This content originally appeared on DEV Community and was authored by VIET NGUYEN QUOC
Here's a blog post to guide others on setting up a security scan CI pipeline (using Trivy) in GitLab. I am keeping it simple as much as I can.
Setting Up a GitLab CI Pipeline for Security Scanning
Continuous Integration (CI) pipelines play a critical role in automating and securing code development workflows. With GitLab CI, you can automate security scans to detect vulnerabilities and misconfigurations in your code. In this guide, we’ll set up a CI pipeline in GitLab using Trivy, a popular open-source security scanner (https://github.com/aquasecurity/trivy), to perform file system scans for configuration issues and vulnerabilities.
Prerequisites
- GitLab Repository: You’ll need a GitLab project to set up your CI/CD pipeline.
- GitLab Runner: Make sure you have a GitLab Runner available to execute the pipeline jobs.
Step 1: Create the .gitlab-ci.yml File
In the root of your GitLab project, create a .gitlab-ci.yml file. This file defines the stages, jobs, and configuration for your CI/CD pipeline.
Here's the .gitlab-ci.yml configuration for our Trivy security scan job:
security-misc-scan:
stage: security_scan
variables:
TRIVY_NO_PROGRESS: "true" # Disables the progress bar for a cleaner log output
TRIVY_CACHE_DIR: ".trivycache/" # Sets the directory for caching scan data
before_script:
- apt-get update; apt-get install curl -y; # Install curl to retrieve the latest Trivy version
- export TRIVY_VERSION=$(curl -s "https://api.github.com/repos/aquasecurity/trivy/releases/latest" | grep '"tag_name":' | sed -E 's/.*"v([^"]+)".*/\1/') # Fetch the latest Trivy version
- echo $TRIVY_VERSION
- curl -L https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz | tar -zxvf - # Download and extract Trivy
script:
- touch misc-scan-report.json # Create a file to store the scan results
- ./trivy filesystem --scanners config,vuln --exit-code 0 --format template --template "@contrib/gitlab-codequality.tpl" -o misc-scan-report.json . # Run Trivy with config and vulnerability scanners
- cat misc-scan-report.json # Display the report in the job log
cache:
paths:
- .trivycache/ # Cache directory to save data between pipeline runs
artifacts:
paths:
- misc-scan-report.json # Save the scan report as an artifact
reports:
codequality: misc-scan-report.json # Report for GitLab Code Quality
when: always # Always run this job
rules:
- if: $CI_PIPELINE_SOURCE == "parent_pipeline" # Run the job only if the pipeline source is parent_pipeline
allow_failure: true # Allow this job to fail without impacting the pipeline status
tags:
- dind # Runner tag for Docker-in-Docker
needs: []
Explanation of the Job Configuration
-
Stage:
security_scandefines the stage in the pipeline where this job will run. - Variables: Trivy environment variables are defined for better output and caching.
- Before Script: This section downloads and installs Trivy. It fetches the latest release version from GitHub, ensuring the scan uses the most recent updates.
-
Script: Runs the Trivy scan on the repository files and generates a JSON report file
misc-scan-report.json. -
Cache: Caches the
.trivycache/directory to speed up scans by reusing downloaded data between jobs. - Artifacts: Stores the JSON report for later review. GitLab can use this report for Code Quality integration.
- Rules: Ensures the job runs only if triggered by a parent pipeline.
-
Tags: Specifies the runner requirements, in this case, a
dind(Docker-in-Docker) compatible runner.
Step 2: Commit and Push Your .gitlab-ci.yml File
After creating the file, commit and push it to your GitLab repository:
git add .gitlab-ci.yml
git commit -m "Add Trivy security scan job to CI pipeline"
git push origin main
Step 3: Monitor the Pipeline
Once pushed, GitLab will automatically trigger the pipeline. You can check the job logs to see Trivy’s progress and review the misc-scan-report.json output for any discovered vulnerabilities or misconfigurations.
You can check the full report at Code Quality tab in Gitlab Pipelines page:
Conclusion
By following these steps, you’ve set up a GitLab CI pipeline that automates security scanning with Trivy, enhancing your project’s security without manual intervention. This approach keeps your codebase secure and compliant, helping you catch potential issues early in the development process.
Let me know if you’d like further customization options for different scan configurations!
This content originally appeared on DEV Community and was authored by VIET NGUYEN QUOC
VIET NGUYEN QUOC | Sciencx (2024-10-27T10:30:34+00:00) Set up Trivy Scanner in GitLab CI. Retrieved from https://www.scien.cx/2024/10/27/set-up-trivy-scanner-in-gitlab-ci/
Please log in to upload a file.
There are no updates yet.
Click the Upload button above to add an update.