From 15ee0b11cce3b7428311afb5d538f4468b82edae Mon Sep 17 00:00:00 2001
From: Daniela Plascencia <daniela.plascencia@canonical.com>
Date: Wed, 16 Oct 2024 11:08:50 +0200
Subject: [PATCH] ci: enable scheduled trivy scanner and report vulnerabilities
 as GH issues

This workflow enables a scheduled scanner (that can also be run from a workflow dispatch) to
scan images using the trivy scanner. At the same time, enables the automatic creation/edition
of Github issues when a vulnerability is found.

Fixes #96
---
 .github/workflows/scan_images.yaml | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)
 create mode 100644 .github/workflows/scan_images.yaml

diff --git a/.github/workflows/scan_images.yaml b/.github/workflows/scan_images.yaml
new file mode 100644
index 0000000..cb2db86
--- /dev/null
+++ b/.github/workflows/scan_images.yaml
@@ -0,0 +1,21 @@
+name: Scan images
+
+on:  
+  schedule:
+    - cron: '00 23 * * *'
+  workflow_dispatch:
+
+jobs:
+
+  scan-images:
+    name: Scan published images and report vulnerabilities
+    uses: canonical/charmed-kubeflow-workflows/.github/workflows/get-published-images-scan-and-report.yaml@main
+    strategy:
+      matrix:
+        branch: [main, track/0.11]
+    secrets:
+      GH_TOKEN: ${{ secrets.GH_TOKEN }}
+    with:
+      report-vulnerabilities: true
+      severity: "HIGH,CRITICAL"
+      branch: ${{ matrix.branch }}