update: added Trivy CVE scan to service images - #1290
Conversation
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
📝 WalkthroughWalkthroughAdds a reusable Trivy workflow for container image CVE scanning and wires the Knowlg and search service build workflows to expose pushed image references and trigger conditional scan jobs. ChangesCVE scan integration
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (1)
.github/workflows/cve-scan.yml (1)
31-32: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winDisable checkout credential persistence.
actions/checkoutdefaultspersist-credentialstotrue, unnecessarily retaining Git credentials for later steps, including the third-party scanner. Set it tofalseor remove checkout if no repository files are needed. (github.com)Proposed fix
- name: Checkout code uses: actions/checkout@v4 + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/cve-scan.yml around lines 31 - 32, Update the actions/checkout step in the CVE scan workflow to disable credential persistence by setting persist-credentials to false; keep the checkout step otherwise unchanged.Sources: MCP tools, Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/cve-scan.yml:
- Around line 34-35: Update the CVE scan workflow’s registry login step to
authenticate against the registry owning inputs.image rather than hardcoding
ghcr.io. Add the required registry-specific credential inputs to the reusable
workflow and use those inputs with the configured REGISTRY_URL, preserving the
existing docker login flow for all supported private registries.
- Around line 41-43: Update the Trivy configuration in the workflow’s SARIF
output block to enable the limit-severities-for-sarif option, while retaining
severity: HIGH,CRITICAL, so generated SARIF findings contain only HIGH and
CRITICAL results.
In @.github/workflows/knowlg-service.yml:
- Around line 111-113: Update the reusable workflow references from
cve-check.yml to the existing cve-scan.yml in
.github/workflows/knowlg-service.yml lines 111-113 and
.github/workflows/search-service.yml lines 106-108, preserving the existing
image input.
- Line 101: Remove secret-derived REGISTRY_URL from the image outputs in the
image-build steps of .github/workflows/knowlg-service.yml (line 101) and
.github/workflows/search-service.yml (line 96); output only non-secret image
components such as name, tag, and repository, then pass the registry
configuration separately as secrets to cve-check.yml while preserving the
cve-scan job inputs.
---
Nitpick comments:
In @.github/workflows/cve-scan.yml:
- Around line 31-32: Update the actions/checkout step in the CVE scan workflow
to disable credential persistence by setting persist-credentials to false; keep
the checkout step otherwise unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro Plus
Run ID: 83b3f5fc-7328-4628-ab64-6bb8570efc87
📒 Files selected for processing (3)
.github/workflows/cve-scan.yml.github/workflows/knowlg-service.yml.github/workflows/search-service.yml
| - name: Log in to GHCR | ||
| run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
Authenticate against the registry that owns inputs.image.
Both service workflows push to configurable REGISTRY_URL values, but this job only logs into ghcr.io. Scans will fail for Azure, GCP, OCI, or other private registries unless registry-specific credentials are passed to this reusable workflow and used here.
🧰 Tools
🪛 zizmor (1.26.1)
[error] 35-35: code injection via template expansion (template-injection): may expand into attacker-controllable code
(template-injection)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/cve-scan.yml around lines 34 - 35, Update the CVE scan
workflow’s registry login step to authenticate against the registry owning
inputs.image rather than hardcoding ghcr.io. Add the required registry-specific
credential inputs to the reusable workflow and use those inputs with the
configured REGISTRY_URL, preserving the existing docker login flow for all
supported private registries.
