Дмитрий
50 lines
1.5 KiB
YAML
50 lines
1.5 KiB
YAML
name: Trivy — Docker image scan
|
||
|
||
# ОТКЛЮЧЕНО до Sprint 7 (YC Docker pipeline).
|
||
# Для активации:
|
||
# 1. Убрать `if: false` у job trivy
|
||
# 2. Добавить GitHub secret YC_REGISTRY (полный адрес, напр. cr.yandex/crp.../liderra)
|
||
# 3. Убедиться, что CI job собирает образ перед этим workflow
|
||
# См. roadmap Sprint 7 «YC infrastructure setup».
|
||
|
||
on:
|
||
push:
|
||
branches: [main]
|
||
paths:
|
||
- 'Dockerfile'
|
||
- 'docker-compose*.yml'
|
||
- '.github/workflows/trivy.yml'
|
||
- 'trivy.yaml'
|
||
schedule:
|
||
- cron: '0 10 * * 1' # каждый понедельник 10:00 UTC
|
||
|
||
permissions:
|
||
contents: read
|
||
security-events: write
|
||
|
||
jobs:
|
||
trivy:
|
||
runs-on: ubuntu-latest
|
||
if: false # TODO Sprint 7: убрать после настройки Docker pipeline
|
||
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
|
||
- name: Run Trivy image scan
|
||
uses: aquasecurity/trivy-action@0.30.0
|
||
with:
|
||
image-ref: '${{ secrets.YC_REGISTRY }}:${{ github.sha }}'
|
||
format: 'sarif'
|
||
output: 'trivy-results.sarif'
|
||
severity: 'CRITICAL,HIGH'
|
||
exit-code: '1'
|
||
ignore-unfixed: true
|
||
vuln-type: 'os,library'
|
||
trivy-config: 'trivy.yaml'
|
||
|
||
- name: Upload Trivy SARIF to GitHub Security tab
|
||
uses: github/codeql-action/upload-sarif@v3
|
||
if: always()
|
||
with:
|
||
sarif_file: trivy-results.sarif
|