trivy.yaml

# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.

name: trivy

on:
  push:
    branches:
      - main
  pull_request:
  schedule:
    # every Monday at 7:31pm
    - cron: "31 19 * * 1"

permissions: {}

jobs:
  scan:
    name: Build
    runs-on: "ubuntu-latest"
    permissions:
      security-events: write

    steps:
      - name: Checkout code
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Trivy Vulnerability Scan
        uses: aquasecurity/trivy-action@0.29.0
        with:
          scan-type: "fs"
          severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"
          scan-ref: "."
          scanners: "vuln"
          format: "sarif"
          output: "trivy-results.sarif"
          exit-code: 1

      - name: Trivy License Scan
        uses: aquasecurity/trivy-action@0.29.0
        with:
          scan-type: "fs"
          severity: "HIGH,CRITICAL"
          scan-ref: "."
          scanners: "license"
          exit-code: 1

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: "trivy-results.sarif"