trivy-scan.yml

name: trivy-scan

on:
  push:
  pull_request:
  # run weekly to pick up any new CVEs
  schedule:
    - cron: '30 2 * * 1' # 0230 UTC, 2130 EST on Monday nights

jobs:
  scan:
    runs-on: ubuntu-latest
    # avoid duplicate jobs on PRs from the main repo
    if: github.event_name == 'schedule' || github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name

    steps:
      - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
      - uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: '11'
          cache: 'maven'
      - name: Build with Maven
        run: mvn clean install -B -Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false -DskipTests
      - name: Extract NARs
        run: >-
          for nar in $(find . -name '*.nar'); do
            mkdir -p "nars/$(basename $nar)"
            unzip -d "nars/$(basename $nar)" "$nar"
          done
      - name: Trivy rootfs scan
        uses: aquasecurity/trivy-action@1f0aa582c8c8f5f7639610d6d38baddfea4fdcee # 0.9.2
        with:
          scan-type: 'rootfs'
          vuln-type: 'library'
          format: 'sarif'
          output: 'trivy-scan.sarif'
          scan-ref: './nars/'
      - name: Upload results
        uses: github/codeql-action/upload-sarif@17573ee1cc1b9d061760f3a006fc4aac4f944fd5 # v2.2.4
        with:
          sarif_file: 'trivy-scan.sarif'
      - name: Remove GeoMesa artifacts from Maven cache
        run: |
          rm -rf ~/.m2/repository/org/geomesa/nifi