Merge pull request #4355 from bcgov/chore-move-trivy-container-scanning-to-nightly-build-only

Move trivy container scanning to nightly build

Author: Sepehr-Sobhani

.github/workflows/main.yaml

@@ -132,15 +132,6 @@ jobs:
       nx_project: compliance
     secrets: inherit
   trivy:
-    needs:
-      [
-        build-backend,
-        build-administration,
-        build-compliance,
-        build-dashboard,
-        build-registration,
-        build-reporting,
-      ]
     uses: ./.github/workflows/trivy.yaml
   codeql:
     uses: ./.github/workflows/codeql.yaml

.github/workflows/nightly.yaml

@@ -127,6 +127,8 @@ jobs:
     uses: ./.github/workflows/schemaspy.yaml
     secrets: inherit
   trivy:
+    uses: ./.github/workflows/trivy.yaml
+  trivy-containers:
     needs:
       [
         build-backend,
@@ -136,7 +138,7 @@ jobs:
         build-registration,
         build-reporting,
       ]
-    uses: ./.github/workflows/trivy.yaml
+    uses: ./.github/workflows/trivy-containers.yaml
   codeql:
     uses: ./.github/workflows/codeql.yaml
   notify:
@@ -154,6 +156,7 @@ jobs:
         zap-owasp,
         schemaspy,
         trivy,
+        trivy-containers,
         codeql,
       ]
     env:
@@ -169,6 +172,7 @@ jobs:
         && needs.zap-owasp.result == 'success'
         && needs.schemaspy.result == 'success'
         && needs.trivy.result == 'success'
+        && needs.trivy-containers.result == 'success'
         && needs.codeql.result == 'success'
         && 'success'
         || 'failure'

.github/workflows/trivy-containers.yaml

@@ -0,0 +1,55 @@
+name: Trivy Container Scan
+
+on:
+  workflow_call:
+
+jobs:
+  scan-containers:
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - image: cas-reg-backend
+            category: trivy-container-backend
+          - image: cas-reg-frontend
+            category: trivy-container-registration
+          - image: cas-admin-frontend
+            category: trivy-container-administration
+          - image: cas-compliance-frontend
+            category: trivy-container-compliance
+          - image: cas-dash-frontend
+            category: trivy-container-dashboard
+          - image: cas-rep-frontend
+            category: trivy-container-reporting
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+      - name: Cache Scan Dependencies
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/trivy
+          key: callee-trivy-${{ github.workflow }}-${{ github.run_id }}
+          restore-keys: callee-trivy-${{ github.workflow }}-
+      - name: Run Trivy vulnerability scanner on container image
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
+        with:
+          scan-type: image
+          image-ref: ghcr.io/bcgov/${{ matrix.image }}:${{ github.sha }}
+          format: sarif
+          output: trivy-container-results.sarif
+          exit-code: "0"
+          ignore-unfixed: false
+          severity: CRITICAL,HIGH,MEDIUM
+          timeout: 10m0s
+      - name: Upload Trivy container scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: trivy-container-results.sarif
+          category: ${{ matrix.category }}
+      - name: Upload Trivy container scan results as artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: trivy-container-results-${{ matrix.image }}
+          path: trivy-container-results.sarif

.github/workflows/trivy.yaml

@@ -38,53 +38,3 @@ jobs:
         with:
           name: trivy-results
           path: trivy-results.sarif
-
-  scan-containers:
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - image: cas-reg-backend
-            category: trivy-container-backend
-          - image: cas-reg-frontend
-            category: trivy-container-registration
-          - image: cas-admin-frontend
-            category: trivy-container-administration
-          - image: cas-compliance-frontend
-            category: trivy-container-compliance
-          - image: cas-dash-frontend
-            category: trivy-container-dashboard
-          - image: cas-rep-frontend
-            category: trivy-container-reporting
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v6
-      - name: Cache Scan Dependencies
-        uses: actions/cache@v4
-        with:
-          path: ~/.cache/trivy
-          key: callee-trivy-${{ github.workflow }}-${{ github.run_id }}
-          restore-keys: callee-trivy-${{ github.workflow }}-
-      - name: Run Trivy vulnerability scanner on container image
-        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
-        with:
-          scan-type: image
-          image-ref: ghcr.io/bcgov/${{ matrix.image }}:${{ github.sha }}
-          format: sarif
-          output: trivy-container-results.sarif
-          exit-code: "0"
-          ignore-unfixed: false
-          severity: CRITICAL,HIGH,MEDIUM
-          timeout: 10m0s
-      - name: Upload Trivy container scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v4
-        with:
-          sarif_file: trivy-container-results.sarif
-          category: ${{ matrix.category }}
-      - name: Upload Trivy container scan results as artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: trivy-container-results-${{ matrix.image }}
-          path: trivy-container-results.sarif