recurrent-trivy.yaml

name: Recurrent Trivy scan

on:
  schedule:
  - cron: '42 3 * * *'  # Run at 3:42 UTC every day
  workflow_dispatch:

jobs:
  trivy:
    name: recurrent trivy scan
    runs-on: ubuntu-latest

    steps:
    - name: Get latest release
      id: get_latest_release
      run: |
        latest_release=$(curl --silent "https://api.github.com/repos/${{ github.repository }}/releases/latest" | jq -r '.tag_name')
        echo "Latest release tag: $latest_release"
        echo "latest_release=$latest_release" >> $GITHUB_OUTPUT

    - name: Checkout latest release
      uses: actions/checkout@v4
      with:
        ref: ${{ steps.get_latest_release.outputs.latest_release }}

    - name: Run Trivy vulnerability scanner with rootfs command
      uses: aquasecurity/trivy-action@master
      env:
        TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db
        TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db
      with:
        scan-type: 'rootfs'
        scan-ref: '.'
        ignore-unfixed: true
        format: 'sarif'
        output: 'trivy-results.sarif'
        severity: 'CRITICAL'

    - name: Upload Trivy scan results to GitHub Security tab
      uses: github/codeql-action/upload-sarif@v3
      with:
        sarif_file: 'trivy-results.sarif'