security-scan.yaml

name: Security Scan  👮

env:
  REGISTRY: ghcr.io

on:
  schedule:
    - cron: '44 21 7,21 * *'
  workflow_dispatch:

jobs:
  build:
    name: Security Scan 🚔
    runs-on: ubuntu-latest
    strategy:
      matrix:
        image:
          - r: '4.4.1'
            bioc: '3.19'
            distro: rstudio
    steps:
      - name: Log in to the Container registry 🗝
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Run Trivy vulnerability scanner 🚓
        uses: aquasecurity/trivy-action@0.14.0
        with:
          scan-type: image
          image-ref: ${{ env.REGISTRY }}/${{ github.repository_owner }}/${{ matrix.image.distro }}_${{ matrix.image.r }}_bioc_${{ matrix.image.bioc }}:latest
          exit-code: 0
          ignore-unfixed: true
          vuln-type: 'os,library'
          severity: 'CRITICAL,HIGH,MEDIUM'
          format: 'sarif'
          output: 'trivy-results.sarif'
          timeout: 30m0s
          security-checks: vuln,secret,config
          github-pat: ${{ secrets.GITHUB_TOKEN }}

      - name: Upload Trivy scan results to GitHub Security tab ⛽
        uses: github/codeql-action/upload-sarif@v2
        if: always()
        with:
          sarif_file: 'trivy-results.sarif'