Skip to content

fix: move commenting into own job #19

fix: move commenting into own job

fix: move commenting into own job #19

---
name: Security Scanning 🕵️
on:
push:
branches:
- main
pull_request:
branches:
- main
jobs:
setup-matrix:
runs-on: ubuntu-latest
outputs:
matrix: ${{ steps.set-matrix.outputs.matrix }}
steps:
- name: Source checkout
uses: actions/checkout@v4
- id: set-matrix
run: echo "matrix=$(jq -c . build_versions.json)" >> $GITHUB_OUTPUT
build_test_container:
name: 'Build test container'
runs-on: ubuntu-latest
permissions:
actions: read
contents: read
security-events: write
pull-requests: write
needs: setup-matrix
strategy:
matrix: ${{ fromJson(needs.setup-matrix.outputs.matrix) }}
steps:
- name: Checkout repository
uses: actions/checkout@v4
- name: Build local container
uses: docker/build-push-action@v6
with:
tags: 'ci/test:latest'
push: false
build-args: |
BASE_IMAGE=${{ matrix.base_image }}
- name: Scan image with Anchore Grype
uses: anchore/scan-action@v3
id: scan
with:
image: 'ci/test:latest'
fail-build: false
- name: Inspect action SARIF report
run: jq . ${{ steps.scan.outputs.sarif }}
- name: Upload Anchore scan SARIF report
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: ${{ steps.scan.outputs.sarif }}