This repository has been archived by the owner on Oct 16, 2024. It is now read-only.

Merge pull request #831 from DFE-Digital/feature/redirect-to-conversions #15

	name: Scan Docker image

	on:
	push:
	branches: main

	jobs:
	scan:
	runs-on: ubuntu-latest
	outputs:
	image: ${{ steps.build.outputs.imageid }}
	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Set up Docker Buildx
	uses: docker/setup-buildx-action@v3

	- name: Build docker image
	uses: docker/build-push-action@v6
	id: build
	with:
	secrets: github_token=${{ secrets.GITHUB_TOKEN }}
	load: true
	cache-from: type=gha
	cache-to: type=gha
	push: false

	- name: Export docker image as tar
	run: docker save -o ${{ github.ref_name }}.tar ${{ steps.build.outputs.imageid }}

	- name: Scan Docker image for CVEs
	uses: aquasecurity/trivy-action@0.24.0
	with:
	input: ${{ github.ref_name }}.tar
	format: 'sarif'
	output: 'trivy-results.sarif'
	limit-severities-for-sarif: true
	ignore-unfixed: true
	severity: 'CRITICAL,HIGH'
	github-pat: ${{ secrets.GITHUB_TOKEN }}

	- name: Upload scan results to GitHub Security
	uses: github/codeql-action/upload-sarif@v3
	if: always()
	with:
	sarif_file: 'trivy-results.sarif'

Provide feedback