Trivy image scanning #7
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Trivy image scanning | |
| on: | |
| workflow_dispatch: | |
| schedule: | |
| - cron: '0 0 * * 1' # Every Monday at 00:00 | |
| permissions: # set contents: read at top-level, per OpenSSF ScoreCard rule TokenPermissionsID | |
| contents: read | |
| jobs: | |
| image-scanning: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| security-events: write | |
| strategy: | |
| matrix: | |
| IMAGE: [ | |
| 'ghcr.io/kubeflow/model-registry/server:latest', | |
| 'ghcr.io/kubeflow/model-registry/ui:latest', | |
| 'ghcr.io/kubeflow/model-registry/job/async-upload:latest', | |
| 'ghcr.io/kubeflow/model-registry/storage-initializer:latest', | |
| 'ghcr.io/kubeflow/model-registry/ui-standalone:latest' | |
| ] | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v5.0.0 | |
| - name: Sanitize image name for SARIF filename | |
| run: | | |
| # Replace special characters with hyphens and convert to lowercase | |
| SANITIZED_NAME=$(echo "${{ matrix.IMAGE }}" | sed 's/[^a-zA-Z0-9._-]/-/g' | tr '[:upper:]' '[:lower:]') | |
| echo "SANITIZED_IMAGE_NAME=${SANITIZED_NAME}" >> $GITHUB_ENV | |
| echo "Sanitized image name: ${SANITIZED_NAME}" | |
| - name: trivy scan for github security tab | |
| uses: aquasecurity/trivy-action@0.33.1 | |
| with: | |
| image-ref: '${{ matrix.IMAGE }}' | |
| format: 'sarif' | |
| ignore-unfixed: true | |
| vuln-type: 'os,library' | |
| severity: 'CRITICAL,HIGH' | |
| output: 'trivy-results-${{ env.SANITIZED_IMAGE_NAME }}.sarif' | |
| timeout: 30m0s | |
| - name: Upload Trivy scan results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@v3 | |
| if: always() | |
| with: | |
| sarif_file: 'trivy-results-${{ env.SANITIZED_IMAGE_NAME }}.sarif' |