From dce91f00408b44f5468b045b25aabbceafaf7d5b Mon Sep 17 00:00:00 2001 From: Antoine Toulme Date: Fri, 7 Apr 2023 17:53:41 -0700 Subject: [PATCH] Add trivy scan --- .github/workflows/trivy-scans.yaml | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 .github/workflows/trivy-scans.yaml diff --git a/.github/workflows/trivy-scans.yaml b/.github/workflows/trivy-scans.yaml new file mode 100644 index 00000000..4994f933 --- /dev/null +++ b/.github/workflows/trivy-scans.yaml @@ -0,0 +1,30 @@ +name: trivy scans + +on: + push: + branches: + - main + pull_request: + paths: + - '.github/workflows/trivy-scans.yml' + - '.trivyignore' + +concurrency: + group: trivy-scans-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +jobs: + trivy-fs-scan: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v3 + - name: Run trivy filesystem scan + uses: aquasecurity/trivy-action@0.9.2 + with: + scan-type: 'fs' + scan-ref: '.' + skip-dirs: 'docs' + format: 'table' + exit-code: '1' + severity: 'CRITICAL,HIGH' + ignore-unfixed: true \ No newline at end of file