do not merge, testing ci #4428

	name: "Trivy secret scanning"
	on:
	push:
	branches:
	- "**"
	pull_request:
	jobs:
	scan:
	name: "Trivy scan in fs mode"
	runs-on: ubuntu-22.04
	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Run Trivy vulnerability scanner in fs mode
	uses: aquasecurity/trivy-action@0.21.0
	with:
	scan-type: 'fs'
	scan-ref: '.'
	scanners: 'secret'
	exit-code: '1'
	env:
	TRIVY_SECRET_CONFIG: 'trivy/trivy-secret.yaml'
	send-alert:
	name: "Send alert in case secret is detected"
	if: ${{ failure() }}
	needs: scan
	runs-on: ubuntu-22.04
	steps:
	- name: Run curl to the Slack webhook
	run: \|
	curl \
	--request POST \
	--header "Content-Type: application/json" \
	--data '{"text": ":warning::warning::warning: SECRET LEAK ALERT :warning::warning::warning:\n\nTrivy detected a secret pushed to the Kuberpult repository. Navigate to the <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}\|failing run> page to inspect the alert.\n\nIf the alert is a false positive, then make sure to add an allow rule for it under <https://github.com/freiheit-com/kuberpult/blob/main/trivy/trivy-secret.yaml\|`trivy/trivy-secret.yaml`>."}' \
	--fail \
	${{ secrets.SLACK_WEBHOOK_SRE_ALERTS_INTERNAL }}

Provide feedback