search

aquasecurity / trivy-action

Runs Trivy as GitHub action to scan your Docker container image for vulnerabilities
Apache License 2.0
729 stars 216 forks source link

action exits for sarif output, default completes, GHES self-hosted #365

Open chadhutchins182 opened 2 weeks ago

chadhutchins182 commented 2 weeks ago

I'm attempting to scan a image on a GHES 3.12 with a action runner in a docker container using @myoung34 container https://github.com/myoung34/docker-github-actions-runner.

When specifying sarif format (with and without template defined) the scan fails but no information is given why, it simply fails after stating: Building SARIF report with options: --exit-code 0 --vuln-type os,library containers.github.nrlmry.navy.mil/github-user-dashboard/gud-editor:8258c13d6368bc18e53c8dd3ffc2af306f967d38

Running with debug does not yield any additional information. However running with the default output (table) produces results and the action completes successfully.

name: Trivy Scan

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  trivy:
    runs-on: ["self-hosted"]
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Build an image from Dockerfile
        run: |
          docker build -t containers.github.nrlmry.navy.mil/github-user-dashboard/gud-editor:${{ github.sha }} .

      - name: Print workspace directory
        run: |
          echo "Workspace Directory: ${{ github.workspace }}"

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@0.20.0
        with:
          image-ref: "containers.github.nrlmry.navy.mil/github-user-dashboard/gud-editor:${{ github.sha }}"
          format: "sarif"
          output: "${{ github.workspace }}/trivy-results.sarif"
          exit-code: "0"
          scan-type: "image"
          hide-progress: "false"

      - name: Upload Trivy scan results to GitHub
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: "${{ github.workspace }}/trivy-results.sarif"
Run aquasecurity/trivy-action@0.20.0
  with:
    image-ref: containers.github.nrlmry.navy.mil/github-user-dashboard/gud-editor:8258c13d6368bc18e53c8dd3ffc2af306f967d38
    format: sarif
    output: /_work/docker-github-runner-GUD-archer/GUD-editor/GUD-editor/trivy-results.sarif
    exit-code: 0
    scan-type: image
    hide-progress: false
    scan-ref: .
    ignore-unfixed: false
    vuln-type: os,library
    severity: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
    list-all-pkgs: false
