Repository navigation

CVE scan (GHCR image) #11

	# Weekly trivy scan of the published image → SARIF to the Security tab.
	# Report-only: never fails the run.
	name: CVE scan (GHCR image)

	on:
	schedule:
	- cron: "0 6 * * 1" # Mondays 06:00 UTC
	workflow_dispatch:

	env:
	REGISTRY: ghcr.io

	jobs:
	scan:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	packages: read
	security-events: write

	steps:
	- name: Log in to the Container registry
	uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
	with:
	registry: ${{ env.REGISTRY }}
	username: ${{ github.actor }}
	password: ${{ secrets.GITHUB_TOKEN }}

	- name: Trivy scan
	uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
	with:
	image-ref: ${{ env.REGISTRY }}/${{ github.repository }}:main
	format: sarif
	output: trivy.sarif
	severity: CRITICAL,HIGH
	exit-code: "0"
	# Drop CVEs with no upstream fix — the scratch Rust image carries
	# almost no userland; self-heals once a fix ships (the CVE resurfaces).
	ignore-unfixed: true
	env:
	TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db

	- name: Upload SARIF to Security tab
	uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
	if: always()
	with:
	sarif_file: trivy.sarif