Skip to content

Commit 5e9435a

Browse files
sidnhssidnhs
authored
CCM-15550: Disable Trivy in CI (#99)
1 parent 97ce319 commit 5e9435a

7 files changed

Lines changed: 101 additions & 93 deletions

File tree

‎.github/PULL_REQUEST_TEMPLATE.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
- [ ] I have added tests to cover my changes
2626
- [ ] I have updated the documentation accordingly
2727
- [ ] This PR is a result of pair or mob programming
28-
- [ ] If I have used the 'skip-trivy-package' label I have done so responsibly and in the knowledge that this is being fixed as part of a separate ticket/PR.
28+
<!-- - [ ] If I have used the 'skip-trivy-package' label I have done so responsibly and in the knowledge that this is being fixed as part of a separate ticket/PR. TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549 -->
2929

3030
---
3131

‎.github/actions/trivy-iac/action.yaml‎

Lines changed: 19 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,20 @@
1-
name: "Trivy IaC Scan"
2-
description: "Scan Terraform IaC using Trivy"
3-
runs:
4-
using: "composite"
5-
steps:
6-
- name: "Trivy Terraform IaC Scan"
7-
shell: bash
8-
run: |
9-
components_exit_code=0
10-
modules_exit_code=0
11-
asdf plugin add trivy || true
12-
asdf install trivy || true
13-
./scripts/terraform/trivy-scan.sh --mode iac ./infrastructure/terraform/components || components_exit_code=$?
14-
./scripts/terraform/trivy-scan.sh --mode iac ./infrastructure/terraform/modules || modules_exit_code=$?
1+
#TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
2+
# name: "Trivy IaC Scan"
3+
# description: "Scan Terraform IaC using Trivy"
4+
# runs:
5+
# using: "composite"
6+
# steps:
7+
# - name: "Trivy Terraform IaC Scan"
8+
# shell: bash
9+
# run: |
10+
# components_exit_code=0
11+
# modules_exit_code=0
12+
# asdf plugin add trivy || true
13+
# asdf install trivy || true
14+
# ./scripts/terraform/trivy-scan.sh --mode iac ./infrastructure/terraform/components || components_exit_code=$?
15+
# ./scripts/terraform/trivy-scan.sh --mode iac ./infrastructure/terraform/modules || modules_exit_code=$?
1516

16-
if [ $components_exit_code -ne 0 ] || [ $modules_exit_code -ne 0 ]; then
17-
echo "Trivy misconfigurations detected."
18-
exit 1
19-
fi
17+
# if [ $components_exit_code -ne 0 ] || [ $modules_exit_code -ne 0 ]; then
18+
# echo "Trivy misconfigurations detected."
19+
# exit 1
20+
# fi

‎.github/actions/trivy-package/action.yaml‎

Lines changed: 17 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,18 @@
1-
name: "Trivy Package Scan"
2-
description: "Scan project packages using Trivy"
3-
runs:
4-
using: "composite"
5-
steps:
6-
- name: "Trivy Package Scan"
7-
shell: bash
8-
run: |
9-
exit_code=0
10-
asdf plugin add trivy || true
11-
asdf install trivy || true
12-
./scripts/terraform/trivy-scan.sh --mode package . || exit_code=$?
1+
#TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
2+
# name: "Trivy Package Scan"
3+
# description: "Scan project packages using Trivy"
4+
# runs:
5+
# using: "composite"
6+
# steps:
7+
# - name: "Trivy Package Scan"
8+
# shell: bash
9+
# run: |
10+
# exit_code=0
11+
# asdf plugin add trivy || true
12+
# asdf install trivy || true
13+
# ./scripts/terraform/trivy-scan.sh --mode package . || exit_code=$?
1314

14-
if [ $exit_code -ne 0 ]; then
15-
echo "Trivy has detected package vulnerablilites. Please refer to https://nhsd-confluence.digital.nhs.uk/spaces/RIS/pages/1257636917/PLAT-KOP-012+-+Trivy+Pipeline+Vulnerability+Scanning+Exemption"
16-
exit 1
17-
fi
15+
# if [ $exit_code -ne 0 ]; then
16+
# echo "Trivy has detected package vulnerablilites. Please refer to https://nhsd-confluence.digital.nhs.uk/spaces/RIS/pages/1257636917/PLAT-KOP-012+-+Trivy+Pipeline+Vulnerability+Scanning+Exemption"
17+
# exit 1
18+
# fi

