Trivy Vulnerability Scan (Repo mode) #38

	name: Trivy Vulnerability Scan (Repo mode)

	on:
	workflow_dispatch:
	inputs:
	config-path:
	description: 'Relative path to Trivy config file'
	default: '.github/trivy-to-console.yaml'
	required: false
	type: string
	upload-results:
	description: 'Upload scan results to Github?'
	default: false
	required: false
	type: boolean
	workflow_call:
	inputs:
	config-path:
	description: 'Relative path to Trivy config file'
	default: '.github/trivy-to-console.yaml'
	required: false
	type: string
	upload-results:
	description: 'Upload scan results to Github?'
	default: false
	required: false
	type: boolean

	jobs:
	run_trivy_scan:
	name: Run Trivy Scan
	runs-on: ubuntu-latest
	env:
	LOCAL_REPOSITORY_PATH: ./build/publications/repos
	TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db,aquasec/trivy-db,ghcr.io/aquasecurity/trivy-db
	TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db,aquasec/trivy-java-db,ghcr.io/aquasecurity/trivy-java-db
	steps:
	- uses: actions/checkout@v4
	- uses: spring-io/spring-gradle-build-action@v2
	- name: Publish to local repo (poms)
	run: \|
	./gradlew publishMavenJavaPublicationToLocalRepository
	- name: Run Trivy scan in repo mode (fs)
	uses: aquasecurity/trivy-action@master
	with:
	scan-type: 'fs'
	scan-ref: '${{ env.LOCAL_REPOSITORY_PATH }}/org/springframework/pulsar'
	trivy-config: ${{ inputs.config-path }}
	github-pat: ${{ secrets.GH_ACTIONS_REPO_TOKEN }}
	- name: Upload Trivy scan results to GitHub Security tab
	if: inputs.upload-results
	uses: github/codeql-action/upload-sarif@v3
	with:
	sarif_file: 'trivy-results.sarif'

Provide feedback