Skip to content

Commit 7876e5e

Browse files
sidnhssidnhs
committed
CCM-15550: Disable Trivy in CI
1 parent 698883c commit 7876e5e

6 files changed

Lines changed: 94 additions & 89 deletions

File tree

‎.github/actions/trivy-iac/action.yaml‎

Lines changed: 19 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,20 @@
1-
name: "Trivy IaC Scan"
2-
description: "Scan Terraform IaC using Trivy"
3-
runs:
4-
using: "composite"
5-
steps:
6-
- name: "Trivy Terraform IaC Scan"
7-
shell: bash
8-
run: |
9-
components_exit_code=0
10-
modules_exit_code=0
11-
asdf plugin add trivy || true
12-
asdf install trivy || true
13-
./scripts/terraform/trivy-scan.sh --mode iac ./infrastructure/terraform/components || components_exit_code=$?
14-
./scripts/terraform/trivy-scan.sh --mode iac ./infrastructure/terraform/modules || modules_exit_code=$?
1+
# TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
2+
# name: "Trivy IaC Scan"
3+
# description: "Scan Terraform IaC using Trivy"
4+
# runs:
5+
# using: "composite"
6+
# steps:
7+
# - name: "Trivy Terraform IaC Scan"
8+
# shell: bash
9+
# run: |
10+
# components_exit_code=0
11+
# modules_exit_code=0
12+
# asdf plugin add trivy || true
13+
# asdf install trivy || true
14+
# ./scripts/terraform/trivy-scan.sh --mode iac ./infrastructure/terraform/components || components_exit_code=$?
15+
# ./scripts/terraform/trivy-scan.sh --mode iac ./infrastructure/terraform/modules || modules_exit_code=$?
1516

16-
if [ $components_exit_code -ne 0 ] || [ $modules_exit_code -ne 0 ]; then
17-
echo "Trivy misconfigurations detected."
18-
exit 1
19-
fi
17+
# if [ $components_exit_code -ne 0 ] || [ $modules_exit_code -ne 0 ]; then
18+
# echo "Trivy misconfigurations detected."
19+
# exit 1
20+
# fi

‎.github/actions/trivy-package/action.yaml‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,17 @@
1-
name: "Trivy Package Scan"
2-
description: "Scan project packages using Trivy"
3-
runs:
4-
using: "composite"
5-
steps:
6-
- name: "Trivy Package Scan"
7-
shell: bash
8-
run: |
9-
exit_code=0
10-
asdf plugin add trivy || true
11-
asdf install trivy || true
12-
./scripts/terraform/trivy-scan.sh --mode package . || exit_code=$?
1+
# name: "Trivy Package Scan"
2+
# description: "Scan project packages using Trivy"
3+
# runs:
4+
# using: "composite"
5+
# steps:
6+
# - name: "Trivy Package Scan"
7+
# shell: bash
8+
# run: |
9+
# exit_code=0
10+
# asdf plugin add trivy || true
11+
# asdf install trivy || true
12+
# ./scripts/terraform/trivy-scan.sh --mode package . || exit_code=$?
1313

14-
if [ $exit_code -ne 0 ]; then
15-
echo "Trivy has detected package vulnerablilites. Please refer to https://nhsd-confluence.digital.nhs.uk/spaces/RIS/pages/1257636917/PLAT-KOP-012+-+Trivy+Pipeline+Vulnerability+Scanning+Exemption"
16-
exit 1
17-
fi
14+
# if [ $exit_code -ne 0 ]; then
15+
# echo "Trivy has detected package vulnerablilites. Please refer to https://nhsd-confluence.digital.nhs.uk/spaces/RIS/pages/1257636917/PLAT-KOP-012+-+Trivy+Pipeline+Vulnerability+Scanning+Exemption"
16+
# exit 1
17+
# fi

