trivy #1564
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: trivy | |
| on: | |
| schedule: | |
| - cron: "40 11 * * 0" | |
| workflow_dispatch: | |
| workflow_run: | |
| workflows: | |
| - Release Retina Container Images | |
| types: | |
| - completed | |
| permissions: | |
| contents: read | |
| jobs: | |
| scan: | |
| if: ${{ github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success' }} | |
| permissions: | |
| contents: read | |
| security-events: write | |
| name: Trivy Scan | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| image: ["retina-agent", "retina-init", "retina-operator", "kubectl-retina", "retina-shell"] | |
| runs-on: ubuntu-latest # trivy only supports running on Linux | |
| timeout-minutes: 30 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Get Tag | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| if [ "${{ github.event_name }}" = "schedule" ] || [ "${{ github.event_name }}" = "workflow_dispatch" ]; then | |
| TAG=$(gh release view --repo ${{ github.repository }} --json tagName -q .tagName 2>/dev/null || make version) | |
| else | |
| TAG=$(make version) | |
| fi | |
| echo "TAG=$TAG" >> $GITHUB_ENV | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # 0.36.0 | |
| with: | |
| image-ref: "ghcr.io/${{ github.repository }}/${{ matrix.image }}:${{ env.TAG }}" | |
| format: "template" | |
| template: "@/contrib/sarif.tpl" | |
| output: "trivy-results.sarif" | |
| severity: "CRITICAL,HIGH" | |
| - name: Upload Trivy scan results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 | |
| with: | |
| sarif_file: "trivy-results.sarif" | |
| # Scheduled/manual runs scan the latest release image; workflow_run | |
| # runs scan the per-commit image just pushed by release-images. | |
| # Separate SARIF categories keep the two artifacts' alerts from | |
| # closing and reopening each other on every upload. | |
| category: "image:${{ matrix.image }}/${{ github.event_name == 'workflow_run' && 'main' || 'release' }}" |