Skip to content

chore: update go

chore: update go #5135

name: "Trivy secret scanning"
on:
push:
branches:
- "**"
pull_request:
jobs:
scan:
name: "Trivy scan in fs mode"
runs-on: ubuntu-22.04
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Run Trivy vulnerability scanner in fs mode
uses: aquasecurity/[email protected]
with:
scan-type: 'fs'
scan-ref: '.'
scanners: 'secret'
exit-code: '1'
env:
TRIVY_SECRET_CONFIG: 'trivy/trivy-secret.yaml'
send-alert:
name: "Send alert in case secret is detected"
if: ${{ failure() }}
needs: scan
runs-on: ubuntu-22.04
steps:
- name: Run curl to the Slack webhook
run: |
curl \
--request POST \
--header "Content-Type: application/json" \
--data '{"text": ":warning::warning::warning: *SECRET LEAK ALERT *:warning::warning::warning:\n\nTrivy detected a secret pushed to the Kuberpult repository. Navigate to the <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|failing run> page to inspect the alert.\n\nIf the alert is a false positive, then make sure to add an allow rule for it under <https://github.com/freiheit-com/kuberpult/blob/main/trivy/trivy-secret.yaml|`trivy/trivy-secret.yaml`>."}' \
--fail \
${{ secrets.SLACK_WEBHOOK_SRE_ALERTS_INTERNAL }}