grype.yml

# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.

name: Grype docker image scan
on:
  schedule:
    - cron: '0 0 * * *' # do it every day
  # push:
  #  branches:
  #    - '**'        # matches every branch
  #pull_request:
  #  branches:
  #    - '**'
  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

jobs:
  Grype-EMBA-scan:
    if: github.repository_owner == 'e-m-b-a'
    permissions:
      contents: read # for actions/checkout to fetch code
      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
    name: Grype EMBA image check
    runs-on: "ubuntu-latest"
    steps:
      - name: Checkout EMBA
        uses: actions/checkout@v3
      - name: Free Disk Space
        uses: jlumbroso/free-disk-space@main
        with:
          tool-cache: true
          android: true
          dotnet: true
          haskell: true
          large-packages: false
          swap-storage: true
      - name: Run the Anchore Grype scan action
        uses: anchore/scan-action@d5aa5b6cb9414b0c7771438046ff5bcfa2854ed7
        id: scan
        with:
          image: "embeddedanalyzer/emba:latest"
          fail-build: false
          severity-cutoff: critical
      - name: Upload vulnerability report
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: ${{ steps.scan.outputs.sarif }}