Wip/scan with trivy #150

chopkinsmade · 2026-01-16T09:08:27Z

What

Why

How this has been tested

I have tested locally
Testing not required

Reviewer Checklist

I have reviewed the PR and ensured no secret values are present

Signed-off-by: DBT pre-commit check

github-advanced-security · 2026-01-16T09:08:29Z

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

Signed-off-by: DBT pre-commit check

package-lock.json

+    "node_modules/node-fetch": {
+      "version": "1.7.3",
+      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-1.7.3.tgz",
+      "integrity": "sha512-NhZ4CsKx7cYm2vSrBAr2PvFOe6sWDf0UYLRqA6svUYg7+/TSfVAu49jYC4BvQ4Sms9SZgdqGBgroqfDhJdTyKQ==",
+      "license": "MIT",
+      "dependencies": {
+        "encoding": "^0.1.11",
+        "is-stream": "^1.0.1"
+      }
+    },


s3.tf

+resource "aws_s3_bucket" "main" {
+  bucket = var.bucket
+
+  tags     = var.tags != {} ? var.tags : {}
+  tags_all = var.tags_all != {} ? var.tags_all : {}
+}


s3.tf

+resource "aws_s3_bucket" "main" {
+  bucket = var.bucket
+
+  tags     = var.tags != {} ? var.tags : {}
+  tags_all = var.tags_all != {} ? var.tags_all : {}
+}


s3.tf

+resource "aws_s3_bucket" "main" {
+  bucket = var.bucket
+
+  tags     = var.tags != {} ? var.tags : {}
+  tags_all = var.tags_all != {} ? var.tags_all : {}
+}


s3.tf

+resource "aws_s3_bucket" "main" {
+  bucket = var.bucket
+
+  tags     = var.tags != {} ? var.tags : {}
+  tags_all = var.tags_all != {} ? var.tags_all : {}
+}


s3.tf

+resource "aws_s3_bucket" "main" {
+  bucket = var.bucket
+
+  tags     = var.tags != {} ? var.tags : {}
+  tags_all = var.tags_all != {} ? var.tags_all : {}
+}


s3.tf

+resource "aws_s3_bucket" "main" {
+  bucket = var.bucket
+
+  tags     = var.tags != {} ? var.tags : {}
+  tags_all = var.tags_all != {} ? var.tags_all : {}
+}


security_groups.tf

+  description = "egress-https-from-service"
+
+  security_group_id = 1
+  cidr_blocks       = ["0.0.0.0/0"]


Signed-off-by: DBT pre-commit check

github-actions · 2026-01-16T10:04:31Z

Trivy fs scan - Vulnerabilities detected

The following vulnerabilities of HIGH or CRITICAL severity have been detected in the code. Please resolve these before merging the pull request.

Type: npm

Target: package-lock.json

Severity: HIGH

CVE-2022-0235 node-fetch: exposure of sensitive information to an unauthorized actor
node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Type: uv

Target: uv.lock

Severity: HIGH

CVE-2025-69223 aiohttp: AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed in version 3.13.3.

Severity: HIGH

CVE-2026-21441 urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)
urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client. Applications and libraries are affected when they stream content from untrusted sources by setting preload_content=False when they do not disable redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content of redirect responses when preload_content=False. If upgrading is not immediately possible, disable redirects by setting redirect=False for requests to untrusted source.

Type: terraform

Target: .

Type: dockerfile

Target: Dockerfile

Severity: HIGH

DS002 Image user should not be 'root'
Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

Type: terraform

Target: s3.tf

Severity: HIGH

AVD-AWS-0086 S3 Access block should block public ACL
S3 buckets should block public ACLs on buckets and any objects they contain. By blocking, PUTs with fail if the object has any public ACL a.

Severity: HIGH

AVD-AWS-0087 S3 Access block should block public policy
S3 bucket policy should have block public policy to prevent users from putting a policy that enable public access.

Severity: HIGH

AVD-AWS-0088 Unencrypted S3 bucket.
S3 Buckets should be encrypted to protect the data that is stored within them if access is compromised.

Severity: HIGH

AVD-AWS-0091 S3 Access Block should Ignore Public ACL
S3 buckets should ignore public ACLs on buckets and any objects they contain. By ignoring rather than blocking, PUT calls with public ACLs will still be applied but the ACL will be ignored.

Severity: HIGH

AVD-AWS-0093 S3 Access block should restrict public bucket to limit access
S3 buckets should restrict public policies for the bucket. By enabling, the restrict_public_buckets, only the bucket owner and AWS Services can access if it has a public policy.

