Skip to content

Commit

Permalink
Merge pull request #20 from m-mizutani/fix/trivy-action
Browse files Browse the repository at this point in the history
fix(action): trivy failure
  • Loading branch information
m-mizutani authored Nov 12, 2024
2 parents 52aa50f + c285e95 commit 0077b46
Showing 1 changed file with 20 additions and 8 deletions.
28 changes: 20 additions & 8 deletions .github/workflows/trivy.yml
Original file line number Diff line number Diff line change
@@ -1,26 +1,38 @@
name: Vulnerability scan
name: trivy

on: [push]
on:
push:
schedule:
- cron: "0 0 * * *"
workflow_dispatch:

jobs:
scan:
runs-on: ubuntu-latest
permissions:
security-events: write
actions: read
contents: read

steps:
- name: Checkout upstream repo
uses: actions/checkout@v3
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
with:
ref: ${{ github.head_ref }}
- name: Run Trivy vulnerability scanner in repo mode
uses: aquasecurity/trivy-action@master
- id: scan
name: Run Trivy vulnerability scanner in repo mode
uses: aquasecurity/trivy-action@f3d98514b056d8c71a3552e8328c225bc7f6f353 # master
with:
scan-type: "fs"
ignore-unfixed: true
format: "template"
template: "@/contrib/sarif.tpl"
format: "sarif"
output: "trivy-results.sarif"
exit-code: 1
env:
TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db

- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v1
if: failure() && steps.scan.outcome == 'failure'
uses: github/codeql-action/upload-sarif@e8893c57a1f3a2b659b6b55564fdfdbbd2982911 # v3.24.0
with:
sarif_file: "trivy-results.sarif"

0 comments on commit 0077b46

Please sign in to comment.