Repository navigation
Container Security #57
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Container Security | |
| on: | |
| push: | |
| branches: [ "main", "develop" ] | |
| pull_request: | |
| branches: [ "main", "develop" ] | |
| schedule: | |
| - cron: '0 5 * * 1' # Weekly scan | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| security-events: write | |
| jobs: | |
| scan-images: | |
| name: Build & Scan Images | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout Code | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| # ----------------------------------------------------------------------- | |
| # BACKEND | |
| # ----------------------------------------------------------------------- | |
| - name: Build Backend Image | |
| run: | | |
| docker build -t fedex-backend:latest -f backend/crates/Dockerfile . | |
| - name: Scan Backend Image (Trivy) | |
| uses: aquasecurity/trivy-action@915b19bbe73b92a6cf82a1bc12b087c9a19a5fe2 # v0.28.0 | |
| with: | |
| image-ref: 'fedex-backend:latest' | |
| format: 'sarif' | |
| output: 'trivy-backend-results.sarif' | |
| severity: 'CRITICAL,HIGH' | |
| # ----------------------------------------------------------------------- | |
| # FRONTEND | |
| # ----------------------------------------------------------------------- | |
| - name: Build Frontend Image | |
| run: | | |
| docker build -t fedex-frontend:latest -f frontend/Dockerfile frontend | |
| - name: Scan Frontend Image (Trivy) | |
| uses: aquasecurity/trivy-action@915b19bbe73b92a6cf82a1bc12b087c9a19a5fe2 # v0.28.0 | |
| with: | |
| image-ref: 'fedex-frontend:latest' | |
| format: 'sarif' | |
| output: 'trivy-frontend-results.sarif' | |
| severity: 'CRITICAL,HIGH' | |
| - name: Upload Trivy Results (Backend) | |
| uses: github/codeql-action/upload-sarif@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0 | |
| if: always() | |
| with: | |
| sarif_file: 'trivy-backend-results.sarif' | |
| category: 'backend-container' | |
| - name: Upload Trivy Results (Frontend) | |
| uses: github/codeql-action/upload-sarif@48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 # v3.28.0 | |
| if: always() | |
| with: | |
| sarif_file: 'trivy-frontend-results.sarif' | |
| category: 'frontend-container' |