Run trivy image scan whenever new images are built and published to GHCR #110

	name: Run trivy image scan whenever new images are built and published to GHCR
	on:
	workflow_run:
	workflows: ["Release a new version of DivBase", "Build and push DEV images to ghcr and run pytest on the images"]
	types:
	- completed
	schedule:
	- cron: '15 5 * * 3'

	jobs:
	scan:
	if: ${{ github.event_name != 'workflow_run' \|\| github.event.workflow_run.conclusion == 'success' }}
	runs-on: ubuntu-latest
	permissions:
	contents: read
	security-events: write
	strategy:
	matrix:
	image-name: [divbase-fastapi, divbase-worker]

	steps:
	- name: Checkout code
	uses: actions/checkout@v6

	- name: Determine image tag to scan
	id: image-tag
	run: \|
	if [ "${{ github.event_name }}" == "workflow_run" ]; then
	echo "tag=${{ github.event.workflow_run.head_sha }}" >> $GITHUB_OUTPUT
	else
	echo "tag=latest" >> $GITHUB_OUTPUT
	fi

	- name: Run Trivy vulnerability scanner
	uses: aquasecurity/trivy-action@0.35.0
	with:
	scan-type: "image"
	image-ref: ghcr.io/scilifelabdatacentre/${{ matrix.image-name }}:${{ steps.image-tag.outputs.tag }}
	ignore-unfixed: true
	format: "sarif"
	output: "trivy-results.sarif"
	severity: "CRITICAL,HIGH"

	- name: Upload Trivy scan results to GitHub Security tab
	uses: github/codeql-action/upload-sarif@v4
	with:
	sarif_file: "trivy-results.sarif"
	category: trivy

Navigation Menu