move trivy scans

.github/workflows/build-containers.yaml

@@ -53,24 +53,3 @@ jobs:
           tags: ${{ steps.meta1.outputs.tags }}
           labels: ${{ steps.meta1.outputs.labels }}
           file: Dockerfile
-
-      # if push to master of release, run trivy scan on the image
-      - name: Trivy scan
-        if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}
-        uses: aquasecurity/[email protected]
-        env:
-          TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db,aquasec/trivy-db,ghcr.io/aquasecurity/trivy-db
-          TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db,aquasec/trivy-java-db,ghcr.io/aquasecurity/trivy-java-db
-        with:
-          image-ref: ghcr.io/${{ github.repository }}/fedn:master
-          format: 'sarif'
-          output: 'trivy-results.sarif'
-          severity: HIGH,CRITICAL
-          vuln-type: 'os,library'
-          github-pat: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v3
-        if: ${{ github.event_name == 'push' && github.ref == 'refs/heads/master' }}
-        with:
-          sarif_file: 'trivy-results.sarif'

.github/workflows/trivy-scanning.yaml

@@ -0,0 +1,41 @@
+name: Trivy scan
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - master
+  schedule:
+    - cron: '0 0 * * 1'
+
+jobs:
+  trivy_scan:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+
+    - name: Build an image from Dockerfile
+      run: |
+        docker build -t ghcr.io/scaleoutsystems/fedn:${{ github.sha }} .
+
+    - name: Run Trivy vulnerability scanner in docker mode
+      uses: aquasecurity/[email protected]
+      env:
+         TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db,aquasec/trivy-db,ghcr.io/aquasecurity/trivy-db
+         TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db,aquasec/trivy-java-db,ghcr.io/aquasecurity/trivy-java-db
+      with:
+        image-ref: 'ghcr.io/scaleoutsystems/fedn:${{ github.sha }}'
+        format: 'sarif'
+        output: 'trivy-results.sarif'
+        severity: HIGH,CRITICAL
+        vuln-type: 'os,library'
+        github-pat: ${{ secrets.GITHUB_TOKEN }}
+
+    - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: 'trivy-results.sarif'