-
Notifications
You must be signed in to change notification settings - Fork 1.3k
43 lines (38 loc) · 1.05 KB
/
vuln-scans.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
name: Vulnerability scans
on:
workflow_dispatch: {} # Allow for manual triggers
pull_request:
jobs:
trivy-scan:
name: Trivy security scan
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v3
# Equivalent to:
# $ trivy fs .
- name: Run Trivy scan on repo
uses: aquasecurity/trivy-action@0.5.1
with:
scan-type: fs
format: table
exit-code: '1'
ignore-unfixed: true
severity: CRITICAL,HIGH
- name: Build image
run: |
make image
- name: Get tag
id: tag
run: echo "::set-output name=TAG::$(./build/get-build-version.sh)"
# Equivalent to:
# $ trivy image $IMAGE
- name: Run Trivy scan on image
uses: aquasecurity/trivy-action@0.5.1
with:
image-ref: 'openpolicyagent/opa:${{ steps.tag.outputs.TAG }}'
format: table
exit-code: '1'
ignore-unfixed: true
vuln-type: os,library
severity: CRITICAL,HIGH