diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md index 812a8ca..6727d30 100644 --- a/.github/PULL_REQUEST_TEMPLATE.md +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -25,7 +25,7 @@ - [ ] I have added tests to cover my changes - [ ] I have updated the documentation accordingly - [ ] This PR is a result of pair or mob programming -- [ ] If I have used the 'skip-trivy-package' label I have done so responsibly and in the knowledge that this is being fixed as part of a separate ticket/PR. + --- diff --git a/.github/actions/trivy-iac/action.yaml b/.github/actions/trivy-iac/action.yaml index d3134a6..27075ac 100644 --- a/.github/actions/trivy-iac/action.yaml +++ b/.github/actions/trivy-iac/action.yaml @@ -1,19 +1,20 @@ -name: "Trivy IaC Scan" -description: "Scan Terraform IaC using Trivy" -runs: - using: "composite" - steps: - - name: "Trivy Terraform IaC Scan" - shell: bash - run: | - components_exit_code=0 - modules_exit_code=0 - asdf plugin add trivy || true - asdf install trivy || true - ./scripts/terraform/trivy-scan.sh --mode iac ./infrastructure/terraform/components || components_exit_code=$? - ./scripts/terraform/trivy-scan.sh --mode iac ./infrastructure/terraform/modules || modules_exit_code=$? +# TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549 +# name: "Trivy IaC Scan" +# description: "Scan Terraform IaC using Trivy" +# runs: +# using: "composite" +# steps: +# - name: "Trivy Terraform IaC Scan" +# shell: bash +# run: | +# components_exit_code=0 +# modules_exit_code=0 +# asdf plugin add trivy || true +# asdf install trivy || true +# ./scripts/terraform/trivy-scan.sh --mode iac ./infrastructure/terraform/components || components_exit_code=$? +# ./scripts/terraform/trivy-scan.sh --mode iac ./infrastructure/terraform/modules || modules_exit_code=$? - if [ $components_exit_code -ne 0 ] || [ $modules_exit_code -ne 0 ]; then - echo "Trivy misconfigurations detected." - exit 1 - fi +# if [ $components_exit_code -ne 0 ] || [ $modules_exit_code -ne 0 ]; then +# echo "Trivy misconfigurations detected." +# exit 1 +# fi diff --git a/.github/actions/trivy-package/action.yaml b/.github/actions/trivy-package/action.yaml index 783948e..7cad282 100644 --- a/.github/actions/trivy-package/action.yaml +++ b/.github/actions/trivy-package/action.yaml @@ -1,17 +1,18 @@ -name: "Trivy Package Scan" -description: "Scan project packages using Trivy" -runs: - using: "composite" - steps: - - name: "Trivy Package Scan" - shell: bash - run: | - exit_code=0 - asdf plugin add trivy || true - asdf install trivy || true - ./scripts/terraform/trivy-scan.sh --mode package . || exit_code=$? +# TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549 +# name: "Trivy Package Scan" +# description: "Scan project packages using Trivy" +# runs: +# using: "composite" +# steps: +# - name: "Trivy Package Scan" +# shell: bash +# run: | +# exit_code=0 +# asdf plugin add trivy || true +# asdf install trivy || true +# ./scripts/terraform/trivy-scan.sh --mode package . || exit_code=$? - if [ $exit_code -ne 0 ]; then - echo "Trivy has detected package vulnerablilites. Please refer to https://nhsd-confluence.digital.nhs.uk/spaces/RIS/pages/1257636917/PLAT-KOP-012+-+Trivy+Pipeline+Vulnerability+Scanning+Exemption" - exit 1 - fi +# if [ $exit_code -ne 0 ]; then +# echo "Trivy has detected package vulnerablilites. Please refer to