Added trivy.yaml #1289
Added trivy.yaml #1289
Conversation
Summary by CodeRabbit
WalkthroughThe pull request updates the CI/CD workflow by replacing inline severity parameters with a reference to an external configuration file ( Changes
Assessment against linked issues
📜 Recent review detailsConfiguration used: .coderabbit.yaml 📒 Files selected for processing (3)
🚧 Files skipped from review as they are similar to previous changes (3)
⏰ Context from checks skipped due to timeout of 90000ms (3)
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (1)
.github/workflows/trivy.yaml (1)
11-13: Environment Variable Consideration
The DOCKERHUB_USERNAME is hardcoded. If this value might change or if there’s any potential for sensitive information in the future, consider moving it to GitHub repository variables or secrets.
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
.github/workflows/run-ci-cd.yaml(0 hunks).github/workflows/trivy.yaml(1 hunks)
💤 Files with no reviewable changes (1)
- .github/workflows/run-ci-cd.yaml
🧰 Additional context used
🪛 actionlint (1.7.4)
.github/workflows/trivy.yaml
57-57: expected scalar node for string value but found sequence node with "!!seq" tag
(syntax-check)
72-72: expected scalar node for string value but found sequence node with "!!seq" tag
(syntax-check)
89-89: expected scalar node for string value but found sequence node with "!!seq" tag
(syntax-check)
104-104: expected scalar node for string value but found sequence node with "!!seq" tag
(syntax-check)
⏰ Context from checks skipped due to timeout of 90000ms (3)
- GitHub Check: Run frontend e2e tests
- GitHub Check: Run backend tests
- GitHub Check: Run frontend unit tests
🔇 Additional comments (5)
.github/workflows/trivy.yaml (5)
1-2: New Workflow Name is Descriptive
The workflow is named "Security Scans", clearly indicating its purpose of automating security scans.
3-10: Trigger Configuration is Correct
The workflow is set to trigger on the completion of the "Run CI/CD" workflow on the main branch, which aligns with the intended chain of execution.
14-28: Repository Scan Job is Properly Configured
The scan-repository job correctly checks out the code and runs the Trivy scan with appropriate parameters. The use of an explicit commit reference for actions (both checkout and Trivy) is acceptable, though consider using version tags if ongoing updates are needed.
29-42: Filesystem Scan Job is Configured Correctly
The scan-filesystem job mirrors the repository scan setup with the necessary adjustment for filesystem scanning. No issues are noted here.
1-106: Overall Workflow File Review
The new workflow for Trivy scans is well-structured with clearly separated jobs for repository, filesystem, and image scans. Once the minor YAML scalar issues with the ignore-cves parameters are addressed, the file will integrate seamlessly into the CI/CD pipeline and enhance the security scanning process.🧰 Tools
🪛 actionlint (1.7.4)
57-57: expected scalar node for string value but found sequence node with "!!seq" tag
(syntax-check)
72-72: expected scalar node for string value but found sequence node with "!!seq" tag
(syntax-check)
89-89: expected scalar node for string value but found sequence node with "!!seq" tag
(syntax-check)
104-104: expected scalar node for string value but found sequence node with "!!seq" tag
(syntax-check)
.github/workflows/trivy.yaml
Outdated
| ignore-cves: | ||
| - CVE-2025-31115 | ||
| exit-code: 1 |
There was a problem hiding this comment.
🛠️ Refactor suggestion
YAML Scalar Issue for 'ignore-cves' in Backend Staging Image Scan
Similarly, in the backend image scan step (lines 71–73), the ignore-cves field is defined as a sequence with a single item. Converting it to a scalar string will resolve the static analysis warning.
