From 0f648ac66139a18ee80119ed08d5a9093ab1bc69 Mon Sep 17 00:00:00 2001 From: Daniela Plascencia Date: Fri, 18 Oct 2024 10:54:31 -0600 Subject: [PATCH] ci: enable scheduled trivy scanner and report vulnerabilities as GH issues (#8) * ci: enable scheduled trivy scanner and report vulnerabilities as GH issues This workflow enables a scheduled scanner (that can also be run from a workflow dispatch) to scan images using the trivy scanner. At the same time, enables the automatic creation/edition of Github issues when a vulnerability is found. Fixes #7 --- .github/workflows/scan_images.yaml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 .github/workflows/scan_images.yaml diff --git a/.github/workflows/scan_images.yaml b/.github/workflows/scan_images.yaml new file mode 100644 index 0000000..d086bdf --- /dev/null +++ b/.github/workflows/scan_images.yaml @@ -0,0 +1,20 @@ +name: Scan images + +on: + schedule: + - cron: '00 23 * * *' + workflow_dispatch: + +jobs: + + scan-images: + name: Scan published images and report vulnerabilities + uses: canonical/charmed-kubeflow-workflows/.github/workflows/get-published-images-scan-and-report.yaml@main + strategy: + matrix: + branch: [track/2.27] + secrets: + GH_TOKEN: ${{ secrets.GH_TOKEN }} + with: + severity: "HIGH,CRITICAL" + branch: ${{ matrix.branch }}