scan-images.yml

name: Scan Images

on:
  workflow_dispatch:
  schedule:
  - cron: '00 7 * * *'

jobs:
  Scan-Images:
    runs-on    : ubuntu-latest
    permissions:
      contents: write
      pull-requests: write
    name       : Scan images
    steps      :
    - uses: actions/checkout@v3
      name: Checkout

    - name: Cache OpenAF runtime
      uses: actions/cache@v3
      with:
        key : oaf-t8
        path: /tmp/oaf

    - name: Restore the trivy databases from cache
      run : |
        wget https://openaf.io/trivy-db.tgz
        docker run --rm -v trivy-db:/volume -v $(pwd):/backup busybox tar xzf /backup/trivy-db.tgz -C /volume

    - uses: openaf/ojob-action@v4
      name: Check latest
      with:
        ojob: 'ojob.io/sec/genSecBadge'
        args: 'image=nmaguiar/hvscs:latest file=.github/sec-latest.svg reportFile=.github/sec-latest.yaml scanOptions="--skip-dirs\ /home/.openvscode-server/**"'
        dist: 't8'

    - uses: openaf/ojob-action@v4
      name: Check build
      with:
        ojob: 'ojob.io/sec/genSecBadge'
        args: 'image=nmaguiar/hvscs:build file=.github/sec-build.svg reportFile=.github/sec-build.yaml scanOptions="--skip-dirs\ /home/.openvscode-server/**"'
        dist: 't8'

    - uses: openaf/ojob-action@v4
      name: Check build lite
      with:
        ojob: 'ojob.io/sec/genSecBadge'
        args: 'image=nmaguiar/hvscs:build-lite file=.github/sec-build-lite.svg reportFile=.github/sec-build-lite.yaml scanOptions="--skip-dirs\ /home/.openvscode-server/**"'
        dist: 't8'

    - uses: openaf/ojob-action@v4
      name: Generate sec-latest.md
      with:
        ojob: 'ojob.io/util/toMDTree'
        args: 'inputFile=.github/sec-latest.yaml file=.github/sec-latest.md'
        dist: 't8'

    - uses: openaf/ojob-action@v4
      name: Generate sec-build.md
      with:
        ojob: 'ojob.io/util/toMDTree'
        args: 'inputFile=.github/sec-build.yaml file=.github/sec-build.md'
        dist: 't8'


    - uses: openaf/ojob-action@v4
      name: Generate sec-build-lite.md
      with:
        ojob: 'ojob.io/util/toMDTree'
        args: 'inputFile=.github/sec-build-lite.yaml file=.github/sec-build-lite.md'
        dist: 't8'

    - uses: openaf/ojob-action@v4
      name: Update badges
      env :
        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      with:
        ojob: 'ojob.io/git/hub/contentIn'
        args: 'message="update\ badge\ {{date}}/{{time}}" title="Scan\ images\ result" paths=.github/'
        dist: 't8'