revert: move container scan back to the container build step

Signed-off-by: Mark Sagi-Kazar <mark.sagikazar@gmail.com>
This commit is contained in:
Mark Sagi-Kazar 2022-04-22 14:21:28 +02:00
parent b8f2186593
commit a9fb4ae7ef
No known key found for this signature in database
GPG key ID: 31AB0439F4C5C90E

View file

@ -17,8 +17,6 @@ jobs:
variant:
- alpine
- distroless
outputs:
version: ${{ steps.details.outputs.version }}
steps:
- name: Checkout
@ -103,38 +101,16 @@ jobs:
org.opencontainers.image.licenses=${{ github.event.repository.license.spdx_id }}
org.opencontainers.image.documentation=https://dexidp.io/docs/
container-scan:
name: Container scan
runs-on: ubuntu-latest
needs: container-images
if: github.event_name == 'push'
strategy:
matrix:
variant:
- alpine
- distroless
steps:
# Workaround for lack of matrix output support
- name: Calculate container image details
id: details
run: |
VERSION="${{ needs.container-images.outputs.version }}"
if [[ "${{ matrix.variant }}" != "alpine" ]]; then
VERSION="${VERSION}-${{ matrix.variant }}"
fi
echo ::set-output name=version::${VERSION}
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@0.2.5
with:
image-ref: "ghcr.io/dexidp/dex:${{ steps.details.outputs.version }}"
format: "sarif"
output: "trivy-results.sarif"
if: github.event_name == 'push'
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v1
with:
sarif_file: "trivy-results.sarif"
if: github.event_name == 'push'