-
Notifications
You must be signed in to change notification settings - Fork 0
48 lines (40 loc) · 1.3 KB
/
scan-rock.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
name: Scan
on:
workflow_call:
jobs:
scan:
runs-on: ubuntu-22.04
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Install rockcraft
run: |
sudo snap install rockcraft --classic --channel edge
- name: Install yq
run: |
sudo snap install yq
- uses: actions/download-artifact@v4
with:
name: rock
- name: Import
run: |
image_name="$(yq '.name' rockcraft.yaml)"
echo "image_name=${image_name}" >> $GITHUB_ENV
version="$(yq '.version' rockcraft.yaml)"
echo "version=${version}" >> $GITHUB_ENV
rock_file=$(ls *.rock | tail -n 1)
sudo rockcraft.skopeo \
--insecure-policy \
copy \
oci-archive:"${rock_file}" \
docker-daemon:"ghcr.io/canonical/${image_name}:${version}"
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@master
with:
image-ref: "ghcr.io/canonical/${{env.image_name}}:${{env.version}}"
format: "sarif"
output: "trivy-results.sarif"
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: "trivy-results.sarif"