chore: setup trivy for image scan (#117)

ariga · Dec 21, 2023 · 9bf128a · 9bf128a
1 parent 9e17700
commit 9bf128a
Showing 1 changed file with 12 additions and 0 deletions.
diff --git a/.github/workflows/push-images.yaml b/.github/workflows/push-images.yaml
@@ -62,3 +62,15 @@ jobs:
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           push: true
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@7b7aa264d83dc58691451798b4d117d53d21edfe
+        with:
+          image-ref: ${{ steps.meta.outputs.tags[0] }}
+          format: 'template'
+          template: '@/contrib/sarif.tpl'
+          output: 'trivy-results.sarif'
+          severity: 'CRITICAL,HIGH'
+      - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: 'trivy-results.sarif'