Skip to content

Commit 7b145fb

Browse files
adilhusain-sadilhusain-s
committed
feat(docker): update Trivy version to v0.68.1 and add enhanced gate script with logging
1 parent 3563a26 commit 7b145fb

File tree

2 files changed

+72
-71
lines changed

2 files changed

+72
-71
lines changed

‎python-versions/Dockerfile‎

Lines changed: 3 additions & 71 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ ARG BASE_IMAGE=powershell:ubuntu-${UBUNTU_VERSION}
44
ARG TARGETARCH
55
ARG PYTHON_VERSION=3.13.3
66
ARG ACTIONS_PYTHON_VERSIONS=3.13.3-14344076652
7-
ARG TRIVY_VERSION=v0.58.1
7+
ARG TRIVY_VERSION=v0.68.1
88

99
# ================= BUILDER STAGE =====================
1010
FROM ${BASE_IMAGE} AS builder
@@ -85,76 +85,8 @@ RUN trivy --download-db-only || true; \
8585
trivy fs --format json --output /tmp/artifact/trivy-${PYTHON_VERSION}-${TARGETARCH}-vuln.json --scanners vuln ${PYTHON_INSTALL_DIR} || true && \
8686
trivy fs --format json --output /tmp/artifact/trivy-${PYTHON_VERSION}-${TARGETARCH}-secret.json --scanners secret,misconfig ${PYTHON_INSTALL_DIR} || true
8787

88-
# Enhanced Gate Script with Logging
89-
COPY <<EOF /usr/local/bin/trivy-gate.sh
90-
#!/bin/sh
91-
set +e
92-
93-
# Logging Helper
94-
log() {
95-
echo "[\$(date +'%Y-%m-%d %H:%M:%S')] \$1"
96-
}
97-
98-
# Inputs
99-
VULN_JSON=\${1:-/tmp/artifact/trivy-${PYTHON_VERSION}-${TARGETARCH}-vuln.json}
100-
SECRET_JSON=\${2:-/tmp/artifact/trivy-${PYTHON_VERSION}-${TARGETARCH}-secret.json}
101-
GATE_RESULT=/tmp/artifact/trivy-gate-result.json
102-
FLAT_REPORT=/tmp/artifact/trivy-flat-report.json
103-
104-
# Thresholds
105-
FAIL_ON_CRITICAL=\${FAIL_ON_CRITICAL:-1}
106-
FAIL_ON_HIGH=\${FAIL_ON_HIGH:-0}
107-
FAIL_ON_MEDIUM=\${FAIL_ON_MEDIUM:-0}
108-
FAIL_ON_SECRET=\${FAIL_ON_SECRET:-1}
109-
110-
log "--- Parsing Trivy Results ---"
111-
112-
# 1. FLATTEN THE DATA
113-
if [ -f "\$VULN_JSON" ]; then
114-
log "Flattening vulnerability report..."
115-
jq '[.Results[] | .Target as \$t | .Vulnerabilities[]? | . + {"Target": \$t}]' "\$VULN_JSON" > "\$FLAT_REPORT"
116-
else
117-
log "No vulnerability report found. Assuming 0 vulnerabilities."
118-
echo "[]" > "\$FLAT_REPORT"
119-
fi
120-
121-
# 2. ANALYZE SEVERITY
122-
critical=\$(jq '[.[] | select(.Severity=="CRITICAL")] | length' "\$FLAT_REPORT")
123-
high=\$(jq '[.[] | select(.Severity=="HIGH")] | length' "\$FLAT_REPORT")
124-
medium=\$(jq '[.[] | select(.Severity=="MEDIUM")] | length' "\$FLAT_REPORT")
125-
126-
if [ -f "\$SECRET_JSON" ]; then
127-
secrets=\$(jq '[.Results[].Secrets[]?] | length' "\$SECRET_JSON" 2>/dev/null || echo 0)
128-
else
129-
secrets=0
130-
fi
131-
132-
log "Analysis Complete: CRITICAL=\$critical HIGH=\$high MEDIUM=\$medium SECRETS=\$secrets"
133-
134-
# 3. DETAILED LOGGING
135-
if [ "\$critical" -gt 0 ]; then
136-
log "!!! CRITICAL VULNERABILITIES FOUND !!!"
137-
jq -r '.[] | select(.Severity=="CRITICAL") | " - [\$t] \(.PkgName) (\(.VulnerabilityID)) in \(.Target)"' "\$FLAT_REPORT"
138-
fi
139-
140-
# 4. DECISION LOGIC
141-
BLOCK=false
142-
REASON="none"
143-
144-
if [ "\$FAIL_ON_CRITICAL" -eq 1 ] && [ "\$critical" -gt 0 ]; then BLOCK=true; REASON="critical"; fi
145-
if [ "\$FAIL_ON_HIGH" -eq 1 ] && [ "\$high" -gt 0 ]; then BLOCK=true; REASON="high"; fi
146-
if [ "\$FAIL_ON_SECRET" -eq 1 ] && [ "\$secrets" -gt 0 ]; then BLOCK=true; REASON="secrets"; fi
147-
148-
printf '{"critical":%d,"high":%d,"medium":%d,"secrets":%d,"block":%s,"reason":"%s"}\n' "\$critical" "\$high" "\$medium" "\$secrets" "\$BLOCK" "\$REASON" > "\$GATE_RESULT"
149-
150-
if [ "\$BLOCK" = "true" ]; then
151-
log "GATE FAILED: Blocking due to \$REASON severity."
152-
exit 1
153-
else
154-
log "GATE PASSED."
155-
exit 0
156-
fi
157-
EOF
88+
# Copy Enhanced Gate Script with Logging
89+
COPY trivy-gate.sh /usr/local/bin/trivy-gate.sh
15890
RUN chmod +x /usr/local/bin/trivy-gate.sh
15991

