trivy.yml

name: Scan Trivy Config
on:
  push:
    branches:
    - main
  pull_request:
  workflow_dispatch:
    inputs:
      branch:
        description: 'branch to run scans on'
        default: 'main'
        type: string

permissions:
  contents: read

jobs:
  scan:
    permissions:
      contents: read  # for actions/checkout to fetch code
      security-events: write  # for github/codeql-action/upload-sarif to upload SARIF results
    runs-on: ubuntu-22.04
    name: scan
    steps:

      - name: Harden Runner
        uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
        with:
          egress-policy: audit
      - name: Checkout code
        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
        with:
          ref: ${{ inputs.branch }}
      - name: Run Trivy vulnerability scanner for 'config' with sarif output
        uses: aquasecurity/trivy-action@7c2007bcb556501da015201bcba5aa14069b74e2 # v0.23.0
        with:
          scan-type: config
          skip-dirs: deployment #helm charts not supported 
          exit-code: '0'
          format: 'sarif'
          output: 'trivy-results.sarif'
      - name: Run Trivy vulnerability scanner for 'config' with table output
        if: always()
        uses: aquasecurity/trivy-action@7c2007bcb556501da015201bcba5aa14069b74e2 # v0.23.0
        with:
          scan-type: config
          skip-dirs: deployment #helm charts not supported 
          exit-code: '0'
          format: 'table'
          output: 'trivy-results.txt'
      - name: Upload Trivy scan results to GitHub Security tab
        if: always()
        uses: github/codeql-action/upload-sarif@b611370bb5703a7efb587f9d136a52ea24c5c38c # v3.25.11
        with:
          sarif_file: 'trivy-results.sarif'
      - uses: actions/upload-artifact@v4
        if: always()
        with:
          name: trivy-results
          path: 'trivy-results.txt'