Break workflow when using sarif

[javixeneize]

Hi

Im trying to run trivy, generate a sarif report, upload the artifact, and then, depending on the vulnerabilities, break the workflow or allow it to continue.

Im setting something like this:

  - name: Run Trivy vulnerability scanner
    uses: aquasecurity/trivy-action@master
    with:
      image-ref: 'javidr/vulnerbank:latest'
      format: 'template'
      template: '@/contrib/sarif.tpl'
      output: 'trivy-results.sarif'
      exit-code: '1'
      severity: 'LOW'
  - name: Upload artifact
    uses: actions/upload-artifact@v2
    with:
      name: trivy report
      path: 'trivy-results.sarif'

If i set exit-code, then, the upload artifact step is not executed. Is there any way to do it? Maybe upload artifact can be embedded as an option in the action?

Thanks

[simar7]

hi @javixeneize - you could set a conditional of - if: always() with your Upload artifact step.

Something like this:

  - name: Run Trivy vulnerability scanner
    uses: aquasecurity/trivy-action@master
    with:
      image-ref: 'javidr/vulnerbank:latest'
      format: 'template'
      template: '@/contrib/sarif.tpl'
      output: 'trivy-results.sarif'
      exit-code: '1'
      severity: 'LOW'
  - if: always()
    name: Upload artifact
    uses: actions/upload-artifact@v2
    with:
      name: trivy report
      path: 'trivy-results.sarif'

More details here https://docs.github.com/en/actions/reference/context-and-expression-syntax-for-github-actions

Hope that helps.

[javixeneize]

Yeah it should work, but maybe it is also a good idea to add an option do save the report directly inside the action without having to add that step

Thanks!