Skip to content

Commit ab6099f

Browse files
lelialelia
authored
Pin trufflehog to known-good version tag (#32)
* Pin trufflehog to known-good version tag Signed-off-by: lelia <lelia@socket.dev> * Bump version for release Signed-off-by: lelia <lelia@socket.dev> * Set build time args for Trufflehog + Trivy Signed-off-by: lelia <lelia@socket.dev> * Add instructions for overriding OSS tool versions at build time Signed-off-by: lelia <lelia@socket.dev> --------- Signed-off-by: lelia <lelia@socket.dev>
1 parent 08579d9 commit ab6099f

9 files changed

Lines changed: 78 additions & 68 deletions

File tree

‎Dockerfile‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,12 @@ RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - && \
1919
RUN npm install -g socket
2020

2121
# Install Trivy
22-
RUN curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin v0.67.2
22+
ARG TRIVY_VERSION=v0.67.2
23+
RUN curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /usr/local/bin "${TRIVY_VERSION}"
2324

2425
# Install Trufflehog
25-
RUN curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin
26+
ARG TRUFFLEHOG_VERSION=v3.93.3
27+
RUN curl -sSfL https://raw.githubusercontent.com/trufflesecurity/trufflehog/main/scripts/install.sh | sh -s -- -b /usr/local/bin "${TRUFFLEHOG_VERSION}"
2628

2729
# Install OpenGrep (connector/runtime dependency)
2830
RUN curl -fsSL https://raw.githubusercontent.com/opengrep/opengrep/main/install.sh | bash

‎README.md‎

Lines changed: 14 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ jobs:
2727
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2828

2929
- name: Run Socket Basics
30-
uses: SocketDev/socket-basics@1.0.28
30+
uses: SocketDev/socket-basics@1.0.29
3131
env:
3232
GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
3333
with:
@@ -120,7 +120,7 @@ Configure scanning policies, notification channels, and rule sets for your entir
120120

121121
**Dashboard-Configured (Enterprise):**
122122
```yaml
123-
- uses: SocketDev/socket-basics@1.0.28
123+
- uses: SocketDev/socket-basics@1.0.29
124124
env:
125125
GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
126126
with:
@@ -131,7 +131,7 @@ Configure scanning policies, notification channels, and rule sets for your entir
131131

132132
**CLI-Configured:**
133133
```yaml
134-
- uses: SocketDev/socket-basics@1.0.28
134+
- uses: SocketDev/socket-basics@1.0.29
135135
env:
136136
GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
137137
with:
@@ -147,16 +147,25 @@ Configure scanning policies, notification channels, and rule sets for your entir
147147

148148
```bash
149149
# Build with version tag
150-
docker build -t socketdev/socket-basics:1.0.28 .
150+
docker build -t socketdev/socket-basics:1.0.29 .
151151
152152
# Run scan
153-
docker run --rm -v "$PWD:/workspace" socketdev/socket-basics:1.0.28 \
153+
docker run --rm -v "$PWD:/workspace" socketdev/socket-basics:1.0.29 \
154154
--workspace /workspace \
155155
--python-sast-enabled \
156156
--secret-scanning-enabled \
157157
--console-tabular-enabled
158158
```
159159

160+
Tip: If you need specific Trivy or TruffleHog versions, you can override them at build time:
161+
162+
```bash
163+
docker build \
164+
--build-arg TRIVY_VERSION=v0.67.2 \
165+
--build-arg TRUFFLEHOG_VERSION=v3.93.3 \
166+
-t socketdev/socket-basics:1.0.29 .
167+
```
168+
160169
📖 **[View Docker Installation Guide](docs/local-install-docker.md)**
161170

162171
### CLI
@@ -281,4 +290,3 @@ We welcome contributions! To add new features:
281290
---
282291

283292
**Need help?** Visit our [documentation](docs/) or contact [Socket Support](https://socket.dev/support).
284-

‎docs/github-action.md‎

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ jobs:
3939
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
4040

4141
- name: Run Socket Basics
42-
uses: SocketDev/socket-basics@1.0.28
42+
uses: SocketDev/socket-basics@1.0.29
4343
env:
4444
GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
4545
with:
@@ -79,7 +79,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.
7979

8080
**SAST (Static Analysis):**
8181
```yaml
82-
- uses: SocketDev/socket-basics@1.0.28
82+
- uses: SocketDev/socket-basics@1.0.29
8383
with:
8484
github_token: ${{ secrets.GITHUB_TOKEN }}
8585
# Enable SAST for specific languages
@@ -93,7 +93,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.
9393

9494
**Secret Scanning:**
9595
```yaml
96-
- uses: SocketDev/socket-basics@1.0.28
96+
- uses: SocketDev/socket-basics@1.0.29
9797
with:
9898
github_token: ${{ secrets.GITHUB_TOKEN }}
9999
secret_scanning_enabled: 'true'
@@ -105,7 +105,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.
105105

106106
**Container Scanning:**
107107
```yaml
108-
- uses: SocketDev/socket-basics@1.0.28
108+
- uses: SocketDev/socket-basics@1.0.29
109109
with:
110110
github_token: ${{ secrets.GITHUB_TOKEN }}
111111
# Scan Docker images (auto-enables container scanning)
@@ -116,7 +116,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.
116116

117117
**Socket Tier 1 Reachability:**
118118
```yaml
119-
- uses: SocketDev/socket-basics@1.0.28
119+
- uses: SocketDev/socket-basics@1.0.29
120120
with:
121121
github_token: ${{ secrets.GITHUB_TOKEN }}
122122
socket_tier_1_enabled: 'true'
@@ -125,7 +125,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.
125125
### Output Configuration
126126

