Trivy vulnerability scan #564

	name: Trivy vulnerability scan
	on:
	push:
	branches:
	- main
	paths:
	- "**.tf"
	pull_request:
	paths:
	- "**.tf"
	workflow_dispatch:
	schedule:
	- cron: "0 4 * * *" # Nightly 4AM UTC

	# This allows a subsequently queued workflow run to interrupt previous runs
	concurrency:
	group: ${{ github.workflow }}-${{ github.head_ref \|\| github.run_id}}
	cancel-in-progress: true

	defaults:
	run:
	# fail-fast using bash -eo pipefail. See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
	shell: bash

	permissions:
	contents: read

	jobs:
	trivy:
	permissions:
	contents: read # for actions/checkout to fetch code
	security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
	name: Trivy sarif report
	runs-on: ubuntu-latest

	steps:
	- name: Harden Runner
	uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
	with:
	egress-policy: audit

	- name: Checkout code
	uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0

	- name: Run Trivy vulnerability scanner in repo mode
	uses: aquasecurity/trivy-action@062f2592684a31eb3aa050cc61e7ca1451cecd3d # 0.18.0
	with:
	scan-type: "fs"
	ignore-unfixed: false
	format: "sarif"
	output: "trivy-results.sarif"
	severity: "CRITICAL,HIGH,MEDIUM,LOW"
	trivyignores: ".trivyignore"

	- name: Upload Trivy scan results to GitHub Security tab
	uses: github/codeql-action/upload-sarif@8a470fddafa5cbb6266ee11b37ef4d8aae19c571 # v3.24.6
	with:
	sarif_file: "trivy-results.sarif"

Provide feedback