Skip to content

Analysis

Analysis #104

Workflow file for this run

# https://docs.github.com/actions
name: Analysis
on:
schedule:
- cron: '43 2 * * 6'
workflow_call:
inputs:
artifact:
required: false
default: true
type: string
description: True if analysis must be run against a built artifact
workflow_dispatch:
jobs:
trivy:
name: Trivy
runs-on: ubuntu-latest
permissions:
actions: read
contents: read
security-events: write
strategy:
matrix:
variant: [fpm-alpine, fpm, apache]
steps:
- name: Retrieve image artifact
uses: actions/download-artifact@v4
if: inputs.artifact
with:
name: ${{ matrix.variant }}-image
- name: Run Trivy scanner
uses: aquasecurity/trivy-action@0.16.1
if: inputs.artifact
with:
input: container-image.tar
format: template
template: '@/contrib/sarif.tpl'
output: results.sarif
- name: Run Trivy scanner
uses: aquasecurity/trivy-action@0.16.1
if: "! inputs.artifact"
with:
image-ref: ghcr.io/${{ vars.REGISTRY_IMAGE }}:${{ matrix.variant }}
format: template
template: '@/contrib/sarif.tpl'
output: results.sarif
- name: Upload scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: results.sarif