‎.github/workflows/cicd-1-pull-request.yaml‎

Lines changed: 23 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,8 @@ jobs:
2828
is_version_prerelease: ${{ steps.variables.outputs.is_version_prerelease }}
2929
does_pull_request_exist: ${{ steps.pr_exists.outputs.does_pull_request_exist }}
3030
pr_number: ${{ steps.pr_exists.outputs.pr_number }}
31-
skip_trivy_package: ${{ steps.skip_trivy.outputs.skip_trivy_package }}
31+
#TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
32+
# skip_trivy_package: ${{ steps.skip_trivy.outputs.skip_trivy_package }}
3233
steps:
3334
- name: "Checkout code"
3435
uses: actions/checkout@v4
@@ -68,26 +69,27 @@ jobs:
6869
echo "does_pull_request_exist=false" >> $GITHUB_OUTPUT
6970
echo "pr_number=" >> $GITHUB_OUTPUT
7071
fi
71-
- name: "Determine if Trivy package scan should be skipped"
72-
id: skip_trivy
73-
env:
74-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
75-
PR_NUMBER: ${{ steps.pr_exists.outputs.pr_number }}
76-
run: |
77-
if [[ -z "$PR_NUMBER" ]]; then
78-
echo "No pull request detected; Trivy package scan will run."
79-
echo "skip_trivy_package=false" >> $GITHUB_OUTPUT
80-
exit 0
81-
fi
72+
#TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
73+
# - name: "Determine if Trivy package scan should be skipped"
74+
# id: skip_trivy
75+
# env:
76+
# GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
77+
# PR_NUMBER: ${{ steps.pr_exists.outputs.pr_number }}
78+
# run: |
79+
# if [[ -z "$PR_NUMBER" ]]; then
80+
# echo "No pull request detected; Trivy package scan will run."
81+
# echo "skip_trivy_package=false" >> $GITHUB_OUTPUT
82+
# exit 0
83+
# fi
8284

83-
labels=$(gh pr view "$PR_NUMBER" --json labels --jq '.labels[].name')
84-
echo "Labels on PR #$PR_NUMBER: $labels"
85+
# labels=$(gh pr view "$PR_NUMBER" --json labels --jq '.labels[].name')
86+
# echo "Labels on PR #$PR_NUMBER: $labels"
8587

86-
if echo "$labels" | grep -Fxq 'skip-trivy-package'; then
87-
echo "skip_trivy_package=true" >> $GITHUB_OUTPUT
88-
else
89-
echo "skip_trivy_package=false" >> $GITHUB_OUTPUT
90-
fi
88+
# if echo "$labels" | grep -Fxq 'skip-trivy-package'; then
89+
# echo "skip_trivy_package=true" >> $GITHUB_OUTPUT
90+
# else
91+
# echo "skip_trivy_package=false" >> $GITHUB_OUTPUT
92+
# fi
9193
- name: "List variables"
9294
run: |
9395
export BUILD_DATETIME_LONDON="${{ steps.variables.outputs.build_datetime_london }}"
@@ -111,7 +113,8 @@ jobs:
111113
build_epoch: "${{ needs.metadata.outputs.build_epoch }}"
112114
nodejs_version: "${{ needs.metadata.outputs.nodejs_version }}"
113115
python_version: "${{ needs.metadata.outputs.python_version }}"
114-
skip_trivy_package: ${{ needs.metadata.outputs.skip_trivy_package == 'true' }}
116+
#TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
117+
# skip_trivy_package: ${{ needs.metadata.outputs.skip_trivy_package == 'true' }}
115118
terraform_version: "${{ needs.metadata.outputs.terraform_version }}"
116119
version: "${{ needs.metadata.outputs.version }}"
117120
secrets: inherit

