Skip to content

🔄 Templates: synced local '.github/workflows/add_issue_to_project.yml… #1160

🔄 Templates: synced local '.github/workflows/add_issue_to_project.yml…

🔄 Templates: synced local '.github/workflows/add_issue_to_project.yml… #1160

Workflow file for this run

name: Trivy Security Scan
on:
push:
workflow_dispatch:
jobs:
security_scan:
name: security_scan
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Run static analysis (rootfs)
uses: aquasecurity/[email protected]
env:
#try default GitHub DBs, if failing, use AWS mirror instead (https://github.com/aquasecurity/trivy-action/issues/389)
TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db
TRIVY_JAVA_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-java-db,public.ecr.aws/aquasecurity/trivy-java-db
with:
scan-type: "rootfs"
scanners: "vuln,misconfig"
ignore-unfixed: true
format: 'table'
severity: "CRITICAL,HIGH"
- name: Run static analysis (repo)
uses: aquasecurity/[email protected]
env:
#try default GitHub DBs, if failing, use AWS mirror instead (https://github.com/aquasecurity/trivy-action/issues/389)
TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db
TRIVY_JAVA_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-java-db,public.ecr.aws/aquasecurity/trivy-java-db
with:
scan-type: "repo"
scanners: "vuln,misconfig"
ignore-unfixed: true
format: 'table'
severity: "CRITICAL,HIGH"