diff --git a/.github/workflows/trivy-dashbaord-4-4.yml b/.github/workflows/trivy-dashbaord-4-4.yml new file mode 100644 index 00000000..bc8806ce --- /dev/null +++ b/.github/workflows/trivy-dashbaord-4-4.yml @@ -0,0 +1,71 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +name: Trivy scan Wazuh dashboard + +on: + release: + types: + - published + pull_request: + branches: + - master + - stable + schedule: + - cron: '*/30 * * * *' + workflow_dispatch: + +permissions: + contents: read + +jobs: + build: + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + + name: Build images and upload Trivy results + runs-on: "ubuntu-latest" + steps: + - name: Checkout code + uses: actions/checkout@v3 + with: { ref: 4.4 } + + - name: Installing dependencies + run: | + sudo apt-get update + sudo apt-get install -y jq + - name: Build Wazuh images + run: build-docker-images/build-images.sh + + - name: Create enviroment variables + run: | + cat .env > $GITHUB_ENV + echo "GITHUB_REF_NAME="${GITHUB_REF_NAME%/*} >> $GITHUB_ENV + + - name: Run Trivy vulnerability scanner for Wazuh dashboard + uses: aquasecurity/trivy-action@2a2157eb22c08c9a1fac99263430307b8d1bc7a2 + with: + image-ref: 'wazuh/wazuh-dashboard:${{env.WAZUH_IMAGE_VERSION}}' + format: 'template' + template: '@/contrib/sarif.tpl' + output: 'trivy-results-dashboard.sarif' + severity: 'LOW,MEDIUM,CRITICAL,HIGH' + + - name: Upload Trivy scan results to GitHub Security tab + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: 'trivy-results-dashboard.sarif' + + - name: Slack notification + uses: rtCamp/action-slack-notify@v2 + env: + SLACK_CHANNEL: cicd-monitoring + SLACK_COLOR: ${{ job.status }} # or a specific color like 'good' or '#ff00ff' + #SLACK_ICON: https://github.com/rtCamp.png?size=48 + SLACK_MESSAGE: "Check the results: https://github.com/wazuh/wazuh-docker/security/code-scanning?query=is%3Aopen+branch%3A${{ env.GITHUB_REF_NAME }}" + SLACK_TITLE: Wazuh docker Trivy vulnerability scan finished. + SLACK_USERNAME: github_actions + SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }} \ No newline at end of file diff --git a/.github/workflows/trivy-indexer-4-4.yml b/.github/workflows/trivy-indexer-4-4.yml new file mode 100644 index 00000000..3969ab62 --- /dev/null +++ b/.github/workflows/trivy-indexer-4-4.yml @@ -0,0 +1,71 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +name: Trivy scan Wazuh indexer + +on: + release: + types: + - published + pull_request: + branches: + - master + - stable + schedule: + - cron: '*/30 * * * *' + workflow_dispatch: + +permissions: + contents: read + +jobs: + build: + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + + name: Build images and upload Trivy results + runs-on: "ubuntu-latest" + steps: + - name: Checkout code + uses: actions/checkout@v3 + with: { ref: 4.4 } + + - name: Installing dependencies + run: | + sudo apt-get update + sudo apt-get install -y jq + - name: Build Wazuh images + run: build-docker-images/build-images.sh + + - name: Create enviroment variables + run: | + cat .env > $GITHUB_ENV + echo "GITHUB_REF_NAME="${GITHUB_REF_NAME%/*} >> $GITHUB_ENV + + - name: Run Trivy vulnerability scanner for Wazuh indexer + uses: aquasecurity/trivy-action@2a2157eb22c08c9a1fac99263430307b8d1bc7a2 + with: + image-ref: 'wazuh/wazuh-indexer:${{env.WAZUH_IMAGE_VERSION}}' + format: 'template' + template: '@/contrib/sarif.tpl' + output: 'trivy-results-indexer.sarif' + severity: 'LOW,MEDIUM,CRITICAL,HIGH' + + - name: Upload Trivy scan results to GitHub Security tab + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: 'trivy-results-indexer.sarif' + + - name: Slack notification + uses: rtCamp/action-slack-notify@v2 + env: + SLACK_CHANNEL: cicd-monitoring + SLACK_COLOR: ${{ job.status }} # or a specific color like 'good' or '#ff00ff' + #SLACK_ICON: https://github.com/rtCamp.png?size=48 + SLACK_MESSAGE: "Check the results: https://github.com/wazuh/wazuh-docker/security/code-scanning?query=is%3Aopen+branch%3A${{ env.GITHUB_REF_NAME }}" + SLACK_TITLE: Wazuh docker Trivy vulnerability scan finished. + SLACK_USERNAME: github_actions + SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }} \ No newline at end of file diff --git a/.github/workflows/trivy-manager-4-4,yml b/.github/workflows/trivy-manager-4-4,yml new file mode 100644 index 00000000..46f1d5bb --- /dev/null +++ b/.github/workflows/trivy-manager-4-4,yml @@ -0,0 +1,71 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +name: Trivy scan Wazuh manager + +on: + release: + types: + - published + pull_request: + branches: + - master + - stable + schedule: + - cron: '*/30 * * * *' + workflow_dispatch: + +permissions: + contents: read + +jobs: + build: + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + + name: Build images and upload Trivy results + runs-on: "ubuntu-latest" + steps: + - name: Checkout code + uses: actions/checkout@v3 + with: { ref: 4.4 } + + - name: Installing dependencies + run: | + sudo apt-get update + sudo apt-get install -y jq + - name: Build Wazuh images + run: build-docker-images/build-images.sh + + - name: Create enviroment variables + run: | + cat .env > $GITHUB_ENV + echo "GITHUB_REF_NAME="${GITHUB_REF_NAME%/*} >> $GITHUB_ENV + + - name: Run Trivy vulnerability scanner for Wazuh manager + uses: aquasecurity/trivy-action@2a2157eb22c08c9a1fac99263430307b8d1bc7a2 + with: + image-ref: 'wazuh/wazuh-manager:${{env.WAZUH_IMAGE_VERSION}}' + format: 'template' + template: '@/contrib/sarif.tpl' + output: 'trivy-results-manager.sarif' + severity: 'LOW,MEDIUM,CRITICAL,HIGH' + + - name: Upload Trivy scan results to GitHub Security tab + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: 'trivy-results-manager.sarif' + + - name: Slack notification + uses: rtCamp/action-slack-notify@v2 + env: + SLACK_CHANNEL: cicd-monitoring + SLACK_COLOR: ${{ job.status }} # or a specific color like 'good' or '#ff00ff' + #SLACK_ICON: https://github.com/rtCamp.png?size=48 + SLACK_MESSAGE: "Check the results: https://github.com/wazuh/wazuh-docker/security/code-scanning?query=is%3Aopen+branch%3A${{ env.GITHUB_REF_NAME }}" + SLACK_TITLE: Wazuh docker Trivy vulnerability scan finished. + SLACK_USERNAME: github_actions + SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }} \ No newline at end of file