code_scan.yml

name: Code Scanning

on:
  workflow_dispatch: # run on request (no need for PR)
  schedule:
    # every UTC 6PM from Mon to Fri
    - cron: "0 18 * * 1-5"

jobs:
  Trivy:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v3
      - name: Setup Python
        uses: actions/setup-python@v4
        with:
          python-version: "3.10"
      - name: Install dependencies
        run: python -m pip install tox
      - name: Trivy Scanning
        env:
          TRIVY_DOWNLOAD_URL: ${{ vars.TRIVY_DOWNLOAD_URL }}
        run: tox -e trivy-scan
      - name: Upload Trivy results artifact
        uses: actions/upload-artifact@v3
        with:
          name: trivy-results
          path: |
            .tox/trivy-results-datumaro.txt
            .tox/trivy-results-datumaro.csv
            .tox/trivy-spdx-datumaro.json
  Bandit:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v3
      - name: Setup Python
        uses: actions/setup-python@v4
        with:
          python-version: 3.8
      - name: Install dependencies
        run: python -m pip install tox
      - name: Bandit Scanning
        run: tox -e bandit-scan
      - name: Upload Bandit artifact
        uses: actions/upload-artifact@v3
        with:
          name: bandit-report
          path: .tox/bandit-report.txt
        # Use always() to always run this step to publish scan results when there are test failures
        if: ${{ always() }}
  call-notify-to-teams:
    needs: [Trivy, Bandit]
    if: |
      always() &&
      contains(needs.*.result, 'failure')
    uses: ./.github/workflows/notify_teams.yml
    secrets: inherit