PI-2613 Add ECR repository for Trivy scanning

with fallback to GHCR, should help mitigate rate-limiting issues
ministryofjustice · Oct 31, 2024 · ca3171a · ca3171a
1 parent 691f051
commit ca3171a
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
@@ -48,6 +48,9 @@ jobs:
           output: 'trivy-results.sarif'
           trivyignores: '.trivyignore,projects/${{ matrix.project }}/.trivyignore'
           limit-severities-for-sarif: true
+        env:
+          TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2,ghcr.io/aquasecurity/trivy-db:2
+          TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db:1,ghcr.io/aquasecurity/trivy-java-db:1
 
       - name: Upload Trivy scan results to GitHub Security tab
         uses: github/codeql-action/upload-sarif@v3
@@ -64,6 +67,9 @@ jobs:
           format: 'json'
           output: 'trivy.json'
           trivyignores: '.trivyignore,projects/${{ matrix.project }}/.trivyignore'
+        env:
+          TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2,ghcr.io/aquasecurity/trivy-db:2
+          TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db:1,ghcr.io/aquasecurity/trivy-java-db:1
 
       - name: Output results
         run: |