trivy-scan.yml

name: Trivy

on:
  workflow_dispatch:
  schedule:
    - cron:  '30 18 * * *'    # 00:00 in LK time (GMT+5:30)

jobs:
  ubuntu_build:
    name: Build on Ubuntu
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4
      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          distribution: 'temurin'
          java-version: '17.0.7'

      - name: Initialize sub-modules
        run: git submodule update --init
      - name: Cache Gradle packages
        uses: actions/cache@v4
        with:
          path: ~/.gradle/caches
          key: ${{ runner.os }}-gradle-${{ github.sha }}
          restore-keys: ${{ runner.os }}-gradle
      - name: Build with Gradle
        run: |
          export DISPLAY=':99.0'
          /usr/bin/Xvfb :99 -screen 0 1024x768x24 > /dev/null 2>&1 &
          ./gradlew build -x check -x test --max-workers=2 --scan --no-daemon
          find ~/.gradle/caches/ -name "*.lock" -type f -delete
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'rootfs'
          scan-ref: '/github/workspace/distribution/zip/jballerina-tools'
          format: 'table'
          timeout: '10m0s'
          exit-code: '1'