scan-for-cves.yaml

name: Scan for CVEs

on:
  schedule:
    - cron: "0 0 * * *"
  workflow_dispatch: {}

jobs:
  getAllCharts:
    uses: ./.github/workflows/get-all-charts.yaml
    with:
      showLibraryCharts: false

  generateSarifReports:
    runs-on: ubuntu-latest
    needs: getAllCharts
    permissions:
      security-events: write
    strategy:
      fail-fast: false
      matrix:
        chart: ${{ fromJson(needs.getAllCharts.outputs.charts) }}
    steps:
      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4

      - run: /home/linuxbrew/.linuxbrew/bin/brew install trivy
      - run: pip install yq
      - name: Generate sarif reports
        run: |
          eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
          ./.github/scripts/generate-sarif-reports.sh ${{ matrix.chart }}
      - uses: github/codeql-action/upload-sarif@2c779ab0d087cd7fe7b826087247c2c81f27bfa6 # v3
        if: ${{ hashFiles('reports/*.sarif') != '' }}
        with:
          sarif_file: reports
          # TODO: github dependency tree?