trivy.yaml

# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.

name: trivy
permissions: {}

on:
  workflow_dispatch:
    inputs:
      run:
        description: "Run the workflow"
        required: true
        default: true
        type: boolean
  push:
    branches:
      - main
  pull_request:
  schedule:
    # every Monday at 7:31pm
    - cron: "31 19 * * 1"

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  scan:
    name: Build
    runs-on: "ubuntu-latest"
    permissions:
      security-events: write # Needed to upload the analysis results

    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false

      - name: Trivy Vulnerability Scan
        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0
        with:
          scan-type: "fs"
          severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"
          scan-ref: "."
          scanners: "vuln"
          format: "sarif"
          output: "trivy-results.sarif"
          exit-code: 1

      - name: Trivy License Scan
        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # 0.35.0
        with:
          scan-type: "fs"
          severity: "HIGH,CRITICAL"
          scan-ref: "."
          scanners: "license"
          exit-code: 1

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@0d579ffd059c29b07949a3cce3983f0780820c98 # v4.32.6
        with:
          sarif_file: "trivy-results.sarif"