/usr/bin/docker run --name aaa0d15a7e645dce4565a3cb28db575e8a3d_805dec --label 78aaa0 --workdir /github/workspace --rm -e "INPUT_IMAGE-REF" -e "INPUT_FORMAT" -e "INPUT_OUTPUT" -e "INPUT_EXIT-CODE" -e "INPUT_SCAN-TYPE" -e "INPUT_HIDE-PROGRESS" -e "INPUT_INPUT" -e "INPUT_SCAN-REF" -e "INPUT_IGNORE-UNFIXED" -e "INPUT_VULN-TYPE" -e "INPUT_SEVERITY" -e "INPUT_TEMPLATE" -e "INPUT_SKIP-DIRS" -e "INPUT_SKIP-FILES" -e "INPUT_CACHE-DIR" -e "INPUT_TIMEOUT" -e "INPUT_IGNORE-POLICY" -e "INPUT_LIST-ALL-PKGS" -e "INPUT_SCANNERS" -e "INPUT_TRIVYIGNORES" -e "INPUT_ARTIFACT-TYPE" -e "INPUT_GITHUB-PAT" -e "INPUT_TRIVY-CONFIG" -e "INPUT_TF-VARS" -e "INPUT_LIMIT-SEVERITIES-FOR-SARIF" -e "INPUT_DOCKER-HOST" -e "HOME" -e "GITHUB_JOB" -e "GITHUB_REF" -e "GITHUB_SHA" -e "GITHUB_REPOSITORY" -e "GITHUB_REPOSITORY_OWNER" -e "GITHUB_REPOSITORY_OWNER_ID" -e "GITHUB_RUN_ID" -e "GITHUB_RUN_NUMBER" -e "GITHUB_RETENTION_DAYS" -e "GITHUB_RUN_ATTEMPT" -e "GITHUB_REPOSITORY_ID" -e "GITHUB_ACTOR_ID" -e "GITHUB_ACTOR" -e "GITHUB_TRIGGERING_ACTOR" -e "GITHUB_WORKFLOW" -e "GITHUB_HEAD_REF" -e "GITHUB_BASE_REF" -e "GITHUB_EVENT_NAME" -e "GITHUB_SERVER_URL" -e "GITHUB_API_URL" -e "GITHUB_GRAPHQL_URL" -e "GITHUB_REF_NAME" -e "GITHUB_REF_PROTECTED" -e "GITHUB_REF_TYPE" -e "GITHUB_WORKFLOW_REF" -e "GITHUB_WORKFLOW_SHA" -e "GITHUB_WORKSPACE" -e "GITHUB_ACTION" -e "GITHUB_EVENT_PATH" -e "GITHUB_ACTION_REPOSITORY" -e "GITHUB_ACTION_REF" -e "GITHUB_PATH" -e "GITHUB_ENV" -e "GITHUB_STEP_SUMMARY" -e "GITHUB_STATE" -e "GITHUB_OUTPUT" -e "RUNNER_DEBUG" -e "RUNNER_OS" -e "RUNNER_ARCH" -e "RUNNER_NAME" -e "RUNNER_ENVIRONMENT" -e "RUNNER_TOOL_CACHE" -e "RUNNER_TEMP" -e "RUNNER_WORKSPACE" -e "ACTIONS_RUNTIME_URL" -e "ACTIONS_RUNTIME_TOKEN" -e "ACTIONS_CACHE_URL" -e GITHUB_ACTIONS=true -e CI=true -v "/var/run/docker.sock":"/var/run/docker.sock" -v "/_work/docker-github-runner-GUD-archer/_temp/_github_home":"/github/home" -v "/_work/docker-github-runner-GUD-archer/_temp/_github_workflow":"/github/workflow" -v "/_work/docker-github-runner-GUD-archer/_temp/_runner_file_commands":"/github/file_commands" -v "/_work/docker-github-runner-GUD-archer/GUD-editor/GUD-editor":"/github/workspace" 78aaa0:d15a7e645dce4565a3cb28db575e8a3d  "-a image" "-b sarif" "-c " "-d 0" "-e false" "-f os,library" "-g UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL" "-h /_work/docker-github-runner-GUD-archer/GUD-editor/GUD-editor/trivy-results.sarif" "-i containers.github.nrlmry.navy.mil/github-user-dashboard/gud-editor:8258c13d6368bc18e53c8dd3ffc2af306f967d38" "-j ." "-k " "-l " "-m " "-n " "-o " "-p false" "-q " "-r false" "-s " "-t " "-u " "-v " "-x " "-z " "-y "
Building SARIF report with options:  --exit-code  0 --vuln-type  os,library  containers.github.nrlmry.navy.mil/github-user-dashboard/gud-editor:8258c13d6368bc18e53c8dd3ffc2af306f967d38
##[debug]Docker Action run completed with exit code 1
##[debug]Finishing: Run Trivy vulnerability scanner
0s
##[debug]Evaluating condition for step: 'Upload Trivy scan results to GitHub'
##[debug]Evaluating: success()
##[debug]Evaluating success:
##[debug]=> false
##[debug]Result: false

