@sanity-labs/backstage-plugin-trivy-backend 0.0.2 → 0.0.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +1 -1
- package/README.md +0 -114
package/package.json
CHANGED
package/README.md
DELETED
|
@@ -1,114 +0,0 @@
|
|
|
1
|
-
# Trivy Backend Plugin
|
|
2
|
-
|
|
3
|
-
This backend plugin integrates Trivy security scan results from Google Cloud Storage into Backstage.
|
|
4
|
-
|
|
5
|
-
## Features
|
|
6
|
-
|
|
7
|
-
- Fetches Trivy scan results from GCS bucket (`sanity-trivy-logs`)
|
|
8
|
-
- Parses filesystem and image scan outputs
|
|
9
|
-
- Provides REST API endpoints for security findings
|
|
10
|
-
- Links findings to CircleCI builds and GitHub PRs
|
|
11
|
-
|
|
12
|
-
## API Endpoints
|
|
13
|
-
|
|
14
|
-
### `GET /api/trivy/health`
|
|
15
|
-
Health check endpoint.
|
|
16
|
-
|
|
17
|
-
### `GET /api/trivy/scans`
|
|
18
|
-
Returns all security scans sorted by timestamp (newest first).
|
|
19
|
-
|
|
20
|
-
Response:
|
|
21
|
-
```json
|
|
22
|
-
[
|
|
23
|
-
{
|
|
24
|
-
"repo": "alert-relay",
|
|
25
|
-
"branch": "add-ci",
|
|
26
|
-
"scanId": "2627705d-5a14-4d61-ae79-e9ec457b851c",
|
|
27
|
-
"timestamp": "2024-01-15T10:30:00Z",
|
|
28
|
-
"metadata": {
|
|
29
|
-
"circleciUrl": "https://circleci.com/gh/sanity-io/alert-relay/9",
|
|
30
|
-
"githubPr": "https://github.com/sanity-io/alert-relay/pull/4",
|
|
31
|
-
"gitCommit": "6e0858eab194dcab5235b4ef41165f80c7a9dd45",
|
|
32
|
-
"committer": "obliadp"
|
|
33
|
-
},
|
|
34
|
-
"findings": [
|
|
35
|
-
{
|
|
36
|
-
"file": "deploy/base/deployment.yaml",
|
|
37
|
-
"severity": "HIGH",
|
|
38
|
-
"title": "Container should set securityContext.readOnlyRootFilesystem",
|
|
39
|
-
"description": "An immutable root file system prevents...",
|
|
40
|
-
"lines": "18-62",
|
|
41
|
-
"avdId": "https://avd.aquasec.com/misconfig/ksv014"
|
|
42
|
-
}
|
|
43
|
-
]
|
|
44
|
-
}
|
|
45
|
-
]
|
|
46
|
-
```
|
|
47
|
-
|
|
48
|
-
### `GET /api/trivy/scans/:repo/:branch/:scanId`
|
|
49
|
-
Returns a specific scan by repo, branch, and scan ID.
|
|
50
|
-
|
|
51
|
-
### `GET /api/trivy/scans/:repo/latest`
|
|
52
|
-
Returns the latest scan for a specific repository.
|
|
53
|
-
|
|
54
|
-
## Setup
|
|
55
|
-
|
|
56
|
-
1. Ensure you have access to the `sanity-trivy-logs` GCS bucket
|
|
57
|
-
2. Configure GCP credentials for the Backstage backend
|
|
58
|
-
3. Add the plugin to your backend in `packages/backend/src/index.ts`:
|
|
59
|
-
|
|
60
|
-
```typescript
|
|
61
|
-
import trivy from '@internal/backstage-plugin-trivy-backend';
|
|
62
|
-
|
|
63
|
-
const backend = createBackend();
|
|
64
|
-
backend.add(trivy());
|
|
65
|
-
backend.start();
|
|
66
|
-
```
|
|
67
|
-
|
|
68
|
-
## Configuration
|
|
69
|
-
|
|
70
|
-
### app-config.yaml
|
|
71
|
-
|
|
72
|
-
```yaml
|
|
73
|
-
trivy:
|
|
74
|
-
# GCS bucket name (default: sanity-trivy-logs)
|
|
75
|
-
bucketName: sanity-trivy-logs
|
|
76
|
-
|
|
77
|
-
# Backend cache time in minutes (default: 5)
|
|
78
|
-
# How long to cache GCS responses in memory
|
|
79
|
-
cacheTime: 5
|
|
80
|
-
|
|
81
|
-
# Severity filter (default: CRITICAL, HIGH, MEDIUM)
|
|
82
|
-
severityFilter:
|
|
83
|
-
- CRITICAL
|
|
84
|
-
- HIGH
|
|
85
|
-
- MEDIUM
|
|
86
|
-
```
|
|
87
|
-
|
|
88
|
-
### GCP Authentication
|
|
89
|
-
|
|
90
|
-
The plugin uses Google Cloud Storage with Application Default Credentials. Ensure your Backstage backend has appropriate GCP credentials configured.
|
|
91
|
-
|
|
92
|
-
### Caching
|
|
93
|
-
|
|
94
|
-
The backend implements in-memory caching to reduce GCS API calls:
|
|
95
|
-
|
|
96
|
-
- Caches all API responses for the configured `cacheTime` duration
|
|
97
|
-
- Cache keys are based on endpoint parameters
|
|
98
|
-
- Cache stats available via `/api/trivy/health` endpoint
|
|
99
|
-
- Automatic cache invalidation after TTL expires
|
|
100
|
-
|
|
101
|
-
```json
|
|
102
|
-
// GET /api/trivy/health response
|
|
103
|
-
{
|
|
104
|
-
"status": "ok",
|
|
105
|
-
"cache": {
|
|
106
|
-
"size": 3,
|
|
107
|
-
"keys": ["all-scans", "latest-alert-relay", "scan-alert-relay-main-abc123"]
|
|
108
|
-
},
|
|
109
|
-
"config": {
|
|
110
|
-
"bucketName": "sanity-trivy-logs",
|
|
111
|
-
"cacheTime": 5
|
|
112
|
-
}
|
|
113
|
-
}
|
|
114
|
-
```
|