‎.github/workflows/stage-1-commit.yaml‎

Lines changed: 35 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -23,10 +23,11 @@ on:
2323
description: "Python version, set by the CI/CD pipeline workflow"
2424
required: true
2525
type: string
26-
skip_trivy_package:
27-
description: "Skip Trivy package scan when true"
28-
type: boolean
29-
default: false
26+
#TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
27+
# skip_trivy_package:
28+
# description: "Skip Trivy package scan when true"
29+
# type: boolean
30+
# default: false
3031
terraform_version:
3132
description: "Terraform version, set by the CI/CD pipeline workflow"
3233
required: true
@@ -152,35 +153,36 @@ jobs:
152153
uses: asdf-vm/actions/setup@1902764435ca0dd2f3388eea723a4f92a4eb8302
153154
- name: "Lint Terraform"
154155
uses: ./.github/actions/lint-terraform
155-
trivy-iac:
156-
name: "Trivy IaC Scan"
157-
permissions:
158-
contents: read
159-
runs-on: ubuntu-latest
160-
timeout-minutes: 10
161-
needs: detect-terraform-changes
162-
if: needs.detect-terraform-changes.outputs.terraform_changed == 'true'
163-
steps:
164-
- name: "Checkout code"
165-
uses: actions/checkout@v4
166-
- name: "Setup ASDF"
167-
uses: asdf-vm/actions/setup@1902764435ca0dd2f3388eea723a4f92a4eb8302
168-
- name: "Trivy IaC Scan"
169-
uses: ./.github/actions/trivy-iac
170-
trivy-package:
171-
if: ${{ !inputs.skip_trivy_package }}
172-
name: "Trivy Package Scan"
173-
permissions:
174-
contents: read
175-
runs-on: ubuntu-latest
176-
timeout-minutes: 10
177-
steps:
178-
- name: "Checkout code"
179-
uses: actions/checkout@v4
180-
- name: "Setup ASDF"
181-
uses: asdf-vm/actions/setup@1902764435ca0dd2f3388eea723a4f92a4eb8302
182-
- name: "Trivy Package Scan"
183-
uses: ./.github/actions/trivy-package
156+
#TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
157+
# trivy-iac:
158+
# name: "Trivy IaC Scan"
159+
# permissions:
160+
# contents: read
161+
# runs-on: ubuntu-latest
162+
# timeout-minutes: 10
163+
# needs: detect-terraform-changes
164+
# if: needs.detect-terraform-changes.outputs.terraform_changed == 'true'
165+
# steps:
166+
# - name: "Checkout code"
167+
# uses: actions/checkout@v4
168+
# - name: "Setup ASDF"
169+
# uses: asdf-vm/actions/setup@1902764435ca0dd2f3388eea723a4f92a4eb8302
170+
# - name: "Trivy IaC Scan"
171+
# uses: ./.github/actions/trivy-iac
172+
# trivy-package:
173+
# if: ${{ !inputs.skip_trivy_package }}
174+
# name: "Trivy Package Scan"
175+
# permissions:
176+
# contents: read
177+
# runs-on: ubuntu-latest
178+
# timeout-minutes: 10
179+
# steps:
180+
# - name: "Checkout code"
181+
# uses: actions/checkout@v4
182+
# - name: "Setup ASDF"
183+
# uses: asdf-vm/actions/setup@1902764435ca0dd2f3388eea723a4f92a4eb8302
184+
# - name: "Trivy Package Scan"
185+
# uses: ./.github/actions/trivy-package
184186
count-lines-of-code:
185187
name: "Count lines of code"
186188
runs-on: ubuntu-latest

‎.tool-versions‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,9 @@ nodejs 22.11.0
55
pre-commit 3.6.0
66
terraform 1.14.3
77
terraform-docs 0.21.0
8-
trivy 0.69.3
98
vale 3.6.0
109
python 3.13.2
10+
# trivy 0.69.3 - TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
1111

1212
# ==============================================================================
1313
# The section below is reserved for Docker image versions.

‎scripts/terraform/terraform.mk‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -118,9 +118,10 @@ terraform-validate-all: # Validate all Terraform components @Quality
118118
fi; \
119119
done
120120

121-
terraform-sec: # Run Trivy IaC security scanning on Terraform code @Quality
122-
# Example: make terraform-sec
123-
./scripts/terraform/trivy-scan.sh --mode iac infrastructure/terraform
121+
#TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
122+
# terraform-sec: # Run Trivy IaC security scanning on Terraform code @Quality
123+
# # Example: make terraform-sec
124+
# ./scripts/terraform/trivy-scan.sh --mode iac infrastructure/terraform
124125

125126
terraform-docs: # Generate Terraform documentation - optional: component=[specific component, or all if omitted] @Quality
126127
# Example: make terraform-docs component=mycomp
@@ -168,6 +169,6 @@ ${VERBOSE}.SILENT: \
168169
terraform-output \
169170
terraform-plan \
170171
terraform-plan-destroy \
171-
terraform-sec \
172+
# terraform-sec \
172173
terraform-validate \
173174
terraform-validate-all \

0 commit comments

Comments
 (0)