Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Change github-pat input name #209

Open
wants to merge 9 commits into
base: master
Choose a base branch
from
Open

Change github-pat input name #209

Show file tree
Hide file tree
Changes from 7 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
d6443d4
feat: rename token input
Feb 18, 2023
914a0e3
feat: renamed token input
Feb 18, 2023
8fa0922
feat: renamed token input
Feb 18, 2023
bd9284c
feat: renamed token input
Feb 18, 2023
a55f6e9
feat: update script
Feb 18, 2023
3475d3f
feat: update script
Feb 18, 2023
93f1a94
feat: renamed token input in test file
Feb 18, 2023
5b16700
fix: typo
saerosV Feb 21, 2023
91b73c9
feat: update input description in table
saerosV Feb 21, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
4 changes: 2 additions & 2 deletions README.md
View file
Open in desktop
Expand Up @@ -327,7 +327,7 @@ jobs:
format: 'github'
output: 'dependency-results.sbom.json'
image-ref: '.'
github-pat: '<github_pat_token>'
github-token: '<github_pat_token>'
```

### Using Trivy to scan your private registry
Expand Down Expand Up @@ -501,7 +501,7 @@ Following inputs can be used as `step.with` keys:
| `security-checks` | String | `vuln,secret` | comma-separated list of what security issues to detect (`vuln`,`secret`,`config`) |
| `trivyignores` | String | | comma-separated list of relative paths in repository to one or more `.trivyignore` files |
| `trivy-config` | String | | Path to trivy.yaml config |
| `github-pat` | String | | GitHub Personal Access Token (PAT) for sending SBOM scan results to GitHub Dependency Snapshots |
| `github-token` | String | | GitHub Personal Access Token (PAT) for sending SBOM scan results to GitHub Dependency Snapshots |
saerosV marked this conversation as resolved.
Show resolved Hide resolved
| `limit-severities-for-sarif` | Boolean | false | By default *SARIF* format enforces output of all vulnerabilities regardless of configured severities. To override this behavior set this parameter to **true** |

[release]: https://github.com/aquasecurity/trivy-action/releases/latest
Expand Down
6 changes: 3 additions & 3 deletions action.yaml
View file
Open in desktop
Expand Up @@ -82,8 +82,8 @@ inputs:
artifact-type:
description: 'input artifact type (image, fs, repo, archive) for SBOM generation'
required: false
github-pat:
description: 'GitHub Personal Access Token (PAT) for submitting SBOM to GitHub Dependency Snapshot API'
github-token:
description: 'Authentication token to enable sending SBOM scan results to GitHub Dependency Graph. Can be either a GitHub Personal Access Token (PAT) or GITHUB_TOKEN'
required: false
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
required: false
default: ${{ github.token }}

We could add this to make the configuration even simpler, not sure if that is a good idea, but it how it's done for https://github.com/actions/checkout/blob/main/action.yml for example.

Copy link
Contributor Author

@saerosV saerosV Mar 29, 2023 •
edited

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@simar7 do you think this should be part of the PR? Not part of the initial goals of the PR, but I think it is a good enough improvement to add.

trivy-config:
description: 'path to trivy.yaml config'
Expand Down Expand Up @@ -116,6 +116,6 @@ runs:
- '-r ${{ inputs.list-all-pkgs }}'
- '-s ${{ inputs.security-checks }}'
- '-t ${{ inputs.trivyignores }}'
- '-u ${{ inputs.github-pat }}'
- '-u ${{ inputs.github-token }}'
- '-v ${{ inputs.trivy-config }}'
- '-z ${{ inputs.limit-severities-for-sarif }}'
8 changes: 4 additions & 4 deletions entrypoint.sh
View file
Open in desktop
Expand Up @@ -63,7 +63,7 @@ while getopts "a:b:c:d:e:f:g:h:i:j:k:l:m:n:o:p:q:r:s:t:u:v:z:" o; do
export trivyIgnores=${OPTARG}
;;
u)
export githubPAT=${OPTARG}
export githubToken=${OPTARG}
;;
v)
export trivyConfig=${OPTARG}
Expand Down Expand Up @@ -187,11 +187,11 @@ else
fi

if [[ "${format}" == "github" ]]; then
if [[ "$(echo $githubPAT | xargs)" != "" ]]; then
if [[ "$(echo $githubToken | xargs)" != "" ]]; then
printf "\n Uploading GitHub Dependency Snapshot"
curl -H 'Accept: application/vnd.github+json' -H "Authorization: token $githubPAT" 'https://api.github.com/repos/'$GITHUB_REPOSITORY'/dependency-graph/snapshots' -d @./$(echo $output | xargs)
curl -H 'Accept: application/vnd.github+json' -H "Authorization: token $githubToken" 'https://api.github.com/repos/'$GITHUB_REPOSITORY'/dependency-graph/snapshots' -d @./$(echo $output | xargs)
else
printf "\n Failing GitHub Dependency Snapshot. Missing github-pat"
printf "\n Failing GitHub Dependency Snapshot. Missing github-token"
fi
fi

Expand Down
10 changes: 5 additions & 5 deletions test/data/repo.test
View file
Open in desktop
Expand Up @@ -20,10 +20,10 @@
"Class": "secret",
"Secrets": [
{
"RuleID": "github-pat",
"RuleID": "github-token",
"Category": "GitHub",
"Severity": "CRITICAL",
"Title": "GitHub Personal Access Token",
"Title": "GitHub Token (PAT or install acess token)",
saerosV marked this conversation as resolved.
Show resolved Hide resolved
"StartLine": 5,
"EndLine": 5,
"Code": {
Expand All @@ -49,11 +49,11 @@
},
{
"Number": 5,
"Content": "export GITHUB_PAT=****************************************",
"Content": "export GITHUB_TOKEN=****************************************",
"IsCause": true,
"Annotation": "",
"Truncated": false,
"Highlighted": "export GITHUB_PAT=****************************************",
"Highlighted": "export GITHUB_TOKEN=****************************************",
"FirstCause": true,
"LastCause": true
},
Expand All @@ -68,7 +68,7 @@
}
]
},
"Match": "export GITHUB_PAT=****************************************",
"Match": "export GITHUB_TOKEN=****************************************",
"Layer": {}
}
]
Expand Down