From bf296659942ce90bd29f7cf405623331303ff17b Mon Sep 17 00:00:00 2001 From: Wonderfall Date: Wed, 2 Jun 2021 19:12:33 +0200 Subject: [PATCH] add scan workflow --- .github/workflows/scan.yml | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 .github/workflows/scan.yml diff --git a/.github/workflows/scan.yml b/.github/workflows/scan.yml new file mode 100644 index 0000000..ae8150c --- /dev/null +++ b/.github/workflows/scan.yml @@ -0,0 +1,29 @@ +name: scan + +on: + schedule: + # Scan the image regularly (once a day) + - cron: '45 03 * * *' + +jobs: + build: + name: Scan current image & report results + runs-on: "ubuntu-20.04" + steps: + - name: Checkout code + uses: actions/checkout@v2 + + - name: Run Trivy vulnerability scanner + uses: aquasecurity/trivy-action@master + with: + image-ref: 'ghcr.io/wonderfall/synapse' + format: 'template' + template: '@/contrib/sarif.tpl' + output: 'trivy-results.sarif' + severity: 'CRITICAL,HIGH' + vuln-type: "os" + + - name: Upload Trivy scan results to GitHub Security tab + uses: github/codeql-action/upload-sarif@v1 + with: + sarif_file: 'trivy-results.sarif' \ No newline at end of file