| format: 'sarif' | ||
| output: 'trivy-results.sarif' | ||
| severity: HIGH,CRITICAL |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow excerpt =="
sed -n '1,120p' .github/workflows/cve-scan.yml 2>/dev/null || true
echo "== action refs =="
rg -n "aquasecurity/trivy-action|trivy-results.sarif|severity:" .github/workflows -S || true
echo "== local module docs if present =="
rg -n "limit-severities-for-sarif|HIGH,CRITICAL|SARIF|sarif" .github workflows src node_modules 2>/dev/null | head -200 || trueRepository: Sunbird-Knowlg/knowledge-platform
Length of output: 2786
🌐 Web query:
aquasecurity/trivy-action sarif limit-severities-for-sarif input documentation
💡 Result:
In the aquasecurity/trivy-action GitHub Action, the limit-severities-for-sarif input is a boolean parameter used to control how vulnerability severities are handled when generating SARIF output [1][2]. By default, this input is set to false, which means the SARIF report will include all detected vulnerabilities, regardless of the severities configured in the severity input [1][3]. When set to true, the action ensures the generated SARIF report respects the severity filter (e.g., CRITICAL,HIGH), meaning only vulnerabilities matching those specified levels will be included in the report [3][4]. This parameter is particularly useful for aligning the SARIF report content with the action's exit code behavior, as well as for reducing noise in GitHub Code Scanning alerts [3][5][6]. When limit-severities-for-sarif is false, a scan might report lower-severity vulnerabilities in the SARIF output even if the severity input is restricted, which can lead to inconsistencies where an exit-code check fails due to findings that were supposed to be ignored [4][6]. Documentation for this input is found in the main README.md and action.yaml of the trivy-action repository [1][7]. Example Usage: - name: Run Trivy uses: aquasecurity/trivy-action@master with: format: 'sarif' output: 'trivy-results.sarif' severity: 'CRITICAL,HIGH' limit-severities-for-sarif: 'true'
Citations:
- 1: https://github.com/aquasecurity/trivy-action
- 2: https://github.com/aquasecurity/trivy-action/blob/master/README.md
- 3: https://deepwiki.com/aquasecurity/trivy-action/5.1.1-code-scanning-(sarif)
- 4: exit-code with SARIF format doesn't respect the 'severity' parameter aquasecurity/trivy-action#309
- 5: Trivy always uploads SARIF with all levels of vulnerabilities aquasecurity/trivy-action#258
- 6: Arediss/Oscarr@8ca89c9
- 7: https://github.com/aquasecurity/trivy-action/blob/master/action.yaml
Restrict SARIF findings to HIGH and CRITICAL.
With SARIF output, severity: HIGH,CRITICAL alone can still include all severities because limit-severities-for-sarif defaults to false; Code Scanning will receive lower-severity results unless it is enabled.
Proposed fix
output: 'trivy-results.sarif'
severity: HIGH,CRITICAL
+ limit-severities-for-sarif: true📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| format: 'sarif' | |
| output: 'trivy-results.sarif' | |
| severity: HIGH,CRITICAL | |
| format: 'sarif' | |
| output: 'trivy-results.sarif' | |
| severity: HIGH,CRITICAL | |
| limit-severities-for-sarif: true |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/cve-scan.yml around lines 41 - 43, Update the Trivy
configuration in the workflow’s SARIF output block to enable the
limit-severities-for-sarif option, while retaining severity: HIGH,CRITICAL, so
generated SARIF findings contain only HIGH and CRITICAL results.
