Merge pull request #9 from rocky-linux/feature/scan

Upload scan results to github security tab
This commit is contained in:
Neil Hanlon 2022-03-15 08:45:06 -04:00 committed by GitHub
commit 1d71d04740
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23

View File

@ -6,7 +6,7 @@ on:
jobs: jobs:
scan: scan:
name: Scan name: Scan for Security Vulnerabilities
runs-on: ubuntu-18.04 runs-on: ubuntu-18.04
steps: steps:
- name: Checkout code - name: Checkout code
@ -16,8 +16,15 @@ jobs:
uses: aquasecurity/trivy-action@master uses: aquasecurity/trivy-action@master
with: with:
image-ref: 'docker.io/library/rockylinux:8' image-ref: 'docker.io/library/rockylinux:8'
format: 'table' format: 'sarif'
output: 'trivy-results.sarif'
exit-code: '1' exit-code: '1'
ignore-unfixed: true ignore-unfixed: true
vuln-type: 'os,library' vuln-type: 'os,library'
severity: 'CRITICAL,HIGH' severity: 'CRITICAL,HIGH'
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v1
if: always()
with:
sarif_file: 'trivy-results.sarif'