diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 5505b8c..76c30c1 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -130,41 +130,3 @@ jobs: cache-from: type=gha cache-to: type=gha,mode=max platforms: linux/amd64,linux/arm64 - - trivy-scan: - needs: build-and-push - runs-on: ubuntu-latest - permissions: - packages: read - security-events: write - - steps: - - name: Normalize image name - run: echo "IMAGE_NAME=${GITHUB_REPOSITORY,,}" >> $GITHUB_ENV - - - name: Log in to GitHub Container Registry - uses: docker/login-action@v3 - with: - registry: ${{ env.REGISTRY }} - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - - name: Scan image for vulnerabilities - uses: aquasecurity/trivy-action@0.35.0 - with: - image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest - format: sarif - output: trivy-results.sarif - severity: CRITICAL,HIGH - exit-code: '1' - ignore-unfixed: true - vuln-type: os,library - scanners: vuln - limit-severities-for-sarif: true - - - name: Upload Trivy scan results to GitHub Security - if: always() - uses: github/codeql-action/upload-sarif@v4 - with: - sarif_file: trivy-results.sarif - category: trivy