Skip to content

Merge pull request #1737 from AndrewSirenko/edit-owners #462

Merge pull request #1737 from AndrewSirenko/edit-owners

Merge pull request #1737 from AndrewSirenko/edit-owners #462

name: Trivy Scanner - Container Images
on:
push:
branches:
- master
schedule:
- cron: '0 */24 * * *'
jobs:
build-matrix:
runs-on: ubuntu-latest
outputs:
images: ${{ steps.set-matrix.outputs.result }}
steps:
- name: Checkout code
uses: actions/checkout@v3
- id: set-matrix
uses: mikefarah/yq@master
with:
# Dynamically build the matrix of images to scan
cmd: "yq '[{\"repository\": .image.repository, \"tag\": \"v'$(yq '.appVersion' charts/aws-ebs-csi-driver/Chart.yaml)'\"}] + (.sidecars | map(.image)) | map(.repository + \":\" + .tag) | . style=\"flow\"' charts/aws-ebs-csi-driver/values.yaml"
trivy-scan:
needs: build-matrix
runs-on: ubuntu-latest
strategy:
matrix:
image: ${{ fromJson(needs.build-matrix.outputs.images) }}
steps:
- name: Scan container image
uses: aquasecurity/trivy-action@master
with:
image-ref: '${{ matrix.image }}'
output: 'results.sarif'
format: 'sarif'
ignore-unfixed: true
severity: 'HIGH,CRITICAL'
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v2
with:
sarif_file: 'results.sarif'