Proposed change:
- ignore-cves:
- - CVE-2025-31115
+ ignore-cves: "CVE-2025-31115"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| ignore-cves: | |
| - CVE-2025-31115 | |
| exit-code: 1 | |
| ignore-cves: "CVE-2025-31115" | |
| exit-code: 1 |
🧰 Tools
🪛 actionlint (1.7.4)
72-72: expected scalar node for string value but found sequence node with "!!seq" tag
(syntax-check)
.github/workflows/trivy.yaml
Outdated
| ignore-cves: | ||
| - CVE-2025-31115 | ||
| exit-code: 1 |
There was a problem hiding this comment.
🛠️ Refactor suggestion
YAML Scalar Issue for 'ignore-cves' in Production Backend Image Scan
For the production backend image scan (lines 103–105), the ignore-cves parameter should also be a scalar string rather than a list.
Proposed change:
- ignore-cves:
- - CVE-2025-31115
+ ignore-cves: "CVE-2025-31115"📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| ignore-cves: | |
| - CVE-2025-31115 | |
| exit-code: 1 | |
| ignore-cves: "CVE-2025-31115" | |
| exit-code: 1 |
🧰 Tools
🪛 actionlint (1.7.4)
104-104: expected scalar node for string value but found sequence node with "!!seq" tag
(syntax-check)
There was a problem hiding this comment.
This doesn't seem to introduce trivy.yaml config file as described in the issue. Instead you extracted the workflow to a separate file.
What we want is to configure trivy using trivy.yaml. It also looks like we may need .trivyignore too.
.github/workflows/trivy.yaml
Outdated
| @@ -0,0 +1,105 @@ | |||
| name: Security Scans | |||
There was a problem hiding this comment.
Why moving this out of the CI/CD scope? I think this way we won't be able to use them in needs sections.
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
.github/workflows/run-ci-cd.yaml(4 hunks).trivyignore(1 hunks)trivy.yaml(1 hunks)
✅ Files skipped from review due to trivial changes (1)
- .trivyignore
🚧 Files skipped from review as they are similar to previous changes (1)
- .github/workflows/run-ci-cd.yaml
🧰 Additional context used
🪛 YAMLlint (1.35.1)
trivy.yaml
[error] 12-12: no new line character at the end of file
(new-line-at-end-of-file)
🪛 GitHub Actions: Run CI/CD
trivy.yaml
[error] 12-12: no new line character at the end of file (new-line-at-end-of-file)
🔇 Additional comments (3)
trivy.yaml (3)
1-6: Vulnerability Block Configuration Validated
The vulnerability configuration block is well-defined and includes the necessary keys (ignorefile,ignore-unfixed,security-checks, andseverity). This centralized configuration will simplify managing scanning parameters in the CI/CD pipeline.
7-11: Filesystem Exclusion Configuration is Clear
The filesystem block correctly specifies directories (frontend/node_modules/andbackend/.venv/) to be skipped during scanning. This exclusion is important for reducing scan noise and improving scan performance.
12-12: Timeout Setting Specified
The timeout is set to10m, which appears appropriate for extensive scanning jobs. Confirm that this duration aligns well with your expected scan performance and does not lead to premature termination during heavy workloads.🧰 Tools
🪛 YAMLlint (1.35.1)
[error] 12-12: no new line character at the end of file
(new-line-at-end-of-file)
🪛 GitHub Actions: Run CI/CD
[error] 12-12: no new line character at the end of file (new-line-at-end-of-file)
trivy.yaml
Outdated
| - frontend/node_modules/ | ||
| - backend/.venv/ | ||
|
|
||
| timeout: 10m |
There was a problem hiding this comment.
Fix YAML Newline at End of File
YAML lint and the CI/CD pipeline have flagged a missing newline at the end of the file. Please add a newline after line 12 to comply with standard YAML formatting guidelines.
🧰 Tools
🪛 YAMLlint (1.35.1)
[error] 12-12: no new line character at the end of file
(new-line-at-end-of-file)
🪛 GitHub Actions: Run CI/CD
[error] 12-12: no new line character at the end of file (new-line-at-end-of-file)
|
|
@arkid15r Trivy Doc: https://github.com/aquasecurity/trivy-action#usage |
Resolves #1288