diff --git a/.github/WORKFLOWS.md b/.github/WORKFLOWS.md index bf9ce773467..149cec6a3ce 100644 --- a/.github/WORKFLOWS.md +++ b/.github/WORKFLOWS.md @@ -554,7 +554,7 @@ Supply chain security ensures artifacts haven't been tampered with. We provide t - **Runs on:** stable/nightly/rc Docker builds - **Scans:** n8n image, runners image -- **Output:** Slack `#notify-security-scan-outputs` (all), `#mission-security` (critical) +- **Output:** GitHub Actions step summary (`$GITHUB_STEP_SUMMARY`) and run logs ### SBOM diff --git a/.github/workflows/security-trivy-scan-callable.yml b/.github/workflows/security-trivy-scan-callable.yml index 3bf970924c0..14f4c81a208 100644 --- a/.github/workflows/security-trivy-scan-callable.yml +++ b/.github/workflows/security-trivy-scan-callable.yml @@ -13,17 +13,10 @@ on: type: string description: 'Full image reference to scan e.g. ghcr.io/n8n-io/n8n:latest' required: true - secrets: - QBOT_SLACK_TOKEN: - required: true permissions: contents: read -env: - QBOT_SLACK_TOKEN: ${{ secrets.QBOT_SLACK_TOKEN }} - SLACK_CHANNEL_ID: C0AHNJU9XFA #updates-security - jobs: security_scan: name: Security - Scan Docker Image With Trivy @@ -166,98 +159,3 @@ jobs: } >> "$GITHUB_STEP_SUMMARY" fi - - name: Generate Slack Blocks JSON - if: steps.process_results.outputs.vulnerabilities_found == 'true' - id: generate_blocks - env: - IMAGE_REF: ${{ inputs.image_ref }} - run: | - BLOCKS_JSON=$(jq -c --arg image_ref "$IMAGE_REF" \ - --arg repo_url "${{ github.server_url }}/${{ github.repository }}" \ - --arg repo_name "${{ github.repository }}" \ - --arg run_url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \ - --arg critical_count "${{ steps.process_results.outputs.critical_count }}" \ - --arg high_count "${{ steps.process_results.outputs.high_count }}" \ - --arg medium_count "${{ steps.process_results.outputs.medium_count }}" \ - --arg low_count "${{ steps.process_results.outputs.low_count }}" \ - --arg unique_cves "${{ steps.process_results.outputs.unique_cves }}" \ - ' - # Function to create a vulnerability block with emoji indicators - def vuln_block: { - "type": "section", - "text": { - "type": "mrkdwn", - "text": "\(if .Severity == "CRITICAL" then ":red_circle:" elif .Severity == "HIGH" then ":large_orange_circle:" elif .Severity == "MEDIUM" then ":large_yellow_circle:" else ":large_green_circle:" end) ** (CVSS: `\(.CVSS.nvd.V3Score // "N/A")`)\n*Package:* `\(.PkgName)@\(.InstalledVersion)` → `\(.FixedVersion // "No fix available")`" - } - }; - - # Main structure - [ - { - "type": "header", - "text": { "type": "plain_text", "text": ":warning: Trivy Scan: Vulnerabilities Detected" } - }, - { - "type": "section", - "fields": [ - { "type": "mrkdwn", "text": "*Repository:*\n<\($repo_url)|\($repo_name)>" }, - { "type": "mrkdwn", "text": "*Image:*\n`\($image_ref)`" }, - { "type": "mrkdwn", "text": "*Critical:*\n:red_circle: \($critical_count)" }, - { "type": "mrkdwn", "text": "*High:*\n:large_orange_circle: \($high_count)" }, - { "type": "mrkdwn", "text": "*Medium:*\n:large_yellow_circle: \($medium_count)" }, - { "type": "mrkdwn", "text": "*Low:*\n:large_green_circle: \($low_count)" } - ] - }, - { - "type": "context", - "elements": [ - { "type": "mrkdwn", "text": ":shield: \($unique_cves) unique CVEs affecting packages" } - ] - }, - { "type": "divider" } - ] + - ( - # Group vulnerabilities by CVE to avoid duplicates in notification - [.Results[] | select(.Vulnerabilities != null) | .Vulnerabilities[]] | - group_by(.VulnerabilityID) | - map(.[0]) | - sort_by( - (if .Severity == "CRITICAL" then 0 - elif .Severity == "HIGH" then 1 - elif .Severity == "MEDIUM" then 2 - elif .Severity == "LOW" then 3 - else 4 end), - -((.CVSS.nvd.V3Score // 0) | tonumber? // 0) - ) | - .[:8] | - map(. | vuln_block) - ) + - [ - { "type": "divider" }, - { - "type": "actions", - "elements": [ - { - "type": "button", - "text": { "type": "plain_text", "text": ":github: View Full Report" }, - "style": "primary", - "url": $run_url - } - ] - } - ] - ' trivy-results.json) - - echo "slack_blocks=$BLOCKS_JSON" >> "$GITHUB_OUTPUT" - - - name: Send Slack Notification - if: steps.process_results.outputs.vulnerabilities_found == 'true' - uses: slackapi/slack-github-action@91efab103c0de0a537f72a35f6b8cda0ee76bf0a # v2.1.1 - with: - method: chat.postMessage - token: ${{ secrets.QBOT_SLACK_TOKEN }} - payload: | - channel: ${{ env.SLACK_CHANNEL_ID }} - text: "🚨 Trivy Scan: ${{ steps.process_results.outputs.critical_count }} Critical, ${{ steps.process_results.outputs.high_count }} High, ${{ steps.process_results.outputs.medium_count }} Medium, ${{ steps.process_results.outputs.low_count }} Low vulnerabilities found in ${{ inputs.image_ref }}" - blocks: ${{ steps.generate_blocks.outputs.slack_blocks }} -