Registry Security Scan #3
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Registry Security Scan | |
| on: | |
| schedule: | |
| - cron: '0 4 * * 1' # Every Monday 04:00 UTC | |
| workflow_dispatch: | |
| jobs: | |
| scan-latest: | |
| name: Scan Latest Release Image | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Run Trivy on latest image | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: websoft9dev/websoft9:latest | |
| format: sarif | |
| output: trivy-latest.sarif | |
| exit-code: '1' | |
| severity: CRITICAL,HIGH | |
| timeout: 15m | |
| - name: Upload results to GitHub Security | |
| uses: github/codeql-action/upload-sarif@v4 | |
| if: always() | |
| with: | |
| sarif_file: trivy-latest.sarif | |
| scan-dev: | |
| name: Scan Dev Image | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Run Trivy on dev image | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: websoft9dev/websoft9:dev | |
| format: sarif | |
| output: trivy-dev.sarif | |
| exit-code: '0' # Don't block on dev — report only | |
| severity: CRITICAL,HIGH | |
| timeout: 15m | |
| - name: Upload results to GitHub Security | |
| uses: github/codeql-action/upload-sarif@v4 | |
| if: always() | |
| with: | |
| sarif_file: trivy-dev.sarif |