also mirror checks

opencrvs · Oct 28, 2024 · 5c8e98f · 5c8e98f
1 parent 46a5e5e
commit 5c8e98f
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 2 deletions.
diff --git a/.github/workflows/mirror-trivy-db.yml b/.github/workflows/mirror-trivy-db.yml
@@ -73,3 +73,6 @@ jobs:
 
       - name: Mirror trivy-java-db to GHCR
         run: ./mirror-image.sh docker://ghcr.io/aquasecurity/trivy-java-db:1 docker://ghcr.io/${{ github.repository_owner }}/trivy-java-db:1 ${{ env.RETRIES }}
+
+      - name: Mirror trivy-checks to GHCR
+        run: ./mirror-image.sh docker://ghcr.io/aquasecurity/trivy-checks:1 docker://ghcr.io/${{ github.repository_owner }}/trivy-checks:1 ${{ env.RETRIES }}
diff --git a/.github/workflows/security-scans.yml b/.github/workflows/security-scans.yml
@@ -63,6 +63,7 @@ jobs:
         env:
           TRIVY_DB_REPOSITORY: 'ghcr.io/opencrvs/trivy-db'
           TRIVY_JAVA_DB_REPOSITORY: 'ghcr.io/opencrvs/trivy-java-db'
+          TRIVY_POLICIESBUNDLE_REPOSITORY: 'ghcr.io/opencrvs/trivy-checks'
         with:
           scan-type: 'fs'
           scan-ref: 'branch'

diff --git a/trivy.yaml b/trivy.yaml
@@ -21,8 +21,7 @@ scan:
     - usr/local/share/.cache/yarn/v6/
     - home/node/.cache/yarn/v6
   skip-files:
-    - Dockerfile.dockerignore
-    - packages/*/Dockerfile.dockerignore
+    - '**/*.dockerignore'
   scanners:
     - vuln
     - misconfig