Source: MCP tools
| run: | | ||
| docker push $REGISTRY_URL/${IMAGE_NAME}:${IMAGE_TAG} | ||
| echo "Pushed Docker image: $REGISTRY_URL/${IMAGE_NAME}:${IMAGE_TAG}" | ||
| echo "image=$REGISTRY_URL/${IMAGE_NAME}:${IMAGE_TAG}" >> $GITHUB_OUTPUT |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== workflow files =="
git ls-files .github/workflows || true
echo
echo "== relevant workflow excerpts =="
for f in .github/workflows/knowlg-service.yml .github/workflows/search-service.yml; do
if [ -f "$f" ]; then
echo "--- $f ($(wc -l < "$f") lines) ---"
nl -ba "$f" | sed -n '1,180p'
fi
done
echo
echo "== occurrences of REGISTRY_URL and image output =="
rg -n "REGISTRY_URL|GITHUB_OUTPUT|outputs:|download-artifact|upload-artifact|github\\.action_ref|REPOSITORY|IMAGE_NAME|IMAGE_TAG|SCAN|scan" .github/workflows || trueRepository: Sunbird-Knowlg/knowledge-platform
Length of output: 697
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n== relevant workflow excerpts using awk ==\n'
for f in .github/workflows/knowlg-service.yml .github/workflows/search-service.yml; do
if [ -f "$f" ]; then
echo "--- $f ($(wc -l < "$f") lines) ---"
awk '{printf "%6d\t%s\n", NR, $0}' "$f" | sed -n '1,180p'
fi
done
printf '\n== occurrences of REGISTRY_URL and image output ==\n'
grep -RInE "REGISTRY_URL|GITHUB_OUTPUT|outputs:|download-artifact|upload-artifact|github\.action_ref|REPOSITORY|IMAGE_NAME|IMAGE_TAG|SCAN|scan" .github/workflows || true
printf '\n== all references to knowlg/search scan image or reusable workflow ==\n'
grep -RInE "knowlg-service|search-service|image=|scan|security|trivy|sast|sca" .github/workflows || trueRepository: Sunbird-Knowlg/knowledge-platform
Length of output: 19955
Keep secret-derived registry data out of job outputs.
The image output contains ${{ secrets.REGISTRY_URL }}; GitHub can redact outputs that include secret values, making subsequent needs.<job>.outputs.image values empty and skipping the cve-scan jobs. Output only non-secret components like the image name, image tag, and repository, and pass registry configuration as secrets to cve-check.yml.
📍 Affects 2 files
.github/workflows/knowlg-service.yml#L101-L101(this comment).github/workflows/search-service.yml#L96-L96
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/knowlg-service.yml at line 101, Remove secret-derived
REGISTRY_URL from the image outputs in the image-build steps of
.github/workflows/knowlg-service.yml (line 101) and
.github/workflows/search-service.yml (line 96); output only non-secret image
components such as name, tag, and repository, then pass the registry
configuration separately as secrets to cve-check.yml while preserving the
cve-scan job inputs.
Source: MCP tools
| uses: ./.github/workflows/cve-check.yml | ||
| with: | ||
| image: ${{ needs.build-and-push.outputs.image }} |
There was a problem hiding this comment.
🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win
Use the reusable workflow filename that exists.
Both callers reference cve-check.yml, while the added file is cve-scan.yml; actionlint cannot resolve the referenced file.
.github/workflows/knowlg-service.yml#L111-L113: changeusesto./.github/workflows/cve-scan.yml..github/workflows/search-service.yml#L106-L108: changeusesto./.github/workflows/cve-scan.yml.
🧰 Tools
🪛 actionlint (1.7.12)
[error] 111-111: could not read reusable workflow file for "./.github/workflows/cve-check.yml": open /home/jailuser/git/.github/workflows/cve-check.yml: no such file or directory
(workflow-call)
📍 Affects 2 files
.github/workflows/knowlg-service.yml#L111-L113(this comment).github/workflows/search-service.yml#L106-L108
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/knowlg-service.yml around lines 111 - 113, Update the
reusable workflow references from cve-check.yml to the existing cve-scan.yml in
.github/workflows/knowlg-service.yml lines 111-113 and
.github/workflows/search-service.yml lines 106-108, preserving the existing
image input.
Source: Linters/SAST tools
1 participant
Summary
Adds Trivy CVE scanning for service images. A reusable workflow (
cve-check.yml) runs after each build/push and uploads results to GitHub's Code Scanning tab.trivy-actionis pinned to a commit SHA (not a version tag) to avoid a known resolution bug, and permissions are granted from the calling job so the scan can actually upload SARIF results.Motivation
Get visibility into known CVEs in published images without manual scanning. No specific issue — proactive security addition.
Type of change
How Has This Been Tested?
knowlg-service.yml/search-service.yml.Checklist
Summary by CodeRabbit