mirror of
https://github.com/fleetdm/fleet
synced 2026-05-22 08:28:52 +00:00
58 lines
1.7 KiB
YAML
58 lines
1.7 KiB
YAML
name: Trivy vulnerability scan
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
paths:
|
|
- "**.tf"
|
|
pull_request:
|
|
paths:
|
|
- "**.tf"
|
|
workflow_dispatch:
|
|
schedule:
|
|
- cron: "0 4 * * *" # Nightly 4AM UTC
|
|
|
|
# This allows a subsequently queued workflow run to interrupt previous runs
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.head_ref || github.run_id}}
|
|
cancel-in-progress: true
|
|
|
|
defaults:
|
|
run:
|
|
# fail-fast using bash -eo pipefail. See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
|
|
shell: bash
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
trivy:
|
|
permissions:
|
|
contents: read # for actions/checkout to fetch code
|
|
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
|
|
name: Trivy sarif report
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- name: Checkout code
|
|
uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
|
|
|
|
- name: Run Trivy vulnerability scanner in repo mode
|
|
uses: aquasecurity/trivy-action@062f2592684a31eb3aa050cc61e7ca1451cecd3d # 0.18.0
|
|
with:
|
|
scan-type: "fs"
|
|
ignore-unfixed: false
|
|
format: "sarif"
|
|
output: "trivy-results.sarif"
|
|
severity: "CRITICAL,HIGH,MEDIUM,LOW"
|
|
trivyignores: ".trivyignore"
|
|
|
|
- name: Upload Trivy scan results to GitHub Security tab
|
|
uses: github/codeql-action/upload-sarif@8a470fddafa5cbb6266ee11b37ef4d8aae19c571 # v3.24.6
|
|
with:
|
|
sarif_file: "trivy-results.sarif"
|