try-trivy-image-scanning

mlibrary · Nov 6, 2023 · 388d472 · 388d472
1 parent 3a7a869
commit 388d472
Showing 1 changed file with 14 additions and 0 deletions.
diff --git a/.github/workflows/manual-deploy-unstable.yaml b/.github/workflows/manual-deploy-unstable.yaml
@@ -25,6 +25,20 @@ jobs:
       dockerfile: Dockerfile
     secrets: inherit
 
+  scan-image:
+    needs: build-unstable
+    runs-on: ubuntu-latest
+    steps:
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: ${{ needs.build-unstable.outputs.image }}
+          format: 'table'
+          exit-code: '1'
+          ignore-unfixed: true
+          vuln-type: 'os,library'
+          severity: 'CRITICAL,HIGH'
+
   deploy:
     needs: build-unstable
     runs-on: ubuntu-latest