chore(ci): Save Trivy cache to avoid Trivy TOOMANYREQUESTS errors #182
Conversation
WalkthroughA new GitHub Actions workflow file named Changes
Poem
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Outside diff range and nitpick comments (2)
.github/workflows/update-trivy-cache.yaml (2)
14-16: Consider using double quotes in the echo command.While the current implementation works, it's generally recommended to use double quotes in shell commands to prevent potential issues with word splitting or globbing.
Consider updating the line as follows:
- run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT + run: echo "date=$(date +"%Y-%m-%d")" >> "$GITHUB_OUTPUT"🧰 Tools
🪛 actionlint
16-16: shellcheck reported issue in this script: SC2086:info:1:36: Double quote to prevent globbing and word splitting
(shellcheck)
1-38: Overall, the workflow is well-designed with room for minor improvements.This new workflow effectively accomplishes its goal of updating and caching Trivy vulnerability databases. The structure is clear, and the use of caching will optimize subsequent runs.
To further enhance the workflow:
- Implement more robust error handling in the database download steps.
- Use double quotes consistently in shell commands to prevent potential issues.
- Consider adding a step to verify the integrity of the downloaded databases.
These improvements will make the workflow more resilient and align it with best practices in shell scripting and GitHub Actions.
Would you like assistance in implementing any of these suggestions?
🧰 Tools
🪛 actionlint
16-16: shellcheck reported issue in this script: SC2086:info:1:36: Double quote to prevent globbing and word splitting
(shellcheck)
19-19: shellcheck reported issue in this script: SC2086:info:1:10: Double quote to prevent globbing and word splitting
(shellcheck)
19-19: shellcheck reported issue in this script: SC2086:info:4:23: Double quote to prevent globbing and word splitting
(shellcheck)
27-27: shellcheck reported issue in this script: SC2086:info:1:10: Double quote to prevent globbing and word splitting
(shellcheck)
27-27: shellcheck reported issue in this script: SC2086:info:4:27: Double quote to prevent globbing and word splitting
(shellcheck)
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
📒 Files selected for processing (1)
- .github/workflows/update-trivy-cache.yaml (1 hunks)
🧰 Additional context used
🪛 actionlint
.github/workflows/update-trivy-cache.yaml
16-16: shellcheck reported issue in this script: SC2086:info:1:36: Double quote to prevent globbing and word splitting
(shellcheck)
19-19: shellcheck reported issue in this script: SC2086:info:1:10: Double quote to prevent globbing and word splitting
(shellcheck)
19-19: shellcheck reported issue in this script: SC2086:info:4:23: Double quote to prevent globbing and word splitting
(shellcheck)
27-27: shellcheck reported issue in this script: SC2086:info:1:10: Double quote to prevent globbing and word splitting
(shellcheck)
27-27: shellcheck reported issue in this script: SC2086:info:4:27: Double quote to prevent globbing and word splitting
(shellcheck)
🔇 Additional comments (2)
.github/workflows/update-trivy-cache.yaml (2)
1-8: LGTM: Workflow name and triggers are well-defined.The workflow name accurately describes its purpose, and the triggers (daily schedule and manual) are appropriate for updating the Trivy cache.
34-38: LGTM: Caching step is well-implemented.The use of
actions/cache/save@v4with a date-based cache key is an excellent approach to ensure that the Trivy databases are cached daily. This implementation will help optimize subsequent workflow runs by reusing the cached databases when possible.
| - name: Download and extract the vulnerability DB | ||
| run: | | ||
| mkdir -p $GITHUB_WORKSPACE/.cache/trivy/db | ||
| oras copy ghcr.io/aquasecurity/trivy-db:2 ghcr.io/tiryoh/aquasecurity/trivy-db:2 || echo "err" | ||
| oras pull ghcr.io/aquasecurity/trivy-db:2 || oras pull ghcr.io/tiryoh/aquasecurity/trivy-db:2 | ||
| tar -xzf db.tar.gz -C $GITHUB_WORKSPACE/.cache/trivy/db | ||
| rm db.tar.gz |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Enhance error handling and use double quotes for variables.
The fallback mechanism for database download is a good practice. However, there are a few areas that could be improved:
- Error handling: Instead of
echo "err", consider using proper error messages and exit codes. - Variable quoting: Use double quotes around variables to prevent word splitting and globbing issues.
Consider updating the step as follows:
- name: Download and extract the vulnerability DB
run: |
mkdir -p "$GITHUB_WORKSPACE/.cache/trivy/db"
if ! oras copy ghcr.io/aquasecurity/trivy-db:2 ghcr.io/tiryoh/aquasecurity/trivy-db:2; then
echo "Failed to copy trivy-db, falling back to direct pull"
fi
if ! (oras pull ghcr.io/aquasecurity/trivy-db:2 || oras pull ghcr.io/tiryoh/aquasecurity/trivy-db:2); then
echo "Failed to pull trivy-db from both sources" >&2
exit 1
fi
tar -xzf db.tar.gz -C "$GITHUB_WORKSPACE/.cache/trivy/db"
rm db.tar.gzThis update improves error handling and adds proper quoting for variables.
🧰 Tools
🪛 actionlint
19-19: shellcheck reported issue in this script: SC2086:info:1:10: Double quote to prevent globbing and word splitting
(shellcheck)
19-19: shellcheck reported issue in this script: SC2086:info:4:23: Double quote to prevent globbing and word splitting
(shellcheck)
| - name: Download and extract the Java DB | ||
| run: | | ||
| mkdir -p $GITHUB_WORKSPACE/.cache/trivy/java-db | ||
| oras copy ghcr.io/aquasecurity/trivy-java-db:1 ghcr.io/tiryoh/aquasecurity/trivy-java-db:1 || echo "err" | ||
| oras pull ghcr.io/aquasecurity/trivy-java-db:1 || oras pull ghcr.io/tiryoh/aquasecurity/trivy-java-db:1 | ||
| tar -xzf javadb.tar.gz -C $GITHUB_WORKSPACE/.cache/trivy/java-db | ||
| rm javadb.tar.gz |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Apply similar improvements to the Java DB download step.
This step could benefit from the same enhancements suggested for the previous step:
- Improved error handling
- Proper variable quoting
Consider updating the step as follows:
- name: Download and extract the Java DB
run: |
mkdir -p "$GITHUB_WORKSPACE/.cache/trivy/java-db"
if ! oras copy ghcr.io/aquasecurity/trivy-java-db:1 ghcr.io/tiryoh/aquasecurity/trivy-java-db:1; then
echo "Failed to copy trivy-java-db, falling back to direct pull"
fi
if ! (oras pull ghcr.io/aquasecurity/trivy-java-db:1 || oras pull ghcr.io/tiryoh/aquasecurity/trivy-java-db:1); then
echo "Failed to pull trivy-java-db from both sources" >&2
exit 1
fi
tar -xzf javadb.tar.gz -C "$GITHUB_WORKSPACE/.cache/trivy/java-db"
rm javadb.tar.gzThis update aligns the Java DB step with the improvements suggested for the vulnerability DB step.
🧰 Tools
🪛 actionlint
27-27: shellcheck reported issue in this script: SC2086:info:1:10: Double quote to prevent globbing and word splitting
(shellcheck)
27-27: shellcheck reported issue in this script: SC2086:info:4:27: Double quote to prevent globbing and word splitting
(shellcheck)
Tiryoh
changed the title
Summary by CodeRabbit
New Features
Chores