trivy-test-images.yml

name: Trivy Docker Image Analysis

on:
  push:
    branches:
      - main
  # Trigger manually
  workflow_dispatch:

permissions:
  security-events: write # To upload sarif files

jobs:
  build-and-scan:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Helm
        uses: azure/setup-helm@v4
        with:
          version: '3.6.3'

      - name: Set up python
        uses: actions/setup-python@v5
        with:
          python-version: '3.7'

      # Workaround: https://github.com/docker/build-push-action/issues/461
      - name: Setup Docker buildx
        uses: docker/setup-buildx-action@0d103c3126aa41d772a8362f6aa67afac040f80c

      # Build and push Docker image with Buildx (don't push on PR)
      # https://github.com/docker/build-push-action
      - name: Build and push Docker image
        id: build-and-push
        uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56
        with:
          context: .
          file: ./Dockerfile
          push: false
          tags: backend:latest
          load: true  # Load the image into Docker's local image store


      - name: Run Trivy Table
        uses: aquasecurity/trivy-action@0.18.0
        with:
          scan-type: 'image'
          image-ref: 'backend:latest'
          severity: 'MEDIUM,HIGH,CRITICAL'
          format: 'table'