trivy_periodic_image_scan.yml

---
#
# This workflow scans the published container images
# for new vulnerabilities daily, publishing findings.
# Findings will be associated with the 'main' branch
# of the repo' in the GitHub Security tab.
#
name: Trivy Periodic Image Scan

on:
  schedule:
    # run daily
    - cron: "0 0 * * *"

jobs:
  to-lower-case:
    runs-on: ubuntu-latest
    steps:
      - name: Ensure image name is lower case
        id: repo_name
        uses: vishalmamidi/lowercase-action@v1
        with:
          string: ghcr.io/${{ github.repository }}:main
    outputs:
      lowercase-repo-name: ${{ steps.repo_name.outputs.lowercase }}

  periodic-scan:
    needs: to-lower-case
    uses: "./.github/workflows/trivy.yml"
    with:
      SOURCE_TYPE: image
      # While GitHub repo's can be mixed (upper and lower) case,
      # Docker images can only be lower case
      IMAGE_NAME: ${{ needs.to-lower-case.outputs.lowercase-repo-name }}
      EXIT_CODE: 1

  # If scan failed, rebuild the image
  update-image:
    needs: periodic-scan
    runs-on: ubuntu-latest
    if: ${{!cancelled() && needs.periodic-scan.outputs.trivy_conclusion == 'failure' }}
    # tag the repo to trigger a new build
    steps:
      - name: Bump version and push tag
        id: tag_version
        uses: mathieudutour/github-tag-action@v6.2
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
...