scan-images.yml

name: Scan image

on:
  push:
    branches: ["main"]
  pull_request:
    branches: ["main"]
  schedule:
    - cron: "32 12 * * 2" # every tuesday at 12:32 UTC time

env:
  REGISTRY: ghcr.io
  IMAGE_TAG: latest # scan just latest image

jobs:
  trivy:
    name: Run Trivy vulnerability scanner
    permissions:
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
    runs-on: ubuntu-latest

    steps:
      - name: Login to GitHub Container Registry
        uses: docker/login-action@v2
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Extract Docker metadata
        id: metadata
        uses: docker/metadata-action@v4
        with:
          images: ${{ env.REGISTRY }}/${{ github.repository }}
          tags: ${{ env.IMAGE_TAG }}

      - name: Pull the image
        run: |
          docker pull ${{ steps.metadata.outputs.tags }}

      - name: Run Trivy vulnerability scanner for any major issues
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ steps.metadata.outputs.tags }}
          ignore-unfixed: true
          severity: "CRITICAL,HIGH"
          limit-severities-for-sarif: true
          format: sarif
          output: trivy-results.sarif
          timeout: 20m # trivy default timeout is 5m, we need longer for our image

      # Show all detected issues.
      - name: Run Trivy vulnerability scanner for local output
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: ${{ steps.metadata.outputs.tags }}
          format: table
          timeout: 20m # trivy default timeout is 5m, we need longer for our image

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: trivy-results.sarif
          category: ${{ steps.metadata.outputs.tags }} image
          wait-for-processing: true

      - name: Detain results for debug if needed
        uses: actions/upload-artifact@v3
        with:
          name: trivy-results.sarif
          path: trivy-results.sarif
          if-no-files-found: error