github-shared-workflows/.github/workflows/docker-scanner.yml at master · clouddrove/github-shared-workflows · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
---
name: 🐳 docker-scanner

on:
  workflow_call:
    inputs:
      severity:
        required: true
        type: string
      dockerfile-path:
        required: false
        type: string
        default: ./Dockerfile
        description: dockerfile path
      security-upload:
        default: false
        type: string
        description: "Enable image scan report upload to GitHub Security tab."
      block_action:
        default: false
        type: string
        description: "Block github action if severity detected."

jobs:
  build-image:
    name: 🔧 Build Images
    runs-on: ubuntu-latest

    steps:

      - name: 📦 Checkout Repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

      - name: 🛠️ Set up QEMU
        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0

      - name: 🛠️ Set up Docker Buildx
        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0

      - name: 🏗️ Build and export to Docker
        id: build-id
        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
        with:
          push: false
          load: true  #  Export to Docker Engine rather than pushing to a registry
          tags: ${{ github.sha }}
          platforms: linux/amd64
          file: ${{inputs.dockerfile-path}}

      - name: 🔍 Docker Scan with trivy (non-blocking)
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        env:
          tags: ${{ github.sha }}
        with:
          image-ref: ${{ github.sha }}
          exit-code: 0
          format: 'sarif'
          output: 'trivy-results.sarif'

      - name: ☁️ Upload Trivy scan results to GitHub Security tab
        if: ${{ inputs.security-upload == 'true' }}
        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
        with:
          sarif_file: 'trivy-results.sarif'

      - name: 🚨 Docker Scan with trivy (blocking)
        if: ${{ inputs.block_action == true }}
        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
        with:
          image-ref: ${{ github.sha }}
          format: table
          exit-code: 1
          severity: ${{ inputs.severity}}
...