‎.github/workflows/cicd-1-pull-request.yaml‎

Lines changed: 21 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@ jobs:
3434
is_version_prerelease: ${{ steps.variables.outputs.is_version_prerelease }}
3535
does_pull_request_exist: ${{ steps.pr_exists.outputs.does_pull_request_exist }}
3636
pr_number: ${{ steps.pr_exists.outputs.pr_number }}
37-
skip_trivy_package: ${{ steps.skip_trivy.outputs.skip_trivy_package }}
37+
#skip_trivy_package: ${{ steps.skip_trivy.outputs.skip_trivy_package }}
3838
steps:
3939
- name: "Checkout code"
4040
uses: actions/checkout@v4
@@ -74,26 +74,27 @@ jobs:
7474
echo "does_pull_request_exist=false" >> $GITHUB_OUTPUT
7575
echo "pr_number=" >> $GITHUB_OUTPUT
7676
fi
77-
- name: "Determine if Trivy package scan should be skipped"
78-
id: skip_trivy
79-
env:
80-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
81-
PR_NUMBER: ${{ steps.pr_exists.outputs.pr_number }}
82-
run: |
83-
if [[ -z "$PR_NUMBER" ]]; then
84-
echo "No pull request detected; Trivy package scan will run."
85-
echo "skip_trivy_package=false" >> $GITHUB_OUTPUT
86-
exit 0
87-
fi
77+
# TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
78+
# - name: "Determine if Trivy package scan should be skipped"
79+
# id: skip_trivy
80+
# env:
81+
# GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
82+
# PR_NUMBER: ${{ steps.pr_exists.outputs.pr_number }}
83+
# run: |
84+
# if [[ -z "$PR_NUMBER" ]]; then
85+
# echo "No pull request detected; Trivy package scan will run."
86+
# echo "skip_trivy_package=false" >> $GITHUB_OUTPUT
87+
# exit 0
88+
# fi
8889

89-
labels=$(gh pr view "$PR_NUMBER" --json labels --jq '.labels[].name')
90-
echo "Labels on PR #$PR_NUMBER: $labels"
90+
# labels=$(gh pr view "$PR_NUMBER" --json labels --jq '.labels[].name')
91+
# echo "Labels on PR #$PR_NUMBER: $labels"
9192

92-
if echo "$labels" | grep -Fxq 'skip-trivy-package'; then
93-
echo "skip_trivy_package=true" >> $GITHUB_OUTPUT
94-
else
95-
echo "skip_trivy_package=false" >> $GITHUB_OUTPUT
96-
fi
93+
# if echo "$labels" | grep -Fxq 'skip-trivy-package'; then
94+
# echo "skip_trivy_package=true" >> $GITHUB_OUTPUT
95+
# else
96+
# echo "skip_trivy_package=false" >> $GITHUB_OUTPUT
97+
# fi
9798
- name: "List variables"
9899
run: |
99100
export BUILD_DATETIME_LONDON="${{ steps.variables.outputs.build_datetime_london }}"
@@ -117,7 +118,7 @@ jobs:
117118
build_epoch: "${{ needs.metadata.outputs.build_epoch }}"
118119
nodejs_version: "${{ needs.metadata.outputs.nodejs_version }}"
119120
python_version: "${{ needs.metadata.outputs.python_version }}"
120-
skip_trivy_package: ${{ needs.metadata.outputs.skip_trivy_package == 'true' }}
121+
#skip_trivy_package: ${{ needs.metadata.outputs.skip_trivy_package == 'true' }}
121122
terraform_version: "${{ needs.metadata.outputs.terraform_version }}"
122123
version: "${{ needs.metadata.outputs.version }}"
123124
secrets: inherit

