Skip to content

Scan image

Scan image #60

Workflow file for this run

name: Scan image
on:
push:
branches: ["main"]
pull_request:
branches: ["main"]
schedule:
- cron: "32 12 * * 2" # every tuesday at 12:32 UTC time
env:
REGISTRY: ghcr.io
IMAGE_TAG: latest # scan just latest image
jobs:
trivy:
name: Run Trivy vulnerability scanner
permissions:
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
runs-on: ubuntu-latest
steps:
- name: Login to GitHub Container Registry
uses: docker/login-action@v2
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Extract Docker metadata
id: metadata
uses: docker/metadata-action@v4
with:
images: ${{ env.REGISTRY }}/${{ github.repository }}
tags: ${{ env.IMAGE_TAG }}
- name: Pull the image
run: |
docker pull ${{ steps.metadata.outputs.tags }}
- name: Run Trivy vulnerability scanner for any major issues
uses: aquasecurity/trivy-action@master
with:
image-ref: ${{ steps.metadata.outputs.tags }}
ignore-unfixed: true
severity: "CRITICAL,HIGH"
limit-severities-for-sarif: true
format: sarif
output: trivy-results.sarif
timeout: 20m # trivy default timeout is 5m, we need longer for our image
# Show all detected issues.
- name: Run Trivy vulnerability scanner for local output
uses: aquasecurity/trivy-action@master
with:
image-ref: ${{ steps.metadata.outputs.tags }}
format: table
timeout: 20m # trivy default timeout is 5m, we need longer for our image
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v2
with:
sarif_file: trivy-results.sarif
category: ${{ steps.metadata.outputs.tags }} image
wait-for-processing: true
- name: Detain results for debug if needed
uses: actions/upload-artifact@v3
with:
name: trivy-results.sarif
path: trivy-results.sarif
if-no-files-found: error