From 2e78907a27763d5af0c4f74135ef15bfcf8e75f1 Mon Sep 17 00:00:00 2001
From: Monique Rio <mrio@umich.edu>
Date: Mon, 6 Nov 2023 12:43:03 -0500
Subject: [PATCH] adds scanning to actions

---
 .github/workflows/build-deploy-release.yaml | 15 +++++++++++++++
 .github/workflows/build-main.yaml           | 15 +++++++++++++++
 .github/workflows/deploy-production.yaml    |  2 +-
 3 files changed, 31 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build-deploy-release.yaml b/.github/workflows/build-deploy-release.yaml
index dd1a3d48..f3c89857 100644
--- a/.github/workflows/build-deploy-release.yaml
+++ b/.github/workflows/build-deploy-release.yaml
@@ -14,6 +14,21 @@ jobs:
       tag: ${{ github.event.release.tag_name }}
       dockerfile: Dockerfile
     secrets: inherit
+      
+  scan-image:
+    needs: build-production
+    runs-on: ubuntu-latest
+    steps:
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: ghcr.io/mlibrary/${{ vars.IMAGE_NAME }}:${{ github.event.release.tag_name }}
+          format: 'table'
+          exit-code: '1'
+          ignore-unfixed: true
+          vuln-type: 'os,library'
+          severity: 'CRITICAL,HIGH'
+          skip-files: '/gems/ruby/3.2.0/gems/openid_connect-2.2.0/spec/mock_response/public_keys/private_key.pem'
 
   deploy-production:
     needs: build-production
diff --git a/.github/workflows/build-main.yaml b/.github/workflows/build-main.yaml
index c42fa2f4..07ba0a83 100644
--- a/.github/workflows/build-main.yaml
+++ b/.github/workflows/build-main.yaml
@@ -15,6 +15,21 @@ jobs:
       tag: ${{ github.sha }}
       dockerfile: Dockerfile
     secrets: inherit
+      
+  scan-image:
+    needs: build-unstable
+    runs-on: ubuntu-latest
+    steps:
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: ${{ needs.build-unstable.outputs.image }}
+          format: 'table'
+          exit-code: '1'
+          ignore-unfixed: true
+          vuln-type: 'os,library'
+          severity: 'CRITICAL,HIGH'
+          skip-files: '/gems/ruby/3.2.0/gems/openid_connect-2.2.0/spec/mock_response/public_keys/private_key.pem'
 
   deploy-testing:
     needs: build-unstable
diff --git a/.github/workflows/deploy-production.yaml b/.github/workflows/deploy-production.yaml
index 2d8a25af..a3c9eb22 100644
--- a/.github/workflows/deploy-production.yaml
+++ b/.github/workflows/deploy-production.yaml
@@ -16,7 +16,7 @@ jobs:
       tag: ${{ github.event.inputs.tag }}
       dockerfile: Dockerfile
     secrets: inherit
-
+      
   deploy-production:
     needs: build-production
     runs-on: ubuntu-latest