From c1fbf0e217b4f95995803f1da3b0d024cace90cc Mon Sep 17 00:00:00 2001
From: Daniela Plascencia <daniela.plascencia@canonical.com>
Date: Tue, 15 Oct 2024 11:35:45 +0200
Subject: [PATCH 1/2] ci: enable scheduled trivy scanner and report
 vulnerabilities as GH issues

This workflow enables a scheduled scanner (that can also be run from a workflow dispatch) to
scan images using the trivy scanner. At the same time, enables the automatic creation/edition
of Github issues when a vulnerability is found.

Fixes #139
---
 .github/workflows/scan_images.yaml | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)
 create mode 100644 .github/workflows/scan_images.yaml

diff --git a/.github/workflows/scan_images.yaml b/.github/workflows/scan_images.yaml
new file mode 100644
index 0000000..545d635
--- /dev/null
+++ b/.github/workflows/scan_images.yaml
@@ -0,0 +1,21 @@
+name: Scan images
+
+on:  
+  schedule:
+    - cron: '00 23 * * *'
+  workflow_dispatch:
+
+jobs:
+
+  on-push:
+    name: Get rocks modified and build-scan-test-publish them
+    uses: canonical/charmed-kubeflow-workflows/.github/workflows/get-published-images-scan-and-report.yaml@main
+    strategy:
+      matrix:
+        branch: [main, track/1.8]
+    secrets:
+      GH_TOKEN: ${{ secrets.GH_TOKEN }}
+    with:
+      report-vulnerabilities: true
+      severity: "HIGH,CRITICAL"
+      branch: ${{ matrix.branch }}

From 3224863d1b5ffc5ed865f0f9c30f8d11184045df Mon Sep 17 00:00:00 2001
From: Daniela Plascencia <daniela.plascencia@canonical.com>
Date: Wed, 16 Oct 2024 09:59:38 +0200
Subject: [PATCH 2/2] skip: fix name of job

---
 .github/workflows/scan_images.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/scan_images.yaml b/.github/workflows/scan_images.yaml
index 545d635..22fff6e 100644
--- a/.github/workflows/scan_images.yaml
+++ b/.github/workflows/scan_images.yaml
@@ -7,8 +7,8 @@ on:
 
 jobs:
 
-  on-push:
-    name: Get rocks modified and build-scan-test-publish them
+  scan-images:
+    name: Scan published images and report vulnerabilities
     uses: canonical/charmed-kubeflow-workflows/.github/workflows/get-published-images-scan-and-report.yaml@main
     strategy:
       matrix: