trivy.yml

name: Trivy

on:
  push:
    branches: ["main", "future"]
  pull_request:
    branches: ["main", "future"]
  schedule:
    - cron: "19 7 * * 0"

jobs:
  base:
    name: Analyze
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@main

      - name: Build an image from Dockerfile
        run: |
          docker build -t spacelift:${{ github.sha }} base

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@0.27.0
        with:
          image-ref: "spacelift:${{ github.sha }}"
          format: "template"
          template: "@/contrib/sarif.tpl"
          output: "trivy-results.sarif"
          severity: "CRITICAL,HIGH"
        env:
          TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: "trivy-results.sarif"

  aws:
    name: Analyze
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@main

      - name: Build an image from Dockerfile
        run: |
          docker build --build-arg REPOSITORY_BASE_PATH=${{ secrets.PUBLIC_RUNNER_ANSIBLE_ECR_REPOSITORY_URL }} -t spacelift:${{ github.sha }} aws

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@0.27.0
        with:
          image-ref: "spacelift:${{ github.sha }}"
          format: "template"
          template: "@/contrib/sarif.tpl"
          output: "trivy-results.sarif"
          severity: "CRITICAL,HIGH"
        env:
          TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: "trivy-results.sarif"