scan-images.yml

name: Scan image

on:
  push:
    branches:
      - main
  pull_request:
  schedule:
    # Every Thursday at 7:29 PM
    - cron: 29 19 * * 4
  workflow_dispatch:

jobs:
  trivy-edge:
    name: ${{ matrix.image }}
    runs-on: ubuntu-20.04
    env:
      TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
      TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db:1
    continue-on-error: true
    strategy:
      fail-fast: false
      matrix:
        # TODO: Get this list programmatically
        image:
          - 'openchallenges-apex'
          - 'openchallenges-api-gateway'
          - 'openchallenges-challenge-service'
          - 'openchallenges-zipkin'

    steps:
      - name: Login to GitHub Container Registry
        uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Pull the image
        run: |
          docker pull ghcr.io/sage-bionetworks/${{ matrix.image }}:edge

      # Deliberately chosen master here to keep up-to-date.
      - name: Run Trivy vulnerability scanner for any major issues
        uses: aquasecurity/trivy-action@0.28.0
        with:
          image-ref: ghcr.io/sage-bionetworks/${{ matrix.image }}:edge
          ignore-unfixed: true
          severity: 'CRITICAL,HIGH'
          limit-severities-for-sarif: true
          format: template
          template: '@/contrib/sarif.tpl'
          output: trivy-results-${{ matrix.image }}-edge.sarif

      # Show all detected issues.
      # Note this will show a lot more, including major un-fixed ones.
      - name: Run Trivy vulnerability scanner for local output
        uses: aquasecurity/trivy-action@0.28.0
        with:
          image-ref: ghcr.io/sage-bionetworks/${{ matrix.image }}:edge
          format: table

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: trivy-results-${{ matrix.image }}-edge.sarif
          category: trivy-image-${{ matrix.image }}:edge
          wait-for-processing: true

      - name: Detain results for debug if needed
        uses: actions/upload-artifact@v3
        with:
          name: trivy-results-${{ matrix.image }}-edge.sarif
          path: trivy-results-${{ matrix.image }}-edge.sarif
          if-no-files-found: error