actions.yml

name: Workflow
# yamllint sees the below line as a true or false value instead of an 'on' trigger
on:  # yamllint disable-line rule:truthy
  push:
    branches: [main]
  pull_request:
    branches: ["**"]
jobs:
  # Removing forbidden checks for now. Todo - maintain consistency across platforms
  # sanitize:
  #  name: Check for forbidden words
  #  runs-on: ubuntu-latest
  #  steps:
  #    - name: Checkout the code
  #      uses: actions/checkout@v4
  #    - name: Run the forbidden words scan
  #      uses: dell/common-github-actions/code-sanitizer@main
  #      with:
  #        args: /github/workspace
  image_security_scan:
    name: Image Scanner
    runs-on: ubuntu-latest
    env:
      BASE_IMG: ubuntu:latest
    steps:
      - uses: actions/setup-go@v5
        with:
          go-version: "1.23"
        id: go
      - name: Checkout the code
        uses: actions/checkout@v4
      - name: Build Docker Images
        run: |
          chmod +x ./scripts/build-ubi-micro.sh
          make build-base-image
          make -o gen-semver
          podman build -t docker.io/csm-operator -f ./Dockerfile --build-arg GOIMAGE=golang:latest --build-arg BASEIMAGE="localhost/csm-operator-ubimicro"
          podman save docker.io/library/csm-operator -o /tmp/csm-operator.tar
          docker load -i /tmp/csm-operator.tar
      - name: Scan controller Image
        uses: aquasecurity/trivy-action@0.29.0
        with:
          image-ref: csm-operator:latest
          severity: 'HIGH'
          ignore-unfixed: true
          exit-code: '1'
          trivyignores: '.github/workflows/.trivyignore'