mirror of
https://github.com/aljazceru/ark.git
synced 2026-02-07 12:34:46 +01:00
39 lines
1.1 KiB
YAML
39 lines
1.1 KiB
YAML
name: Trivy Security Scan
|
|
|
|
on:
|
|
push:
|
|
branches: ["master"]
|
|
pull_request:
|
|
branches: ["master"]
|
|
|
|
jobs:
|
|
build:
|
|
name: Build and Scan
|
|
runs-on: ubuntu-20.04
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v2
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@v1
|
|
|
|
- name: Build an image from Dockerfile
|
|
uses: docker/build-push-action@v2
|
|
with:
|
|
context: .
|
|
load: true
|
|
tags: ${{ github.repository }}:${{ github.sha }}
|
|
|
|
- name: Run Trivy vulnerability scanner
|
|
uses: aquasecurity/trivy-action@0.28.0
|
|
env:
|
|
# avoid GHCR rate limits, see https://github.com/aquasecurity/trivy-db/pull/440 and https://github.com/aquasecurity/trivy-action/issues/389
|
|
TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
|
|
with:
|
|
image-ref: "${{ github.repository }}:${{ github.sha }}"
|
|
format: "table"
|
|
exit-code: "1"
|
|
ignore-unfixed: true
|
|
vuln-type: "os,library"
|
|
severity: "CRITICAL,HIGH"
|