trivy_fs.yaml

---
name: trivy-fs
on:
  push:
    branches:
    - main
  pull_request:
    branches:
    - main
  schedule:
  - cron: "50 22 * * *"
concurrency:
  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
  cancel-in-progress: true
permissions:
  contents: read
jobs:
  code-scan:
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
    - uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0  # v0.29.0
      with:
        scan-type: 'fs'
        ignore-unfixed: true
        format: 'sarif'
        output: 'trivy-results.sarif'
    - run: |
        jq '.runs[].tool.driver.name = "trivy-fs"' < trivy-results.sarif > tmp
        mv tmp trivy-results.sarif
    - uses: github/codeql-action/upload-sarif@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0  # v3.28.9
      with:
        sarif_file: 'trivy-results.sarif'
        category: trivy-fs