https://nhsd-confluence.digital.nhs.uk/spaces/RIS/pages/1257636917/PLAT-KOP-012+-+Trivy+Pipeline+Vulnerability+Scanning+Exemption" +# exit 1 +# fi diff --git a/.github/workflows/cicd-1-pull-request.yaml b/.github/workflows/cicd-1-pull-request.yaml index 90a8242..0eef983 100644 --- a/.github/workflows/cicd-1-pull-request.yaml +++ b/.github/workflows/cicd-1-pull-request.yaml @@ -32,7 +32,8 @@ jobs: is_version_prerelease: ${{ steps.variables.outputs.is_version_prerelease }} does_pull_request_exist: ${{ steps.pr_exists.outputs.does_pull_request_exist }} pr_number: ${{ steps.pr_exists.outputs.pr_number }} - skip_trivy_package: ${{ steps.skip_trivy.outputs.skip_trivy_package }} + # TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549 + # skip_trivy_package: ${{ steps.skip_trivy.outputs.skip_trivy_package }} steps: - name: "Checkout code" uses: actions/checkout@v4 @@ -72,26 +73,27 @@ jobs: echo "does_pull_request_exist=false" >> $GITHUB_OUTPUT echo "pr_number=" >> $GITHUB_OUTPUT fi - - name: "Determine if Trivy package scan should be skipped" - id: skip_trivy - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - PR_NUMBER: ${{ steps.pr_exists.outputs.pr_number }} - run: | - if [[ -z "$PR_NUMBER" ]]; then - echo "No pull request detected; Trivy package scan will run." - echo "skip_trivy_package=false" >> $GITHUB_OUTPUT - exit 0 - fi + # TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549 + # - name: "Determine if Trivy package scan should be skipped" + # id: skip_trivy + # env: + # GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + # PR_NUMBER: ${{ steps.pr_exists.outputs.pr_number }} + # run: | + # if [[ -z "$PR_NUMBER" ]]; then + # echo "No pull request detected; Trivy package scan will run." + # echo "skip_trivy_package=false" >> $GITHUB_OUTPUT + # exit 0 + # fi - labels=$(gh pr view "$PR_NUMBER" --json labels --jq '.labels[].name') - echo "Labels on PR #$PR_NUMBER: $labels" + # labels=$(gh pr view "$PR_NUMBER" --json labels --jq '.labels[].name') + # echo "Labels on PR #$PR_NUMBER: $labels" - if echo "$labels" | grep -Fxq 'skip-trivy-package'; then - echo "skip_trivy_package=true" >> $GITHUB_OUTPUT - else - echo "skip_trivy_package=false" >> $GITHUB_OUTPUT - fi + # if echo "$labels" | grep -Fxq 'skip-trivy-package'; then + # echo "skip_trivy_package=true" >> $GITHUB_OUTPUT + # else + # echo "skip_trivy_package=false" >> $GITHUB_OUTPUT + # fi - name: "List variables" run: | export BUILD_DATETIME_LONDON="${{ steps.variables.outputs.build_datetime_london }}" @@ -115,7 +117,8 @@ jobs: build_epoch: "${{ needs.metadata.outputs.build_epoch }}" nodejs_version: "${{ needs.metadata.outputs.nodejs_version }}" python_version: "${{ needs.metadata.outputs.python_version }}" - skip_trivy_package: ${{ needs.metadata.outputs.skip_trivy_package == 'true' }} + # TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549 + # skip_trivy_package: ${{ needs.metadata.outputs.skip_trivy_package == 'true' }} terraform_version: "${{ needs.metadata.outputs.terraform_version }}" version: "${{ needs.metadata.outputs.version }}" secrets: inherit diff --git a/.github/workflows/stage-1-commit.yaml b/.github/workflows/stage-1-commit.yaml index 8e3e342..a8929b7 100644 --- a/.github/workflows/stage-1-commit.yaml +++ b/.github/workflows/stage-1-commit.yaml @@ -23,10 +23,10 @@ on: description: "Python version, set by the CI/CD pipeline workflow" required: true type: string - skip_trivy_package: - description: "Skip Trivy package scan when true" - type: boolean - default: false + # skip_trivy_package: + # description: "Skip Trivy package scan when true" + # type: boolean + # default: false terraform_version: description: "Terraform version, set by the CI/CD pipeline workflow" required: true @@ -152,35 +152,35 @@ jobs: uses: asdf-vm/actions/setup@b7bcd026f18772e44fe1026d729e1611cc435d47 # v4 - name: "Lint Terraform" uses: ./.github/actions/lint-terraform - trivy-iac: - name: "Trivy IaC Scan" - permissions: - contents: read - runs-on: ubuntu-latest - timeout-minutes: 10 - needs: detect-terraform-changes - if: needs.detect-terraform-changes.outputs.terraform_changed == 'true' - steps: - - name: "Checkout code" - uses: actions/checkout@v4 - - name: "Setup ASDF" - uses: asdf-vm/actions/setup@1902764435ca0dd2f3388eea723a4f92a4eb8302 - - name: "Trivy IaC Scan" - uses: ./.github/actions/trivy-iac - trivy-package: - if: ${{ !inputs.skip_trivy_package }} - name: "Trivy Package Scan" - permissions: - contents: read - runs-on: ubuntu-latest - timeout-minutes: 10 - steps: - - name: "Checkout code" - uses: actions/checkout@v4 - - name: "Setup ASDF" - uses: asdf-vm/actions/setup@1902764435ca0dd2f3388eea723a4f92a4eb8302 - - name: "Trivy Package Scan" - uses: ./.github/actions/trivy-package + # trivy-iac: + # name: "Trivy IaC Scan" + # permissions: + # contents: read + # runs-on: ubuntu-latest + # timeout-minutes: 10 + # needs: detect-terraform-changes + # if: needs.detect-terraform-changes.outputs.terraform_changed == 'true' + # steps: + # - name: "Checkout code" + # uses: actions/checkout@v4 + # - name: "Setup ASDF" + # uses: asdf-vm/actions/setup@1902764435ca0dd2f3388eea723a4f92a4eb8302 + # - name: "Trivy IaC Scan" + # uses: ./.github/actions/trivy-iac + # trivy-package: + # if: ${{ !inputs.skip_trivy_package }} + # name: "Trivy Package Scan" + # permissions: + # contents: read + # runs-on: ubuntu-latest + # timeout-minutes: 10 + # steps: + # - name: "Checkout code" + # uses: actions/checkout@v4 + # - name: "Setup ASDF" + # uses: asdf-vm/actions/setup@1902764435ca0dd2f3388eea723a4f92a4eb8302 + # - name: "Trivy Package Scan" + # uses: ./.github/actions/trivy-package count-lines-of-code: name: "Count lines of code" runs-on: ubuntu-latest diff --git a/.tool-versions b/.tool-versions index 4b5b3d4..8c7a172 100644 --- a/.tool-versions +++ b/.tool-versions @@ -5,7 +5,8 @@ nodejs 22.11.0 pre-commit 3.6.0 terraform 1.10.1 terraform-docs 0.19.0 -trivy 0.61.0 +# TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549 +# trivy 0.61.0 vale 3.6.0 python 3.13.2 diff --git a/scripts/terraform/terraform.mk b/scripts/terraform/terraform.mk index bb8552a..ffd0e02 100644 --- a/scripts/terraform/terraform.mk +++ b/scripts/terraform/terraform.mk @@ -118,9 +118,10 @@ terraform-validate-all: # Validate all Terraform components @Quality fi; \ done -terraform-sec: # Run Trivy IaC security scanning on Terraform code @Quality - # Example: make terraform-sec - ./scripts/terraform/trivy-scan.sh --mode iac infrastructure/terraform +# TODO - Re-visit Trivy usage https://nhsd-jira.digital.nhs.uk/browse/CCM-15549 +# terraform-sec: # Run Trivy IaC security scanning on Terraform code @Quality +# # Example: make terraform-sec +# ./scripts/terraform/trivy-scan.sh --mode iac infrastructure/terraform terraform-docs: # Generate Terraform documentation - optional: component=[specific component, or all if omitted] @Quality # Example: make terraform-docs component=mycomp