Cache TrivyDB for 24hrs #47

	name: Run Docker tests

	on:
	pull_request:
	push:
	branches: main

	jobs:
	scan:
	runs-on: ubuntu-latest
	outputs:
	image: ${{ steps.build.outputs.imageid }}
	steps:
	- name: Checkout code
	uses: actions/checkout@v4
	with:
	fetch-depth: 0

	- name: Set up Docker Buildx
	uses: docker/setup-buildx-action@v3

	- name: Build docker image
	uses: docker/build-push-action@v6
	id: build
	with:
	secrets: github_token=${{ secrets.GITHUB_TOKEN }}
	load: true
	cache-from: type=gha
	push: false

	- name: Get TrivyDB data ## To avoid the trivy-db becoming outdated, we save the cache for one day
	id: date
	run: echo "date=$(date +%Y-%m-%d)" >> $GITHUB_OUTPUT

	- name: Restore TrivyDB cache
	uses: actions/cache@v4
	with:
	path: cache/db
	key: trivy-cache-${{ steps.date.outputs.date }}
	restore-keys:
	trivy-cache-

	- name: Export docker image as tar
	run: docker save -o ${{ github.ref_name }}.tar ${{ steps.build.outputs.imageid }}

	- name: Scan Docker image for CVEs
	uses: aquasecurity/[email protected]
	with:
	input: ${{ github.ref_name }}.tar
	format: 'sarif'
	output: 'trivy-results.sarif'
	limit-severities-for-sarif: true
	ignore-unfixed: true
	severity: 'CRITICAL,HIGH'
	github-pat: ${{ secrets.GITHUB_TOKEN }}
	cache-dir: "./cache"

	- name: Change permissions for trivy.db
	run: sudo chmod 0644 ./cache/db/trivy.db

	- name: Upload scan results to GitHub Security
	uses: github/codeql-action/upload-sarif@v2
	with:
	sarif_file: 'trivy-results.sarif'

Provide feedback