From 6c42fdbae8bf05f66349b3cc905dcb071a49e6b1 Mon Sep 17 00:00:00 2001 From: Anchorfree Jenkins Date: Thu, 4 May 2023 09:25:38 +0000 Subject: [PATCH] Workflows updated from AnchorFree/workflows:1208968 --- .github/workflows/hadolint.yml | 2 +- .github/workflows/trivy.yml | 13 ++++++++----- 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/.github/workflows/hadolint.yml b/.github/workflows/hadolint.yml index 357f829..dd74c0d 100644 --- a/.github/workflows/hadolint.yml +++ b/.github/workflows/hadolint.yml @@ -11,7 +11,7 @@ jobs: - name: Check out code uses: actions/checkout@v3 - name: Scanning the dockerfile - uses: reviewdog/action-hadolint@v1.34.0 + uses: reviewdog/action-hadolint@v1.34.1 with: reporter: github-pr-review filter_mode: file diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml index 4340873..a3332da 100644 --- a/.github/workflows/trivy.yml +++ b/.github/workflows/trivy.yml @@ -4,7 +4,10 @@ on: push: branches: [ "master" ] pull_request: - types: [opened, reopened] + types: [opened, reopened, synchronize] + schedule: + # 00:00 every 14 days + - cron: 0 0 */14 * * permissions: contents: read @@ -28,14 +31,14 @@ jobs: run: git lfs checkout - name: Run Trivy vulnerability scanner in repo mode (table) - uses: aquasecurity/trivy-action@master + uses: aquasecurity/trivy-action@0.10.0 with: scan-type: 'fs' ignore-unfixed: true format: 'table' - name: Run Trivy vulnerability scanner in repo mode (sarif) - uses: aquasecurity/trivy-action@master + uses: aquasecurity/trivy-action@0.10.0 with: scan-type: 'fs' ignore-unfixed: true @@ -68,14 +71,14 @@ jobs: run: | docker build -t ${{ github.sha }} . - name: Run Trivy vulnerability scanner in image mode (table output) - uses: aquasecurity/trivy-action@master + uses: aquasecurity/trivy-action@0.10.0 with: image-ref: '${{ github.sha }}' ignore-unfixed: true format: 'table' - name: Run Trivy vulnerability scanner in image mode (sarif output) - uses: aquasecurity/trivy-action@master + uses: aquasecurity/trivy-action@0.10.0 with: image-ref: '${{ github.sha }}' ignore-unfixed: true