Skip to content

Merge pull request #657 from DFE-Digital/renovate/dfe-digital-deploy-… #66

Merge pull request #657 from DFE-Digital/renovate/dfe-digital-deploy-…

Merge pull request #657 from DFE-Digital/renovate/dfe-digital-deploy-… #66

Workflow file for this run

name: Scan Docker image
on:
push:
branches: main
jobs:
scan:
runs-on: ubuntu-latest
outputs:
image: ${{ steps.build.outputs.imageid }}
strategy:
matrix:
image: [
"Dockerfile",
"Dockerfile.PersonsApi"
]
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Build docker image
uses: docker/build-push-action@v6
id: build
with:
file: './${{ matrix.image }}'
build-args: CI=true
secrets: github_token=${{ secrets.GITHUB_TOKEN }}
load: true
cache-from: type=gha
cache-to: type=gha
push: false
- name: Export docker image as tar
run: docker save -o ${{ matrix.image }}.tar ${{ steps.build.outputs.imageid }}
- name: Scan Docker image for CVEs
uses: aquasecurity/[email protected]
with:
input: ${{ matrix.image }}.tar
format: 'sarif'
output: 'trivy-results.sarif'
limit-severities-for-sarif: true
ignore-unfixed: true
severity: 'CRITICAL,HIGH'
github-pat: ${{ secrets.GITHUB_TOKEN }}
- name: Upload scan results to GitHub Security
uses: github/codeql-action/upload-sarif@v3
if: always()
with:
sarif_file: 'trivy-results.sarif'