Merge pull request #15 from sarg3nt/patch-upgrade-release-3

Fix github token missing error

.github/workflows/patch-upgrades-release.yml

@@ -4,17 +4,23 @@ on:
   schedule:
     - cron: '0 0 * * 0' # Runs weekly
   workflow_dispatch: # Allows manual triggering
+  pull_request:
+    branches:
+      - main
+
+permissions: read-all
 
 jobs:
-  build-and-release:
+  release:
     runs-on: ubuntu-latest
     permissions:
       contents: write
-
     steps:
       - name: 'Checkout Repository'
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         # See: https://github.com/huggingface/semver-release-action?tab=readme-ov-file
         # and https://github.com/semantic-release/semantic-release/blob/master/docs/usage/configuration.md#branches
       - name: Release
         uses: huggingface/semver-release-action@latest
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/trivy.yml

@@ -30,9 +30,6 @@ jobs:
     name: Build
     runs-on: "ubuntu-20.04"
     steps:
-      # - name: Authenticate to GitHub Container Registry
-      #   run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
-
       - name: Log into registry
         uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
         with:
@@ -51,14 +48,13 @@ jobs:
       - name: Build and push Docker image
         uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
         with:
-          context: .
           push: false
-          tags: ${{ github.sha }}
+          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
 
       - name: Run Trivy vulnerability scanner
         uses: aquasecurity/trivy-action@915b19bbe73b92a6cf82a1bc12b087c9a19a5fe2
         with:
-          image-ref: 'ghcr.io/sarg3nt/go-docker-container:${{ github.sha }}'
+          image-ref: '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}'
           format: 'template'
           template: '@/contrib/sarif.tpl'
           output: 'trivy-results.sarif'

SECURITY.md

@@ -8,5 +8,5 @@ Dependabot is used to maintain dependency versions.
 
 ## Reporting a Vulnerability
 
-Report found vulnerabilities by opening an Issue.
+Report found vulnerabilities by contacting us at [[email protected]](mailto:[email protected])