trivy

Update open file handles in RenameFile #1549

	# This workflow uses actions that are not certified by GitHub.
	# They are provided by a third-party and are governed by
	# separate terms of service, privacy policy, and support
	# documentation.

	name: trivy

	on:
	push:
	branches:
	- main
	pull_request:
	schedule:
	# every Monday at 7:31pm
	- cron: "31 19 * * 1"

	permissions: {}

	jobs:
	scan:
	name: Build
	runs-on: "ubuntu-latest"
	permissions:
	security-events: write

	steps:
	- name: Checkout code
	uses: actions/checkout@v4
	with:
	persist-credentials: false

	- name: Trivy Vulnerability Scan
	uses: aquasecurity/[email protected]
	with:
	scan-type: "fs"
	severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"
	scan-ref: "."
	scanners: "vuln"
	format: "sarif"
	output: "trivy-results.sarif"
	exit-code: 1

	- name: Trivy License Scan
	uses: aquasecurity/[email protected]
	with:
	scan-type: "fs"
	severity: "HIGH,CRITICAL"
	scan-ref: "."
	scanners: "license"
	exit-code: 1

	- name: Upload Trivy scan results to GitHub Security tab
	uses: github/codeql-action/upload-sarif@v3
	with:
	sarif_file: "trivy-results.sarif"

Provide feedback