trivy-containers.yaml

name: Trivy Scanner - Container Images
on:
  push:
    branches:
      - master
  schedule:
    - cron: '0 */24 * * *'

jobs:
  build-matrix:
    runs-on: ubuntu-latest
    outputs:
      images: ${{ steps.set-matrix.outputs.result }}
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v3

      - id: set-matrix
        uses: mikefarah/yq@master
        with:
          # Dynamically build the matrix of images to scan
          cmd: "yq '[{\"repository\": .image.repository, \"tag\": \"v'$(yq '.appVersion' charts/aws-ebs-csi-driver/Chart.yaml)'\"}] + (.sidecars | map(.image)) | map(.repository + \":\" + .tag) | . style=\"flow\"' charts/aws-ebs-csi-driver/values.yaml"
  
  trivy-scan:
    needs: build-matrix
    runs-on: ubuntu-latest
    strategy:
      matrix:
        image: ${{ fromJson(needs.build-matrix.outputs.images) }}
    
    steps:
      - name: Scan container image
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: '${{ matrix.image }}'
          output: 'results.sarif'
          format: 'sarif'
          ignore-unfixed: true
          severity: 'HIGH,CRITICAL'
      
      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: 'results.sarif'