I've logged into the runner container to see if the sarif file is produced, and it is not. I've tried JSON as well and that fails a bit differently: 

Run aquasecurity/trivy-action@0.20.0
  with:
    image-ref: containers.github.nrlmry.navy.mil/github-user-dashboard/gud-editor:85e7ac5da65fdeb4e2e891b4703d7733b4f9f402
    format: json
    output: /_work/docker-github-runner-GUD-archer/GUD-editor/GUD-editor/trivy-results.json
    exit-code: 0
    scan-type: image
    hide-progress: false
    scan-ref: .
    ignore-unfixed: false
    vuln-type: os,library
    severity: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
    list-all-pkgs: false
/usr/bin/docker run --name aaa0de75adcb2783477da2a448bb3448bdf4_6c3d6a --label 78aaa0 --workdir /github/workspace --rm -e "INPUT_IMAGE-REF" -e "INPUT_FORMAT" -e "INPUT_OUTPUT" -e "INPUT_EXIT-CODE" -e "INPUT_SCAN-TYPE" -e "INPUT_HIDE-PROGRESS" -e "INPUT_INPUT" -e "INPUT_SCAN-REF" -e "INPUT_IGNORE-UNFIXED" -e "INPUT_VULN-TYPE" -e "INPUT_SEVERITY" -e "INPUT_TEMPLATE" -e "INPUT_SKIP-DIRS" -e "INPUT_SKIP-FILES" -e "INPUT_CACHE-DIR" -e "INPUT_TIMEOUT" -e "INPUT_IGNORE-POLICY" -e "INPUT_LIST-ALL-PKGS" -e "INPUT_SCANNERS" -e "INPUT_TRIVYIGNORES" -e "INPUT_ARTIFACT-TYPE" -e "INPUT_GITHUB-PAT" -e "INPUT_TRIVY-CONFIG" -e "INPUT_TF-VARS" -e "INPUT_LIMIT-SEVERITIES-FOR-SARIF" -e "INPUT_DOCKER-HOST" -e "HOME" -e "GITHUB_JOB" -e "GITHUB_REF" -e "GITHUB_SHA" -e "GITHUB_REPOSITORY" -e "GITHUB_REPOSITORY_OWNER" -e "GITHUB_REPOSITORY_OWNER_ID" -e "GITHUB_RUN_ID" -e "GITHUB_RUN_NUMBER" -e "GITHUB_RETENTION_DAYS" -e "GITHUB_RUN_ATTEMPT" -e "GITHUB_REPOSITORY_ID" -e "GITHUB_ACTOR_ID" -e "GITHUB_ACTOR" -e "GITHUB_TRIGGERING_ACTOR" -e "GITHUB_WORKFLOW" -e "GITHUB_HEAD_REF" -e "GITHUB_BASE_REF" -e "GITHUB_EVENT_NAME" -e "GITHUB_SERVER_URL" -e "GITHUB_API_URL" -e "GITHUB_GRAPHQL_URL" -e "GITHUB_REF_NAME" -e "GITHUB_REF_PROTECTED" -e "GITHUB_REF_TYPE" -e "GITHUB_WORKFLOW_REF" -e "GITHUB_WORKFLOW_SHA" -e "GITHUB_WORKSPACE" -e "GITHUB_ACTION" -e "GITHUB_EVENT_PATH" -e "GITHUB_ACTION_REPOSITORY" -e "GITHUB_ACTION_REF" -e "GITHUB_PATH" -e "GITHUB_ENV" -e "GITHUB_STEP_SUMMARY" -e "GITHUB_STATE" -e "GITHUB_OUTPUT" -e "RUNNER_DEBUG" -e "RUNNER_OS" -e "RUNNER_ARCH" -e "RUNNER_NAME" -e "RUNNER_ENVIRONMENT" -e "RUNNER_TOOL_CACHE" -e "RUNNER_TEMP" -e "RUNNER_WORKSPACE" -e "ACTIONS_RUNTIME_URL" -e "ACTIONS_RUNTIME_TOKEN" -e "ACTIONS_CACHE_URL" -e GITHUB_ACTIONS=true -e CI=true -v "/var/run/docker.sock":"/var/run/docker.sock" -v "/_work/docker-github-runner-GUD-archer/_temp/_github_home":"/github/home" -v "/_work/docker-github-runner-GUD-archer/_temp/_github_workflow":"/github/workflow" -v "/_work/docker-github-runner-GUD-archer/_temp/_runner_file_commands":"/github/file_commands" -v "/_work/docker-github-runner-GUD-archer/GUD-editor/GUD-editor":"/github/workspace" 78aaa0:de75adcb2783477da2a448bb3448bdf4  "-a image" "-b json" "-c " "-d 0" "-e false" "-f os,library" "-g UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL" "-h /_work/docker-github-runner-GUD-archer/GUD-editor/GUD-editor/trivy-results.json" "-i containers.github.nrlmry.navy.mil/github-user-dashboard/gud-editor:85e7ac5da65fdeb4e2e891b4703d7733b4f9f402" "-j ." "-k " "-l " "-m " "-n " "-o " "-p false" "-q " "-r false" "-s " "-t " "-u " "-v " "-x " "-z " "-y "
Running trivy with options: trivy image  --format json --exit-code  0 --vuln-type  os,library --severity  UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL --output  /_work/docker-github-runner-GUD-archer/GUD-editor/GUD-editor/trivy-results.json  containers.github.nrlmry.navy.mil/github-user-dashboard/gud-editor:85e7ac5da65fdeb4e2e891b4703d7733b4f9f402
Global options:  
2024-06-12T17:30:45Z    INFO    Vulnerability scanning is enabled
2024-06-12T17:30:45Z    INFO    Secret scanning is enabled
2024-06-12T17:30:45Z    INFO    If your scanning is slow, please try '--scanners vuln' to disable secret scanning
2024-06-12T17:30:45Z    INFO    Please see also https://aquasecurity.github.io/trivy/v0.51/docs/scanner/secret/#recommendation for faster secret detection
2024-06-12T17:30:56Z    INFO    Detected OS family="debian" version="12.4"
2024-06-12T17:30:56Z    INFO    [debian] Detecting vulnerabilities...   os_version="12" pkg_num=413
2024-06-12T17:30:56Z    INFO    Number of language-specific files   num=1
2024-06-12T17:30:56Z    INFO    [node-pkg] Detecting vulnerabilities...
2024-06-12T17:30:57Z    FATAL   Fatal error report error: unable to write results: failed to create a file: failed to create output file: open /_work/docker-github-runner-GUD-archer/GUD-editor/GUD-editor/trivy-results.json: no such file or directory
##[debug]Docker Action run completed with exit code 1
##[debug]Finishing: Run Trivy vulnerability scanner

Any help in figuring out how to diagnose this would be greatly appreciated!