Skip to content

Commit 8c5a18d

Browse files
RootShell-coderRootShell-coder
committed
...
1 parent 11a0eef commit 8c5a18d

File tree

6 files changed

+187
-10
lines changed

6 files changed

+187
-10
lines changed

‎.github/workflows/docker-publish.yml

+78
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
name: Trivy cached
2+
on:
3+
schedule:
4+
- cron: '0 23 */3 * *'
5+
push:
6+
branches: [ "master" ]
7+
paths:
8+
- 'docker/**'
9+
- 'build_trivy_cached.sh'
10+
pull_request:
11+
branches: [ "master" ]
12+
paths:
13+
- 'docker/**'
14+
- 'build_trivy_cached.sh'
15+
16+
env:
17+
REGISTRY: ghcr.io
18+
IMAGE_NAME: ${{ github.repository }}
19+
20+
jobs:
21+
build:
22+
runs-on: ubuntu-latest
23+
permissions:
24+
contents: read
25+
packages: write
26+
id-token: write
27+
28+
steps:
29+
- name: Checkout repository
30+
uses: actions/checkout@v4
31+
32+
- name: Run build script
33+
run: |
34+
chmod +x ./build_trivy_cached.sh
35+
./build_trivy_cached.sh
36+
37+
- name: Install cosign
38+
if: github.event_name != 'pull_request'
39+
uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 #v3.5.0
40+
with:
41+
cosign-release: 'v2.2.4'
42+
43+
- name: Set up Docker Buildx
44+
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
45+
46+
- name: Log into registry ${{ env.REGISTRY }}
47+
if: github.event_name != 'pull_request'
48+
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
49+
with:
50+
registry: ${{ env.REGISTRY }}
51+
username: ${{ github.actor }}
52+
password: ${{ secrets.GITHUB_TOKEN }}
53+
54+
- name: Extract Docker metadata
55+
id: meta
56+
uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
57+
with:
58+
images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
59+
tags: |
60+
type=raw,value=latest,enable={{is_default_branch}}
61+
62+
- name: Build and push Docker image
63+
id: build-and-push
64+
uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
65+
with:
66+
context: docker
67+
push: ${{ github.event_name != 'pull_request' }}
68+
tags: ${{ steps.meta.outputs.tags }}
69+
labels: ${{ steps.meta.outputs.labels }}
70+
# cache-from: type=gha
71+
# cache-to: type=gha,mode=max
72+
73+
- name: Sign the published Docker image
74+
if: ${{ github.event_name != 'pull_request' }}
75+
env:
76+
TAGS: ${{ steps.meta.outputs.tags }}
77+
DIGEST: ${{ steps.build-and-push.outputs.digest }}
78+
run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

‎.gitignore

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
docker/trivy_cache/

‎README.md

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# Trivy cached DB
2+
3+
[![Trivy cached](https://github.com/RootShell-coder/Trivy-cached/actions/workflows/docker-publish.yml/badge.svg)](https://github.com/RootShell-coder/Trivy-cached/actions/workflows/docker-publish.yml)[![Trivy cached](https://github.com/RootShell-coder/Trivy-cached/actions/workflows/docker-publish.yml/badge.svg?event=schedule)](https://github.com/RootShell-coder/Trivy-cached/actions/workflows/docker-publish.yml)
4+
5+
docker pull image
6+
7+
```bash
8+
docker pull quay.io/keycloak/keycloak:latest
9+
```
10+
11+
trivy scan image
12+
13+
```bash
14+
docker run --rm ghcr.io/rootshell-coder/trivy-cached:latest image quay.io/keycloak/keycloak:latest
15+
```

