From 81c1fdc65bae123bbb3fbbb468b6a639f69bc44a Mon Sep 17 00:00:00 2001
From: Brian-Frederik Jahnke <74709618+brianjahnke@users.noreply.github.com>
Date: Mon, 21 Jun 2021 07:47:45 +0200
Subject: [PATCH] chore: add vulnerability scanning (#41)

---
 .github/workflows/build-image.yaml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.github/workflows/build-image.yaml b/.github/workflows/build-image.yaml
index fb34c16..979bf0d 100644
--- a/.github/workflows/build-image.yaml
+++ b/.github/workflows/build-image.yaml
@@ -54,6 +54,15 @@ jobs:
         env:
           IMAGE: ${{ steps.get_repo.outputs.IMAGE }}
           BRANCH: ${{ steps.get_branch.outputs.BRANCH }}
+      - name: Run vulnerability scanner
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: '${{ steps.get_repo.outputs.IMAGE }}:${{ steps.get_branch.outputs.BRANCH }}'
+          format: 'table'
+          exit-code: '0'
+          ignore-unfixed: true
+          vuln-type: 'os,library'
+          severity: 'UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL'
       -
         name: Push tagged image
         run: |