Add further changes to GH actions to fix page upload and trivy SARIF …

…upload

.github/conf/.trivyignore

@@ -1,5 +1,9 @@
-# We dont use HEALTHCHECK for Dockerfiles as we dont run any services
-AVD-DS-0026
-
-# S3 Bucket Logging is currently not enabled
-AVD-AWS-0089
+misconfigurations:
+  - id: AVD-DS-0026 # We dont use HEALTHCHECK for Dockerfiles as we dont run any services
+  - id: AVD-AWS-0089 # S3 Bucket Logging is currently not enabled
+  - id: AVD-AWS-0066 # Function does not have tracing enabled
+  - id: AVD-AWS-0132
+  - id: AVD-AWS-0088
+  - id: AVD-AWS-0132
+  - id: AVD-AWS-0090
+  - id: AVD-AWS-0066

.github/conf/trivy.yaml

@@ -9,7 +9,7 @@ format: sarif
 scan:
   scanners:
     - vuln
-    - config
+    - misconfig
     # - secret
     # - license
 
@@ -29,5 +29,5 @@ scan:
 #   - CRITICAL
 #   - UNKNOWN
 
-# vulnerability:
-#   ignore-unfixed: true
+vulnerability:
+  ignore-unfixed: true

.github/workflows/doc_builder.yaml

@@ -14,7 +14,8 @@ jobs:
   build:
     name: Deploy docs
     permissions:
-      contents: write # for actions/checkout to fetch code
+      contents: write # for actions/checkout to fetch code and  creating gh-pages
+      pages: write # for creating github pages
       security-events: write # for creating github pages
     runs-on: ubuntu-latest
 

.github/workflows/iac_scan.yaml

@@ -25,30 +25,33 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Run trivy in fs mode and generate report
-        uses: aquasecurity/trivy-action@master
+        uses: aquasecurity/trivy-action@0.20.0
         with:
           scan-type: 'fs'
-          ignore-unfixed: true
+          # ignore-unfixed: true
           trivy-config: ".github/conf/trivy.yaml"
           trivyignores: ".github/conf/.trivyignore"
+          exit-code: '0'
           # severity: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
+          # format: 'sarif'
           # output: ${{ env.TRIVY_REPORT_FILE }} # This flag doesnt seem to be working.
         env:
           TRIVY_OUTPUT: ${{ env.TRIVY_REPORT_FILE }}
 
       # As per the following issue/solution: https://github.com/aquasecurity/trivy/issues/5003
-      - name: Fix trivy SARIF report for URI scheme
-        run: |-
-          sed -i 's#git::https:/##g' ${{ env.TRIVY_REPORT_FILE }}
+      # - name: Fix trivy SARIF report for URI scheme
+      #   run: |-
+      #     sed -i 's#git::https:/##g' ${{ env.TRIVY_REPORT_FILE }}
 
       - name: Upload trivy scan results to GitHub Security tab
         uses: github/codeql-action/upload-sarif@v3
-        if: success() || failure()
+        # if: success() || failure()
         with:
           sarif_file: "${{ env.TRIVY_REPORT_FILE }}"
 
       - name: Save report results as an artifact
         uses: actions/upload-artifact@v4
+        if: success() || failure()
         with:
           name: ${{ env.TRIVY_REPORT_FILE }}
           path: ${{ env.TRIVY_REPORT_FILE }}

deployment/dev_environment_cloud9/cfn/.trivyignore

@@ -1,5 +1,7 @@
 #Bucket only contains Cloud9 deployment logs and doesnt require encryption
+
 AVD-AWS-0132
 AVD-AWS-0088
 AVD-AWS-0132
 AVD-AWS-0090
+AVD-AWS-0066