[AN-181] Give default compute SA the secretAccessor role #653

	name: dsp-appsec-trivy
	on:
	pull_request:
	# Branch settings require status checks before merging, so don't add paths-ignore.
	branches: [ master ]

	jobs:
	appsec-trivy:
	# Parse Dockerfile and build, scan image if a "blessed" base image is not used
	name: DSP AppSec Trivy check
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v3

	# fetch JDK
	- uses: actions/setup-java@v4
	with:
	distribution: 'temurin'
	java-version: '17'

	- name: Setup Gradle
	uses: gradle/actions/setup-gradle@v3
	# build the image
	- name: Build
	id: build
	run: \|
	# build sources and store the plain log without colors
	./gradlew jibDockerBuild --console=plain \
	\| perl -pe 's/\x1b\[[0-9;]*[mG]//g' \| tee build.log
	# capture exit code of jib build; because it is piped through perl and tee,
	# any build failures would be otherwise hidden
	jib_code=${PIPESTATUS[0]}
	# export image name from the log
	image=$(grep 'Built image' build.log \| awk '{print $NF}')
	echo image="${image}" >> $GITHUB_OUTPUT
	# fail this step if the jib build failed
	exit $jib_code
	# scan the image
	- uses: broadinstitute/dsp-appsec-trivy-action@v1
	with:
	image: ${{ steps.build.outputs.image }}

Provide feedback