scan.yml

name: scan-images

on:
  schedule:
    # Cron for every Monday at 12:00 UTC.
    - cron: "0 12 * * 1"

# Remove all permissions from GITHUB_TOKEN except metadata.
permissions: {}

jobs:
  scan:
    strategy:
      fail-fast: false
      matrix:
        branch: [ main, release-1.3, release-1.2 ]
    name: Trivy
    runs-on: ubuntu-latest
    steps:
    - name: Check out code
      uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # tag=v3.4.0
      with:
        ref: ${{ matrix.branch }}
    - name: Calculate go version
      id: vars
      run: echo "go_version=$(make go-version)" >> $GITHUB_OUTPUT
    - name: Set up Go
      uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # tag=v3.5.0
      with:
        go-version: ${{ steps.vars.outputs.go_version }}
    - name: Run verify container script
      run: make verify-container-images