127127
```yaml
128-
- uses: SocketDev/socket-basics@1.0.28
128+
- uses: SocketDev/socket-basics@1.0.29
129129
with:
130130
github_token: ${{ secrets.GITHUB_TOKEN }}
131131
python_sast_enabled: 'true'
@@ -155,7 +155,7 @@ Configure Socket Basics centrally from the [Socket Dashboard](https://socket.dev
155155

156156
**Enable in workflow:**
157157
```yaml
158-
- uses: SocketDev/socket-basics@1.0.28
158+
- uses: SocketDev/socket-basics@1.0.29
159159
env:
160160
GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
161161
with:
@@ -167,7 +167,7 @@ Configure Socket Basics centrally from the [Socket Dashboard](https://socket.dev
167167

168168
> **Note:** You can also pass credentials using environment variables instead of the `with:` section:
169169
> ```yaml
170-
> - uses: SocketDev/socket-basics@1.0.28
170+
> - uses: SocketDev/socket-basics@1.0.29
171171
> env:
172172
> SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_SECURITY_API_KEY }}
173173
> with:
@@ -185,7 +185,7 @@ All notification integrations require Socket Enterprise.
185185

186186
**Slack Notifications:**
187187
```yaml
188-
- uses: SocketDev/socket-basics@1.0.28
188+
- uses: SocketDev/socket-basics@1.0.29
189189
with:
190190
github_token: ${{ secrets.GITHUB_TOKEN }}
191191
socket_org: ${{ secrets.SOCKET_ORG }}
@@ -197,7 +197,7 @@ All notification integrations require Socket Enterprise.
197197

198198
**Jira Issue Creation:**
199199
```yaml
200-
- uses: SocketDev/socket-basics@1.0.28
200+
- uses: SocketDev/socket-basics@1.0.29
201201
with:
202202
github_token: ${{ secrets.GITHUB_TOKEN }}
203203
socket_org: ${{ secrets.SOCKET_ORG }}
@@ -212,7 +212,7 @@ All notification integrations require Socket Enterprise.
212212

213213
**Microsoft Teams:**
214214
```yaml
215-
- uses: SocketDev/socket-basics@1.0.28
215+
- uses: SocketDev/socket-basics@1.0.29
216216
with:
217217
github_token: ${{ secrets.GITHUB_TOKEN }}
218218
socket_org: ${{ secrets.SOCKET_ORG }}
@@ -224,7 +224,7 @@ All notification integrations require Socket Enterprise.
224224

225225
**Generic Webhook:**
226226
```yaml
227-
- uses: SocketDev/socket-basics@1.0.28
227+
- uses: SocketDev/socket-basics@1.0.29
228228
with:
229229
github_token: ${{ secrets.GITHUB_TOKEN }}
230230
socket_org: ${{ secrets.SOCKET_ORG }}
@@ -236,7 +236,7 @@ All notification integrations require Socket Enterprise.
236236

237237
**SIEM Integration:**
238238
```yaml
239-
- uses: SocketDev/socket-basics@1.0.28
239+
- uses: SocketDev/socket-basics@1.0.29
240240
with:
241241
github_token: ${{ secrets.GITHUB_TOKEN }}
242242
socket_org: ${{ secrets.SOCKET_ORG }}
@@ -272,7 +272,7 @@ jobs:
272272
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
273273
274274
- name: Run Socket Basics
275-
uses: SocketDev/socket-basics@1.0.28
275+
uses: SocketDev/socket-basics@1.0.29
276276
env:
277277
GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
278278
with:
@@ -318,7 +318,7 @@ jobs:
318318
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
319319
320320
- name: Run Full Security Scan
321-
uses: SocketDev/socket-basics@1.0.28
321+
uses: SocketDev/socket-basics@1.0.29
322322
env:
323323
GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
324324
with:
@@ -369,10 +369,10 @@ jobs:
369369
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
370370
371371
- name: Build Docker Image
372-
run: docker build -t myapp:1.0.28:${{ github.sha }} .
372+
run: docker build -t myapp:1.0.29:${{ github.sha }} .
373373
374374
- name: Scan Container
375-
uses: SocketDev/socket-basics@1.0.28
375+
uses: SocketDev/socket-basics@1.0.29
376376
env:
377377
GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
378378
with:
@@ -435,7 +435,7 @@ jobs:
435435
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
436436
437437
- name: Run Socket Basics
438-
uses: SocketDev/socket-basics@1.0.28
438+
uses: SocketDev/socket-basics@1.0.29
439439
env:
440440
GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
441441
with:
@@ -487,7 +487,7 @@ jobs:
487487
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
488488
489489
- name: Run Socket Basics
490-
uses: SocketDev/socket-basics@1.0.28
490+
uses: SocketDev/socket-basics@1.0.29
491491
env:
492492
GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
493493
with:
@@ -580,7 +580,7 @@ env:
580580
```yaml
581581
steps:
582582
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - Must be first
583-
- uses: SocketDev/socket-basics@1.0.28
583+
- uses: SocketDev/socket-basics@1.0.29
584584
```
585585

586586
### PR Comments Not Appearing

0 commit comments

Comments
 (0)