| `skip-setup-trivy` | Boolean | false | Skip calling the `setup-trivy` action to install `trivy` |
796855
| `token-setup-trivy` | Boolean | | Overwrite `github.token` used by `setup-trivy` to checkout the `trivy` repository |
797856

@@ -809,3 +868,5 @@ When using the `trivy-config` [Input](#inputs), you can set options using the [T
809868
[license-img]: https://img.shields.io/github/license/aquasecurity/trivy-action
810869
[trivy-env]: https://aquasecurity.github.io/trivy/latest/docs/configuration/#environment-variables
811870
[trivy-config]: https://aquasecurity.github.io/trivy/latest/docs/references/configuration/config-file/
871+
[trivy-templates]: https://aquasecurity.github.io/trivy/latest/docs/configuration/reporting/#template
872+
[trivy-default-templates]: https://aquasecurity.github.io/trivy/latest/docs/configuration/reporting/#default-templates

0 commit comments

Comments
 (0)