akanealw/Charon
1
0
Fork 0
Code Issues Pull Requests Actions 14 Packages Projects Releases Wiki Activity

CI: Fix Trivy scan refs and guard SARIF upload; use metadata tags for docker-build scan; add outcome gating

Browse Source
This commit is contained in:
Wikid82
2025-11-18 17:57:52 -05:00
parent 8434121dd1
commit ffa1bd9af7
2 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
.github/workflows/docker-build.yml vendored
View File

@@ -84,24 +84,26 @@ jobs:
# Step 8: Run Trivy security scan
- name: 🔍 Run Trivy vulnerability scanner
id: trivy
uses: aquasecurity/trivy-action@master
with:
image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.ref == 'refs/heads/main' && 'latest' || 'dev' }}
image-ref: ${{ fromJSON(steps.meta.outputs.json).tags[0] }}
format: 'sarif'
output: 'trivy-results.sarif'
# Step 9: Upload Trivy results to GitHub Security tab
- name: 📤 Upload Trivy results to GitHub Security
uses: github/codeql-action/upload-sarif@v3
if: always()
if: steps.trivy.outcome == 'success'
with:
sarif_file: 'trivy-results.sarif'
# Step 10: Run Trivy with table output for workflow logs
- name: 📋 Run Trivy scan (table output)
if: steps.trivy.outcome == 'success'
uses: aquasecurity/trivy-action@master
with:
image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.ref == 'refs/heads/main' && 'latest' || 'dev' }}
image-ref: ${{ fromJSON(steps.meta.outputs.json).tags[0] }}
format: 'table'
severity: 'CRITICAL,HIGH'

6
.github/workflows/docker-publish.yml vendored
View File

@@ -76,6 +76,7 @@ jobs:
- name: Run Trivy vulnerability scanner
if: github.event_name != 'pull_request'
id: trivy
uses: aquasecurity/trivy-action@master
with:
image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build-and-push.outputs.digest }}
@@ -83,16 +84,15 @@ jobs:
output: 'trivy-results.sarif'
- name: Upload Trivy results to GitHub Security
if: github.event_name != 'pull_request'
if: github.event_name != 'pull_request' && steps.trivy.outcome == 'success'
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: 'trivy-results.sarif'
- name: Run Trivy scan (table output)
if: github.event_name != 'pull_request'
if: github.event_name != 'pull_request' && steps.trivy.outcome == 'success'
uses: aquasecurity/trivy-action@master
with:
image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build-and-push.outputs.digest }}
format: 'table'
severity: 'CRITICAL,HIGH'