Build(deps-dev): Bump sass-embedded from 1.100.0 to 1.103.1 in /aas-web-ui #645
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Repository and Container Vulnerability Scan | |
| on: | |
| pull_request: | |
| branches: [main] | |
| paths: | |
| - "aas-web-ui/**" | |
| - ".github/workflows/vuln-scan.yml" | |
| - ".github/workflows/docker-release-ui.yml" | |
| - ".github/workflows/docker-prerelease-ui.yml" | |
| push: | |
| branches: | |
| - main | |
| paths: | |
| - "aas-web-ui/**" | |
| - ".github/workflows/vuln-scan.yml" | |
| - ".github/workflows/docker-release-ui.yml" | |
| - ".github/workflows/docker-prerelease-ui.yml" | |
| schedule: | |
| - cron: "0 4 * * 1" | |
| workflow_dispatch: | |
| concurrency: | |
| group: vuln-scan-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| security-events: write | |
| jobs: | |
| trivy-fs-report: | |
| name: Trivy repository fs report (non-blocking) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Run Trivy filesystem scan | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| scan-type: fs | |
| scan-ref: . | |
| format: sarif | |
| output: trivy-results-fs.sarif | |
| vuln-type: os,library | |
| severity: HIGH,CRITICAL | |
| ignore-unfixed: true | |
| exit-code: "0" | |
| - name: Upload FS SARIF report | |
| if: always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) | |
| continue-on-error: true | |
| uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 | |
| with: | |
| sarif_file: trivy-results-fs.sarif | |
| - name: Upload FS scan artifact | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: trivy-fs-sarif-${{ github.run_id }} | |
| path: trivy-results-fs.sarif | |
| retention-days: 30 | |
| trivy-image-report: | |
| name: Trivy container image report (non-blocking) | |
| if: github.event_name == 'push' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| env: | |
| IMAGE_REF: aas-gui-vuln-scan:${{ github.sha }} | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Build local image for scan | |
| run: | | |
| docker build \ | |
| --file aas-web-ui/Dockerfile \ | |
| --tag "${IMAGE_REF}" \ | |
| aas-web-ui | |
| - name: Run Trivy image scan | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| scan-type: image | |
| image-ref: ${{ env.IMAGE_REF }} | |
| format: sarif | |
| output: trivy-results-image.sarif | |
| vuln-type: os,library | |
| severity: HIGH,CRITICAL | |
| ignore-unfixed: true | |
| exit-code: "0" | |
| - name: Upload image SARIF report | |
| if: always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) | |
| continue-on-error: true | |
| uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7 | |
| with: | |
| sarif_file: trivy-results-image.sarif | |
| - name: Upload image scan artifact | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: trivy-image-sarif-${{ github.run_id }} | |
| path: trivy-results-image.sarif | |
| retention-days: 30 |