template-trivy-scan.yml

name: Reusable workflow to run trivy scan

on:
  workflow_call:
    inputs:
      runs-on:
        required: true
        type: string
      scan-type:
        required: true
        type: string
      format:
        required: true
        type: string
      output:
        required: false
        type: string
        default: trivy.sarif
      image-ref:
        required: false
        type: string
        default: ""
      severity:
        required: false
        type: string
        default: "CRITICAL,HIGH"
      exit-code:
        required: true
        type: number
      publish:
        required: true
        type: boolean

jobs:
  trivy-scan:
    name: Trivy - ${{ inputs.runs-on }} - ${{ inputs.scan-type }} ${{ inputs.image-ref }}
    runs-on: ${{ inputs.runs-on }}
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

      - name: Run Trivy
        uses: aquasecurity/trivy-action@915b19bbe73b92a6cf82a1bc12b087c9a19a5fe2 # v0.28.0
        env:
          TRIVY_DB_REPOSITORY: ghcr.io/kedacore/trivy-db
        with:
          scan-type: ${{ inputs.scan-type }}
          image-ref: ${{ inputs.image-ref }}
          ignore-unfixed: false
          format: ${{ inputs.format }}
          output: ${{ inputs.output }}
          exit-code: ${{ inputs.exit-code }}
          severity: ${{ inputs.severity }}
          trivy-config: trivy.yml

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        if: ${{ inputs.publish }}
        with:
          sarif_file: ${{ inputs.output }}