‎.github/workflows/stage-1-commit.yaml‎

Lines changed: 33 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,9 @@ on:
2323
description: "Python version, set by the CI/CD pipeline workflow"
2424
required: true
2525
type: string
26-
skip_trivy_package:
27-
description: "Skip Trivy package scan when true"
26+
# TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
27+
# skip_trivy_package:
28+
# description: "Skip Trivy package scan when true"
2829
type: boolean
2930
default: false
3031
terraform_version:
@@ -152,35 +153,36 @@ jobs:
152153
uses: asdf-vm/actions/setup@1902764435ca0dd2f3388eea723a4f92a4eb8302
153154
- name: "Lint Terraform"
154155
uses: ./.github/actions/lint-terraform
155-
trivy-iac:
156-
name: "Trivy IaC Scan"
157-
permissions:
158-
contents: read
159-
runs-on: ubuntu-latest
160-
timeout-minutes: 10
161-
needs: detect-terraform-changes
162-
if: needs.detect-terraform-changes.outputs.terraform_changed == 'true'
163-
steps:
164-
- name: "Checkout code"
165-
uses: actions/checkout@v4
166-
- name: "Setup ASDF"
167-
uses: asdf-vm/actions/setup@1902764435ca0dd2f3388eea723a4f92a4eb8302
168-
- name: "Trivy IaC Scan"
169-
uses: ./.github/actions/trivy-iac
170-
trivy-package:
171-
if: ${{ !inputs.skip_trivy_package }}
172-
name: "Trivy Package Scan"
173-
permissions:
174-
contents: read
175-
runs-on: ubuntu-latest
176-
timeout-minutes: 10
177-
steps:
178-
- name: "Checkout code"
179-
uses: actions/checkout@v4
180-
- name: "Setup ASDF"
181-
uses: asdf-vm/actions/setup@1902764435ca0dd2f3388eea723a4f92a4eb8302
182-
- name: "Trivy Package Scan"
183-
uses: ./.github/actions/trivy-package
156+
# TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
157+
# trivy-iac:
158+
# name: "Trivy IaC Scan"
159+
# permissions:
160+
# contents: read
161+
# runs-on: ubuntu-latest
162+
# timeout-minutes: 10
163+
# needs: detect-terraform-changes
164+
# if: needs.detect-terraform-changes.outputs.terraform_changed == 'true'
165+
# steps:
166+
# - name: "Checkout code"
167+
# uses: actions/checkout@v4
168+
# - name: "Setup ASDF"
169+
# uses: asdf-vm/actions/setup@1902764435ca0dd2f3388eea723a4f92a4eb8302
170+
# - name: "Trivy IaC Scan"
171+
# uses: ./.github/actions/trivy-iac
172+
# trivy-package:
173+
# if: ${{ !inputs.skip_trivy_package }}
174+
# name: "Trivy Package Scan"
175+
# permissions:
176+
# contents: read
177+
# runs-on: ubuntu-latest
178+
# timeout-minutes: 10
179+
# steps:
180+
# - name: "Checkout code"
181+
# uses: actions/checkout@v4
182+
# - name: "Setup ASDF"
183+
# uses: asdf-vm/actions/setup@1902764435ca0dd2f3388eea723a4f92a4eb8302
184+
# - name: "Trivy Package Scan"
185+
# uses: ./.github/actions/trivy-package
184186
count-lines-of-code:
185187
name: "Count lines of code"
186188
runs-on: ubuntu-latest

‎.tool-versions‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ pre-commit 3.6.0
66
ruby 3.3.6
77
terraform 1.10.1
88
terraform-docs 0.19.0
9-
trivy 0.61.0
9+
#trivy 0.61.0 - TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
1010
vale 3.6.0
1111
python 3.13.2
1212
# ==============================================================================

‎scripts/terraform/terraform.mk‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -118,9 +118,10 @@ terraform-validate-all: # Validate all Terraform components @Quality
118118
fi; \
119119
done
120120

121-
terraform-sec: # Run Trivy IaC security scanning on Terraform code @Quality
122-
# Example: make terraform-sec
123-
./scripts/terraform/trivy-scan.sh --mode iac infrastructure/terraform
121+
#TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549
122+
# terraform-sec: # Run Trivy IaC security scanning on Terraform code @Quality
123+
# # Example: make terraform-sec
124+
# ./scripts/terraform/trivy-scan.sh --mode iac infrastructure/terraform
124125

125126
terraform-docs: # Generate Terraform documentation - optional: component=[specific component, or all if omitted] @Quality
126127
# Example: make terraform-docs component=mycomp

0 commit comments

Comments
 (0)