ci: wait for container images with container scan

Signed-off-by: Mark Sagi-Kazar <mark.sagikazar@gmail.com>
This commit is contained in:
Mark Sagi-Kazar 2022-04-14 12:50:12 +02:00
parent 0f5481a00a
commit aa35fa6580
No known key found for this signature in database
GPG key ID: 31AB0439F4C5C90E

View file

@ -18,6 +18,8 @@ jobs:
- linux/amd64 - linux/amd64
- linux/arm/v7 - linux/arm/v7
- linux/arm64 - linux/arm64
outputs:
version: ${{ steps.details.outputs.version }}
steps: steps:
- name: Checkout - name: Checkout
@ -96,17 +98,22 @@ jobs:
org.opencontainers.image.licenses=${{ github.event.repository.license.spdx_id }} org.opencontainers.image.licenses=${{ github.event.repository.license.spdx_id }}
org.opencontainers.image.documentation=https://dexidp.io/docs/ org.opencontainers.image.documentation=https://dexidp.io/docs/
container-scan:
name: Container scan
runs-on: ubuntu-latest
needs: container-images
if: github.event_name == 'push'
steps:
- name: Run Trivy vulnerability scanner - name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@0.2.3 uses: aquasecurity/trivy-action@0.2.3
with: with:
image-ref: "ghcr.io/dexidp/dex:${{ steps.details.outputs.version }}" image-ref: "ghcr.io/dexidp/dex:${{ needs.container-images.outputs.version }}"
format: "template" format: "template"
template: "@/contrib/sarif.tpl" template: "@/contrib/sarif.tpl"
output: "trivy-results.sarif" output: "trivy-results.sarif"
if: github.event_name == 'push'
- name: Upload Trivy scan results to GitHub Security tab - name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v1 uses: github/codeql-action/upload-sarif@v1
with: with:
sarif_file: "trivy-results.sarif" sarif_file: "trivy-results.sarif"
if: github.event_name == 'push'