Security scanners

Functions of the tools module at v0.7.0. Each returns what a command runs in; import it with import * as tools from "tools".

trivy.env

Trivy, aquasec/trivy:0.74.0 by default: vulnerabilities, misconfigurations and secrets in a filesystem, a repository or an image. It prints no progress bar (TRIVY_NO_PROGRESS=true).

trivy.env(
  --image: Environment = #aquasec/trivy:0.74.0,
  --severity: String | Null = null,
  --exit_code: String | Null = null,
  --cache_dir: String | Null = null,
  --base_access: String | Map<String> | Null = null,
  --with: Array<Record<env: Map<String>, volumes: Array<String>>> = [],
  --extra_env: Map<String> = {}
): Runnable

Without --cache_dir, every run downloads the vulnerability database.

Parameters

• --image The image to run; another release is passed as image = #aquasec/trivy:<tag>.
• --severity TRIVY_SEVERITY, e.g. "HIGH,CRITICAL".
• --exit_code TRIVY_EXIT_CODE: the exit code when something is found, e.g. "1" to fail a build.
• --cache_dir Host directory mounted at /cache; the databases are kept in /cache/trivy (TRIVY_CACHE_DIR).
• --base_access What the container may do with the project directory: "rw" (the default), "ro", "none", or a table of paths such as {".": "ro", "dist": "rw"} (lask spec 10.2).
• --with Setups of other tools this environment should also carry: registry_setup, docker_setup.
• --extra_env Any other variable; below --with and the named parameters.

Returns Runnable: The environment, for command { "trivy" } on ... or $[...].

Image aquasec/trivy:0.74.0

Command words trivy: import command { "trivy" } from "tools"

lask eval trivy.env --severity HIGH,CRITICAL --exit_code 1

lib/trivy.lask

gitleaks.env

Gitleaks, zricethezav/gitleaks:v8.30.1 by default: secrets in the project's files and Git history. The mounted project is trusted by Git (safe.directory), so its history can be read.

gitleaks.env(
  --image: Environment = #zricethezav/gitleaks:v8.30.1,
  --base_access: String | Map<String> | Null = null,
  --with: Array<Record<env: Map<String>, volumes: Array<String>>> = [],
  --extra_env: Map<String> = {}
): Runnable

Parameters

• --image The image to run; another release is passed as image = #zricethezav/gitleaks:<tag>.
• --base_access What the container may do with the project directory: "rw" (the default), "ro", "none", or a table of paths such as {".": "ro", "dist": "rw"} (lask spec 10.2).
• --with Setups of other tools this environment should also carry.
• --extra_env Any other variable; below --with.

Returns Runnable: The environment, for command { "gitleaks" } on ... or $[...].

Image zricethezav/gitleaks:v8.30.1

Command words gitleaks: import command { "gitleaks" } from "tools"

lask eval gitleaks.env

lib/gitleaks.lask

checkov.env

Checkov, bridgecrew/checkov:3.3.19 by default: misconfigurations in Terraform, CloudFormation, Kubernetes manifests, Dockerfiles and workflows.

checkov.env(
  --image: Environment = #bridgecrew/checkov:3.3.19,
  --api_key: String | Null = <secret>,
  --base_access: String | Map<String> | Null = null,
  --with: Array<Record<env: Map<String>, volumes: Array<String>>> = [],
  --extra_env: Map<String> = {}
): Runnable

Parameters

• --image The image to run; another release is passed as image = #bridgecrew/checkov:<tag>.
• --api_key!! BC_API_KEY, for the Prisma Cloud platform; masked in the command log.
• --base_access What the container may do with the project directory: "rw" (the default), "ro", "none", or a table of paths such as {".": "ro", "dist": "rw"} (lask spec 10.2).
• --with Setups of other tools this environment should also carry.
• --extra_env Any other variable; below --with and the named parameters.

Returns Runnable: The environment, for command { "checkov" } on ... or $[...].

Image bridgecrew/checkov:3.3.19

Command words checkov: import command { "checkov" } from "tools"

lask eval checkov.env

lib/checkov.lask

grype.env

Grype, Anchore's vulnerability scanner.

grype.env(
  --cache_dir: String | Null = null,
  --base_access: String | Map<String> | Null = null,
  --with: Array<Record<env: Map<String>, volumes: Array<String>>> = [],
  --extra_env: Map<String> = {}
): Runnable

Anchore's images have no shell, so the image is built from lib/images/anchore/Dockerfile, which copies grype v0.119.0 and syft v1.52.0 onto Alpine: it takes no --image, and lask sync builds it. Grype checks for no update (GRYPE_CHECK_FOR_APP_UPDATE=false).

Without --cache_dir, every run downloads the vulnerability database.

Parameters

• --cache_dir Host directory mounted at /cache; the database is kept in /cache/grype (GRYPE_DB_CACHE_DIR).
• --base_access What the container may do with the project directory: "rw" (the default), "ro", "none", or a table of paths such as {".": "ro", "dist": "rw"} (lask spec 10.2).
• --with Setups of other tools this environment should also carry: registry_setup, docker_setup.
• --extra_env Any other variable; below --with and the named parameters.

Returns Runnable: The environment, for command { "grype" } on ... or $[...].

Image recipe lib/images/anchore/Dockerfile

Command words grype, syft: import command { "grype", "syft" } from "tools"

lask eval grype.env --cache_dir /tmp/cache

lib/grype.lask

syft.env

Syft, Anchore's SBOM generator, in the image of grype. It checks for no update (SYFT_CHECK_FOR_APP_UPDATE=false).

syft.env(
  --base_access: String | Map<String> | Null = null,
  --with: Array<Record<env: Map<String>, volumes: Array<String>>> = [],
  --extra_env: Map<String> = {}
): Runnable

Parameters

• --base_access What the container may do with the project directory: "rw" (the default), "ro", "none", or a table of paths such as {".": "ro", "dist": "rw"} (lask spec 10.2).
• --with Setups of other tools this environment should also carry: registry_setup, docker_setup.
• --extra_env Any other variable; below --with.

Returns Runnable: The environment, for command { "syft" } on ... or $[...].

Image recipe lib/images/anchore/Dockerfile

Command words grype, syft: import command { "grype", "syft" } from "tools"

lask eval syft.env

lib/syft.lask

semgrep.env

Semgrep, semgrep/semgrep:1.178.0 by default. It sends no metrics and checks for no update (SEMGREP_SEND_METRICS=off, SEMGREP_ENABLE_VERSION_CHECK=0). The mounted project is trusted by Git (safe.directory), since Semgrep lists the files to scan through it.

semgrep.env(
  --image: Environment = #semgrep/semgrep:1.178.0,
  --app_token: String | Null = <secret>,
  --base_access: String | Map<String> | Null = null,
  --with: Array<Record<env: Map<String>, volumes: Array<String>>> = [],
  --extra_env: Map<String> = {}
): Runnable

Parameters

• --image The image to run; another release is passed as image = #semgrep/semgrep:<tag>.
• --app_token!! SEMGREP_APP_TOKEN, for Semgrep AppSec Platform; masked in the command log.
• --base_access What the container may do with the project directory: "rw" (the default), "ro", "none", or a table of paths such as {".": "ro", "dist": "rw"} (lask spec 10.2).
• --with Setups of other tools this environment should also carry.
• --extra_env Any other variable; below --with and the named parameters.

Returns Runnable: The environment, for command { "semgrep" } on ... or $[...].

Image semgrep/semgrep:1.178.0

Command words semgrep: import command { "semgrep" } from "tools"

lask eval semgrep.env

lib/semgrep.lask