From 359a137d2e10124c26a697f258a60d02194b27c3 Mon Sep 17 00:00:00 2001 From: strawberry Date: Wed, 14 Feb 2024 20:00:29 -0500 Subject: [PATCH] add trivy for code and vulnerability scanning Signed-off-by: strawberry --- .github/workflows/trivy.yml | 40 +++++++++++++++++++++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100644 .github/workflows/trivy.yml diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml new file mode 100644 index 00000000..5d6d0a27 --- /dev/null +++ b/.github/workflows/trivy.yml @@ -0,0 +1,40 @@ +name: Trivy code and vulnerability scanning + +on: + pull_request: + push: + branches: + - main + schedule: + - cron: '00 12 * * *' + +permissions: + contents: read + +jobs: + trivy-scan: + name: Trivy Scan + runs-on: ubuntu-latest + permissions: + contents: read + security-events: write + actions: read + steps: + - name: Checkout code + uses: actions/checkout@v4 + + - name: Run Trivy code and vulnerability scanner on repo + uses: aquasecurity/trivy-action@0.17.0 + with: + scan-type: repo + format: sarif + output: trivy-results.sarif + severity: CRITICAL,HIGH,MEDIUM,LOW + + - name: Run Trivy code and vulnerability scanner on filesystem + uses: aquasecurity/trivy-action@0.17.0 + with: + scan-type: fs + format: sarif + output: trivy-results.sarif + severity: CRITICAL,HIGH,MEDIUM,LOW \ No newline at end of file