trivy-security-scan.yml

##
# This action runs trivy container and repository vulnerability
# scanner for docker images and cargo packages.
##

name: trivy-security-scan

on:
  repository_dispatch:
    types: [trivy-scan-dispatch]

jobs:
  wait-for-image:
    runs-on: ubuntu-latest
    outputs:
      image-available: ${{ steps.check-image.outputs.available }}
    steps:
      - name: Check Docker image availability with retry
        run: |
          image="${{ github.event.client_payload.image }}"
          timeout=900 # Timeout in seconds (15 minutes)
          interval=300 # Interval between retries in seconds (5 minutes)
          retry_limit=5 # Number of retries
          attempt=0

          while ! docker pull $image; do
            attempt=$((attempt + 1))
            if [ "$attempt" -gt "$retry_limit" ]; then
              echo "Image $image is not available after $retry_limit attempts."
              echo "::set-output name=available::false"
              exit 1
            fi

            echo "Attempt $attempt: Waiting for $image to be available. Retrying in $interval seconds..."
            sleep $interval
          done

          echo "$image is now available."
          echo "::set-output name=available::true"
        shell: bash

  trivy_scan_image:
    needs: wait-for-image
    if: needs.wait-for-image.outputs.image-available == 'true'
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # @v3.1.0

      - name: Run Trivy vulnerability scanner on image
        uses: aquasecurity/trivy-action@d43c1f16c00cfd3978dde6c07f4bbcf9eb6993ca # @v0.16.1
        with:
          image-ref: ${{ github.event.client_payload.image }}
          format: "sarif"
          output: "trivy-results.sarif"
          exit-code: "1"
          ignore-unfixed: true
          vuln-type: "os,library"
          severity: "CRITICAL,HIGH"

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@4759df8df70c5ebe7042c3029bbace20eee13edd # @v2.23.1
        with:
          sarif_file: "trivy-results.sarif"

  trivy_scan_repo:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8 # @v3.1.0

      - name: Run Trivy vulnerability scanner in repo mode
        uses: aquasecurity/trivy-action@d43c1f16c00cfd3978dde6c07f4bbcf9eb6993ca # @v0.16.1
        with:
          scan-type: fs
          ignore-unfixed: true
          format: sarif
          output: trivy-results.sarif
          severity: CRITICAL

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@4759df8df70c5ebe7042c3029bbace20eee13edd # @v2.23.1
        with:
          sarif_file: trivy-results.sarif