trivy

Bump github/codeql-action/upload-sarif from 4.37.0 to 4.37.3 #3712

	# This workflow uses actions that are not certified by GitHub.
	# They are provided by a third-party and are governed by
	# separate terms of service, privacy policy, and support
	# documentation.

	name: trivy
	permissions: {}

	on:
	workflow_dispatch:
	inputs:
	run:
	description: "Run the workflow"
	required: true
	default: true
	type: boolean
	push:
	branches:
	- main
	pull_request:
	schedule:
	# every Monday at 7:31pm
	- cron: "31 19 * * 1"

	concurrency:
	group: ${{ github.workflow }}-${{ github.event.pull_request.number \|\| github.ref }}
	cancel-in-progress: true

	jobs:
	scan:
	name: Build
	runs-on: "ubuntu-latest"
	permissions:
	security-events: write # Needed to upload the analysis results

	steps:
	- name: Checkout code
	uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	with:
	persist-credentials: false

	- name: Trivy Vulnerability Scan
	uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # 0.36.0
	with:
	scan-type: "fs"
	severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"
	scan-ref: "."
	scanners: "vuln"
	format: "sarif"
	output: "trivy-results.sarif"
	exit-code: 1

	- name: Trivy License Scan
	uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # 0.36.0
	with:
	scan-type: "fs"
	severity: "HIGH,CRITICAL"
	scan-ref: "."
	scanners: "license"
	exit-code: 1

	- name: Upload Trivy scan results to GitHub Security tab
	uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
	with:
	sarif_file: "trivy-results.sarif"

Navigation Menu