scan-docker-image-action.yaml

---
  name: Reusable workflow for Trivy and Dockle to scan images
  on:
    workflow_call:
      inputs:
        platforms:
          description: The platform to scan the image
          required: true
          type: string
          default: '["linux/arm64", "linux/amd64"]'
        source_image: 
          description: The image to clone
          required: true
          type: string
        source_registry:
          description: Image registry from which to pull the image
          required: true
          type: string
      secrets: 
        registry_password:
          description: The Github token or similar to authenticate with for the registry.
          required: true
        registry_username:
          description: The username to authenticate with for the registry.
          required: true
  
  jobs:
    scan:
      strategy:
        matrix:
          platform: ${{ fromJson(inputs.platforms) }}
      runs-on: ubuntu-latest
      name: Trivy + Dockle image scan
      steps:
            
        - name: Login to ${{ inputs.source_registry }}
          uses: docker/login-action@v3
          with:
            registry: ${{ inputs.source_registry }}
            username: ${{ secrets.registry_username }}
            password: ${{ secrets.registry_password }}

        - name: Display platform
          run: |
            echo "Platform: ${{ matrix.platform }}"
        
        - name: check docker image exists
          run: |
            docker pull --platform ${{ matrix.platform }} ${{ inputs.source_registry }}/${{ inputs.source_image }}

        - name: Trivy - multi-arch
          uses: aquasecurity/trivy-action@0.24.0
          with:
            image-ref: ${{ inputs.source_registry }}/${{ inputs.source_image }}
            format: "table"
            exit-code: "1"
            ignore-unfixed: true
            vuln-type: "os,library"
            severity: "CRITICAL,HIGH"
            trivy-config: trivy.yaml
          env:
            TRIVY_PLATFORM: ${{ matrix.platform }}
        
        - name: Dockle - multi-arch
          uses: hands-lab/dockle-action@v1
          with:
            image: ${{ inputs.source_registry }}/${{ inputs.source_image }}
            exit-code: "0"
            exit-level: WARN