kelly/donetick-notifier
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fixing security scan mount points
Security / security (push) Failing after 57s
Details

Browse Source
This commit is contained in:
Kelly Thomas Reardon
2026-05-13 08:00:08 -05:00
parent d32cc1c1db
commit 4d711859ac
1 changed files with 33 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/security.yaml
+33 -17
View File
@@ -30,15 +30,19 @@ jobs:
- name: Gitleaks - name: Gitleaks
run: | run: |
set +e set +e
docker run --rm \ cid="$(docker create \
-v ${{ gitea.workspace }}:/repo \
ghcr.io/gitleaks/gitleaks:latest \ ghcr.io/gitleaks/gitleaks:latest \
detect \ detect \
--source /repo \ --source /repo \
--report-format json \ --report-format json \
--report-path /repo/security-results/gitleaks.json \ --report-path /repo/security-results/gitleaks.json \
--exit-code 1 --exit-code 1)"
echo "$?" > security-results/gitleaks.exit docker cp . "$cid:/repo"
docker start -a "$cid"
status="$?"
docker cp "$cid:/repo/security-results/gitleaks.json" security-results/gitleaks.json || true
docker rm -f "$cid" >/dev/null 2>&1 || true
echo "$status" > security-results/gitleaks.exit
########################################################### ###########################################################
# SEMGREP # SEMGREP
@@ -47,16 +51,21 @@ jobs:
- name: Semgrep - name: Semgrep
run: | run: |
set +e set +e
docker run --rm \ cid="$(docker create \
-v ${{ gitea.workspace }}:/src \ --workdir /src \
semgrep/semgrep \ semgrep/semgrep \
semgrep scan \ semgrep scan \
--config auto \ --config auto \
--json \ --json \
--output /src/security-results/semgrep.json \ --output /src/security-results/semgrep.json \
--error \ --error \
/src /src)"
echo "$?" > security-results/semgrep.exit docker cp . "$cid:/src"
docker start -a "$cid"
status="$?"
docker cp "$cid:/src/security-results/semgrep.json" security-results/semgrep.json || true
docker rm -f "$cid" >/dev/null 2>&1 || true
echo "$status" > security-results/semgrep.exit
########################################################### ###########################################################
# TRIVY FS # TRIVY FS
@@ -65,8 +74,7 @@ jobs:
- name: Trivy Filesystem - name: Trivy Filesystem
run: | run: |
set +e set +e
docker run --rm \ cid="$(docker create \
-v ${{ gitea.workspace }}:/workspace \
aquasec/trivy:latest \ aquasec/trivy:latest \
fs \ fs \
--scanners vuln,secret,misconfig \ --scanners vuln,secret,misconfig \
@@ -74,8 +82,13 @@ jobs:
--format json \ --format json \
--output /workspace/security-results/trivy-fs.json \ --output /workspace/security-results/trivy-fs.json \
--exit-code 1 \ --exit-code 1 \
/workspace /workspace)"
echo "$?" > security-results/trivy-fs.exit docker cp . "$cid:/workspace"
docker start -a "$cid"
status="$?"
docker cp "$cid:/workspace/security-results/trivy-fs.json" security-results/trivy-fs.json || true
docker rm -f "$cid" >/dev/null 2>&1 || true
echo "$status" > security-results/trivy-fs.exit
########################################################### ###########################################################
# DOCKER IMAGE BUILD # DOCKER IMAGE BUILD
@@ -100,17 +113,20 @@ jobs:
exit 0 exit 0
fi fi
docker run --rm \ cid="$(docker create \
-v /var/run/docker.sock:/var/run/docker.sock \ -v /var/run/docker.sock:/var/run/docker.sock \
-v ${{ gitea.workspace }}:/workspace \
aquasec/trivy:latest \ aquasec/trivy:latest \
image \ image \
--severity HIGH,CRITICAL \ --severity HIGH,CRITICAL \
--format json \ --format json \
--output /workspace/security-results/trivy-image.json \ --output /tmp/trivy-image.json \
--exit-code 1 \ --exit-code 1 \
app:${{ gitea.sha }} app:${{ gitea.sha }})"
echo "$?" > security-results/trivy-image.exit docker start -a "$cid"
status="$?"
docker cp "$cid:/tmp/trivy-image.json" security-results/trivy-image.json || true
docker rm -f "$cid" >/dev/null 2>&1 || true
echo "$status" > security-results/trivy-image.exit
- name: Create Gitea issues for security findings - name: Create Gitea issues for security findings
if: always() if: always()