‎build_trivy_cached.sh

+80
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
#!/bin/bash
2+
3+
max_attempts=6
4+
attempt=1
5+
sleep_time=10
6+
7+
# >>> don't change >>>
8+
mkdir -p docker/trivy_cache
9+
10+
tmp_max_attempts=$max_attempts
11+
tmp_attempt=attempt
12+
13+
check_attempts() {
14+
local attempt=$1
15+
local max_attempts=$2
16+
17+
if [ $attempt -gt $max_attempts ]; then
18+
echo "ERROR: maximum number of attempts ($max_attempts)."
19+
exit 1
20+
fi
21+
}
22+
23+
while [ $attempt -le $max_attempts ]; do
24+
output=$(docker pull --platform linux/amd64 ghcr.io/aquasecurity/trivy:latest 2>&1)
25+
if echo "$output" | grep -q "retry-after:"; then
26+
sleep $sleep_time
27+
((attempt++))
28+
check_attempts $attempt $max_attempts
29+
else
30+
echo "Trivy image pulled successfully."
31+
break
32+
fi
33+
done
34+
35+
tmp_max_attempts=$max_attempts
36+
tmp_attempt=attempt
37+
38+
while [ $attempt -le $max_attempts ]; do
39+
output=$(docker run --rm -v ./docker/trivy_cache/:/root/.cache/ ghcr.io/aquasecurity/trivy:latest --cache-dir /root/.cache image --download-db-only 2>&1)
40+
if echo "$output" | grep -q "retry-after:"; then
41+
sleep $sleep_time
42+
((attempt++))
43+
check_attempts $attempt $max_attempts
44+
else
45+
echo "db update successfully."
46+
sudo chmod 644 ./docker/trivy_cache/db/trivy.db ./docker/trivy_cache/db/metadata.json
47+
break
48+
fi
49+
done
50+
51+
tmp_max_attempts=$max_attempts
52+
tmp_attempt=attempt
53+
54+
while [ $attempt -le $max_attempts ]; do
55+
output=$(docker run --rm -v ./docker/trivy_cache/:/root/.cache/ ghcr.io/aquasecurity/trivy:latest --cache-dir /root/.cache image --download-java-db-only 2>&1)
56+
if echo "$output" | grep -q "retry-after:"; then
57+
sleep $sleep_time
58+
((attempt++))
59+
check_attempts $attempt $max_attempts
60+
else
61+
echo "java db update successfully."
62+
sudo chmod 644 ./docker/trivy_cache/java-db/trivy-java.db ./docker/trivy_cache/java-db/metadata.json
63+
break
64+
fi
65+
done
66+
67+
check_attempts $attempt $max_attempts
68+
69+
if [ ! -s ./docker/trivy_cache/db/trivy.db ]; then
70+
echo "ERROR: The file ./docker/trivy_cache/db/trivy.db is empty."
71+
exit 1
72+
fi
73+
74+
if [ ! -s ./docker/trivy_cache/db/trivy.db ]; then
75+
echo "ERROR: The file ./docker/trivy_cache/java-db/trivy-java.db is empty."
76+
exit 1
77+
fi
78+
79+
sudo chown 1000:1000 -R docker/trivy_cache
80+
# docker buildx build --no-cache -t ghcr.io/rootshell-coder/trivy-cached:latest docker

‎docker/Dockerfile

+13-6
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,17 @@
1-
FROM ghcr.io/aquasecurity/trivy:canary
1+
FROM ghcr.io/aquasecurity/trivy:latest
22

33
RUN set -eux; \
4-
mkdir -p /root/.cache/db root/.cache/java-db root/.cache/fanal; \
4+
addgroup -S trivy; \
5+
adduser -S trivy -G trivy -h /home/trivy -s /bin/sh; \
6+
mkdir -p /home/trivy/.cache/fanal; \
7+
chown -R trivy:trivy /home/trivy;
8+
9+
COPY --chown=trivy:trivy ./trivy_cache/ /home/trivy/.cache/
510

611
RUN set -eux; \
7-
TRIVY_TEMP_DIR=$(mktemp -d); \
8-
trivy --cache-dir $TRIVY_TEMP_DIR image --download-db-only\; \
9-
# tar -cf ./db.tar.gz -C $TRIVY_TEMP_DIR/db ./cache/db/metadata.json ./cache/db/trivy.db; \
10-
# rm -rf $TRIVY_TEMP_DIR;
12+
ls -lah /home/trivy/.cache/db/trivy.db; \
13+
ls -lah /home/trivy/.cache/java-db/trivy-java.db;
14+
15+
USER trivy
16+
WORKDIR /home/trivy
17+
ENTRYPOINT [ "/usr/local/bin/trivy", "--cache-dir", "/home/trivy/.cache" ]

‎t.sh

-4
This file was deleted.

0 commit comments

Comments
 (0)