trivy-web.yml

name: Run Trivy scan to web
on:
  pull_request:
    branches:
      - main
    paths:
      - web/**
  push:
    branches:
      - main
    paths:
      - web/**
  schedule:
    - cron: "40 19 * * *"
  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:
jobs:
  build:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node-version: [20.x]
    defaults:
      run:
        working-directory: ./web
    steps:
      - uses: actions/checkout@v4
      - name: Use Node.js ${{ matrix.node-version }}
        uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache: "npm"
          cache-dependency-path: ./web/package-lock.json
      - run: npm ci --omit=dev
      - name: Run Trivy vulnerability scanner in fs mode
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: "fs"
          scan-ref: "./web"
          trivy-config: trivy.yaml
        env:
          TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db
          TRIVY_JAVA_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-java-db,public.ecr.aws/aquasecurity/trivy-java-db