16092
# Run the Gate and Capture Log

‎python-versions/trivy-gate.sh‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
#!/bin/sh
2+
set +e
3+
4+
# Logging Helper
5+
log() {
6+
echo "[$(date +'%Y-%m-%d %H:%M:%S')] $1"
7+
}
8+
9+
# Inputs
10+
VULN_JSON=${1:-/tmp/artifact/trivy-${PYTHON_VERSION}-${TARGETARCH}-vuln.json}
11+
SECRET_JSON=${2:-/tmp/artifact/trivy-${PYTHON_VERSION}-${TARGETARCH}-secret.json}
12+
GATE_RESULT=/tmp/artifact/trivy-gate-result.json
13+
FLAT_REPORT=/tmp/artifact/trivy-flat-report.json
14+
15+
# Thresholds
16+
FAIL_ON_CRITICAL=${FAIL_ON_CRITICAL:-1}
17+
FAIL_ON_HIGH=${FAIL_ON_HIGH:-0}
18+
FAIL_ON_MEDIUM=${FAIL_ON_MEDIUM:-0}
19+
FAIL_ON_SECRET=${FAIL_ON_SECRET:-1}
20+
21+
log "--- Parsing Trivy Results ---"
22+
23+
# 1. FLATTEN THE DATA
24+
if [ -f "$VULN_JSON" ]; then
25+
log "Flattening vulnerability report..."
26+
jq '[.Results[] | .Target as $t | .Vulnerabilities[]? | . + {"Target": $t}]' "$VULN_JSON" > "$FLAT_REPORT"
27+
else
28+
log "No vulnerability report found. Assuming 0 vulnerabilities."
29+
echo "[]" > "$FLAT_REPORT"
30+
fi
31+
32+
# 2. ANALYZE SEVERITY
33+
critical=$(jq '[.[] | select(.Severity=="CRITICAL")] | length' "$FLAT_REPORT")
34+
high=$(jq '[.[] | select(.Severity=="HIGH")] | length' "$FLAT_REPORT")
35+
medium=$(jq '[.[] | select(.Severity=="MEDIUM")] | length' "$FLAT_REPORT")
36+
37+
if [ -f "$SECRET_JSON" ]; then
38+
secrets=$(jq '[.Results[].Secrets[]?] | length' "$SECRET_JSON" 2>/dev/null || echo 0)
39+
else
40+
secrets=0
41+
fi
42+
43+
log "Analysis Complete: CRITICAL=$critical HIGH=$high MEDIUM=$medium SECRETS=$secrets"
44+
45+
# 3. DETAILED LOGGING
46+
if [ "$critical" -gt 0 ]; then
47+
log "!!! CRITICAL VULNERABILITIES FOUND !!!"
48+
jq -r '.[] | select(.Severity=="CRITICAL") | " - [$t] \(.PkgName) (\(.VulnerabilityID)) in \(.Target)"' "$FLAT_REPORT"
49+
fi
50+
51+
# 4. DECISION LOGIC
52+
BLOCK=false
53+
REASON="none"
54+
55+
# Check in priority order: CRITICAL > HIGH > MEDIUM > SECRETS
56+
if [ "$FAIL_ON_CRITICAL" -eq 1 ] && [ "$critical" -gt 0 ]; then BLOCK=true; REASON="critical"; fi
57+
if [ "$FAIL_ON_HIGH" -eq 1 ] && [ "$high" -gt 0 ] && [ "$REASON" = "none" ]; then BLOCK=true; REASON="high"; fi
58+
if [ "$FAIL_ON_MEDIUM" -eq 1 ] && [ "$medium" -gt 0 ] && [ "$REASON" = "none" ]; then BLOCK=true; REASON="medium"; fi
59+
if [ "$FAIL_ON_SECRET" -eq 1 ] && [ "$secrets" -gt 0 ] && [ "$REASON" = "none" ]; then BLOCK=true; REASON="secrets"; fi
60+
61+
printf '{"critical":%d,"high":%d,"medium":%d,"secrets":%d,"block":%s,"reason":"%s"}\n' "$critical" "$high" "$medium" "$secrets" "$BLOCK" "$REASON" > "$GATE_RESULT"
62+
63+
if [ "$BLOCK" = "true" ]; then
64+
log "GATE FAILED: Blocking due to $REASON severity."
65+
exit 1
66+
else
67+
log "GATE PASSED."
68+
exit 0
69+
fi

0 commit comments

Comments
 (0)