diff --git a/.github/workflows/trivy-scan.yaml b/.github/workflows/trivy-scan.yaml new file mode 100644 index 000000000..59d9225f6 --- /dev/null +++ b/.github/workflows/trivy-scan.yaml @@ -0,0 +1,46 @@ +name: Trivy + +on: + pull_request: + branches: + - master + push: + branches: + - master + schedule: + - cron: '25 16 * * 2' + +jobs: + scan: + permissions: + # contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + runs-on: ubuntu-latest + + #if: ${{ github.repository == 'CrunchyData/postgres-operator' }} + + steps: + - uses: actions/checkout@v3 + + - name: Log all detected vulnerabilities + uses: aquasecurity/trivy-action@master + with: + scan-type: fs + hide-progress: true + # exit-code: 1 + + # Upload actionable results to the GitHub Security tab. + # Pull request checks fail according to repository settings. + # + # - https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/uploading-a-sarif-file-to-github + # - https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning + - name: Report actionable vulnerabilities + uses: aquasecurity/trivy-action@master + with: + scan-type: fs + ignore-unfixed: true + format: 'sarif' + output: 'trivy-results.sarif' + - uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: 'trivy-results.sarif'