Severity: HIGH

AVD-AWS-0132 S3 encryption should use Customer Managed Keys
Encryption using AWS keys provides protection for your S3 buckets. To increase control of the encryption and manage factors like rotation use customer managed keys.

Type: terraform

Target: security_groups.tf

Severity: CRITICAL

aws-vpc-no-public-egress-sgr A security group rule should not allow unrestricted egress to any IP address.
Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.

chopkinsmade added 30 commits January 14, 2026 16:03

Use trivy for scanning docker images

93fe282

Signed-off-by: DBT pre-commit check

Ignore low priority issues

f33d8b1

Signed-off-by: DBT pre-commit check

Use trivy for python vulnerability scan

5f8b6b2

Signed-off-by: DBT pre-commit check

use dfiferent filename for each scan

815bc01

Signed-off-by: DBT pre-commit check

Add scan to common

1833012

Signed-off-by: DBT pre-commit check

use default scans

c95fb57

Signed-off-by: DBT pre-commit check

output both file types

b544270

Signed-off-by: DBT pre-commit check

add comments to PR

3d1f971

Signed-off-by: DBT pre-commit check

upload even on failure

f9559af

Signed-off-by: DBT pre-commit check

print github values

c1c43c7

Signed-off-by: DBT pre-commit check

add dedicated scan workflow

9c2293e

Signed-off-by: DBT pre-commit check

dont output event json

44e2977

Signed-off-by: DBT pre-commit check

use workflow secret

62c9f2e

Signed-off-by: DBT pre-commit check

a

d07b2f6

Signed-off-by: DBT pre-commit check

a

69c010e

Signed-off-by: DBT pre-commit check

a

18988ac

Signed-off-by: DBT pre-commit check

a

fe0a2be

Signed-off-by: DBT pre-commit check

include custom tpl file

16d047c

Signed-off-by: DBT pre-commit check

include only high or criticals

3a1a879

Signed-off-by: DBT pre-commit check

Add tf and npm with issues

ff50d0e

Signed-off-by: DBT pre-commit check

add more forced errors

7cc263c

Signed-off-by: DBT pre-commit check

Add misconfig option

9104f38

Signed-off-by: DBT pre-commit check

additional terraform failure

d217d65

Signed-off-by: DBT pre-commit check

Add headings

4c1ec00

Signed-off-by: DBT pre-commit check

More formatting line breaks

976acd4

Signed-off-by: DBT pre-commit check

dont add comment to PR

c6ffee4

Signed-off-by: DBT pre-commit check

force change for uv lock

1307890

Signed-off-by: DBT pre-commit check

a

9aadfd3

Signed-off-by: DBT pre-commit check

b

08e9d08

Signed-off-by: DBT pre-commit check

a

8cdf10c

Signed-off-by: DBT pre-commit check

a

1ce8bf5

Signed-off-by: DBT pre-commit check

a

235e5a7

Signed-off-by: DBT pre-commit check

github-advanced-security bot found potential problems Jan 16, 2026

View reviewed changes

chopkinsmade added 4 commits January 16, 2026 09:46

b

96f86b0

Signed-off-by: DBT pre-commit check

produce sbom

444ff11

Signed-off-by: DBT pre-commit check

a

7c0c3ee

Signed-off-by: DBT pre-commit check

scan container image in ghcr

b2ffd91

Signed-off-by: DBT pre-commit check

uktrade deleted a comment from github-actions bot Jan 16, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Wip/scan with trivy #150

Wip/scan with trivy #150

Uh oh!

chopkinsmade commented Jan 16, 2026

Uh oh!

github-advanced-security bot commented Jan 16, 2026

Uh oh!

Check failure

Check failure

Check failure

Check failure

Check failure

Check failure

Check failure

Check failure

github-actions bot commented Jan 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Wip/scan with trivy #150

Are you sure you want to change the base?

Wip/scan with trivy #150

Uh oh!

Conversation

chopkinsmade commented Jan 16, 2026

What

Why

How this has been tested

Reviewer Checklist

Uh oh!

github-advanced-security bot commented Jan 16, 2026

Uh oh!

Check failure

Check failure

Check failure

Check failure

Check failure

Check failure

Check failure

Check failure

github-actions bot commented Jan 16, 2026

Trivy fs scan - Vulnerabilities detected

Type: npm

Target: package-lock.json

Severity: HIGH

Type: uv

Target: uv.lock

Severity: HIGH

Severity: HIGH

Type: terraform

Target: .

Type: dockerfile

Target: Dockerfile

Severity: HIGH

Type: terraform

Target: s3.tf

Severity: HIGH

Severity: HIGH

Severity: HIGH

Severity: HIGH

Severity: HIGH

Severity: HIGH

Type: terraform

Target: security_groups.tf

Severity: CRITICAL

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant