48 lines
1.6 KiB
YAML
48 lines
1.6 KiB
YAML
name: "Trivy IaC — escaneo de manifiestos Kubernetes"
|
|
description: >-
|
|
Escanea manifiestos Kubernetes buscando misconfiguraciones (root,
|
|
falta de resource limits, falta de probes, etc). Informativo por
|
|
default (no bloquea) — mismo criterio que los 3 pipelines reales del
|
|
lab mientras se revisan los hallazgos antes de decidir qué debería
|
|
bloquear.
|
|
|
|
inputs:
|
|
target:
|
|
description: "Archivo o directorio de manifiestos a escanear."
|
|
required: true
|
|
trivy_version:
|
|
description: "Versión de Trivy a instalar (compartida con trivy-image-step si corrés ambos en el mismo job)."
|
|
required: false
|
|
default: "0.74.0"
|
|
fail_on_findings:
|
|
description: "'true' para bloquear el pipeline si hay hallazgos. Default 'false' (auditoría)."
|
|
required: false
|
|
default: "false"
|
|
|
|
runs:
|
|
using: composite
|
|
steps:
|
|
- name: Instalar Trivy
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
curl -sSfL \
|
|
"https://github.com/aquasecurity/trivy/releases/download/v${{ inputs.trivy_version }}/trivy_${{ inputs.trivy_version }}_Linux-64bit.tar.gz" \
|
|
-o /tmp/trivy.tar.gz
|
|
tar -xzf /tmp/trivy.tar.gz -C /tmp trivy
|
|
chmod +x /tmp/trivy
|
|
/tmp/trivy version
|
|
|
|
- name: Escanear manifiestos Kubernetes (Trivy IaC)
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
EXIT_CODE=0
|
|
if [ "${{ inputs.fail_on_findings }}" = "true" ]; then
|
|
EXIT_CODE=1
|
|
fi
|
|
/tmp/trivy config \
|
|
--severity CRITICAL,HIGH,MEDIUM \
|
|
--exit-code "${EXIT_CODE}" \
|
|
"${{ inputs.target }}"
|