Merge pull request #2387 from dexidp/trivy-scan
ci: run trivy scan on container image
This commit is contained in:
commit
49e15945a2
1 changed files with 15 additions and 0 deletions
15
.github/workflows/docker.yaml
vendored
15
.github/workflows/docker.yaml
vendored
|
@ -92,3 +92,18 @@ jobs:
|
|||
org.opencontainers.image.revision=${{ github.sha }}
|
||||
org.opencontainers.image.licenses=${{ github.event.repository.license.spdx_id }}
|
||||
org.opencontainers.image.documentation=https://dexidp.io/docs/
|
||||
|
||||
- name: Run Trivy vulnerability scanner
|
||||
uses: aquasecurity/trivy-action@0.2.1
|
||||
with:
|
||||
image-ref: "ghcr.io/dexidp/dex:${{ steps.tags.outputs.version }}"
|
||||
format: "template"
|
||||
template: "@/contrib/sarif.tpl"
|
||||
output: "trivy-results.sarif"
|
||||
if: github.event_name == 'push'
|
||||
|
||||
- name: Upload Trivy scan results to GitHub Security tab
|
||||
uses: github/codeql-action/upload-sarif@v1
|
||||
with:
|
||||
sarif_file: "trivy-results.sarif"
|
||||
if: github.event_name == 'push'
|
||||
|
|
Reference in a new issue