Add vulnerability scanning

TheLab-ms · May 22, 2024 · 31d44ed · 31d44ed
1 parent 34229dd
commit 31d44ed
Showing 1 changed file with 12 additions and 1 deletion.
diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml
@@ -36,6 +36,8 @@ jobs:
       - name: Get current date
         id: date
         run: echo "::set-output name=date::$(date +'%Y-%m-%d')"
+      - name: Perform Scan
+        uses: ShiftLeftSecurity/scan-action@master
       - name: Build and push
         uses: docker/build-push-action@v5
         with:
@@ -46,4 +48,13 @@ jobs:
             ${{ env.GHCR }}/vremenar/${{ env.IMAGENAME }}:latest
             ${{ env.GHCR }}/vremenar/${{ env.IMAGENAME }}:${{ steps.date.outputs.date }}
             ${{ env.DOCKER }}/vremenar/${{ env.IMAGENAME }}:latest
-            ${{ env.DOCKER }}/vremenar/${{ env.IMAGENAME }}:${{ steps.date.outputs.date }}
+            ${{ env.DOCKER }}/vremenar/${{ env.IMAGENAME }}:${{ steps.date.outputs.date }}
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: '${{ env.GHCR }}/vremenar/${{ env.IMAGENAME }}:latest'
+          format: 'table'
+          exit-code: '1'
+          ignore-unfixed: true
+          vuln-type: 'os,library'
+          severity: 'CRITICAL,HIGH'