remove trivy I hate it
This commit is contained in:
@@ -130,41 +130,3 @@ jobs:
|
|||||||
cache-from: type=gha
|
cache-from: type=gha
|
||||||
cache-to: type=gha,mode=max
|
cache-to: type=gha,mode=max
|
||||||
platforms: linux/amd64,linux/arm64
|
platforms: linux/amd64,linux/arm64
|
||||||
|
|
||||||
trivy-scan:
|
|
||||||
needs: build-and-push
|
|
||||||
runs-on: ubuntu-latest
|
|
||||||
permissions:
|
|
||||||
packages: read
|
|
||||||
security-events: write
|
|
||||||
|
|
||||||
steps:
|
|
||||||
- name: Normalize image name
|
|
||||||
run: echo "IMAGE_NAME=${GITHUB_REPOSITORY,,}" >> $GITHUB_ENV
|
|
||||||
|
|
||||||
- name: Log in to GitHub Container Registry
|
|
||||||
uses: docker/login-action@v3
|
|
||||||
with:
|
|
||||||
registry: ${{ env.REGISTRY }}
|
|
||||||
username: ${{ github.actor }}
|
|
||||||
password: ${{ secrets.GITHUB_TOKEN }}
|
|
||||||
|
|
||||||
- name: Scan image for vulnerabilities
|
|
||||||
uses: aquasecurity/trivy-action@0.35.0
|
|
||||||
with:
|
|
||||||
image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
|
|
||||||
format: sarif
|
|
||||||
output: trivy-results.sarif
|
|
||||||
severity: CRITICAL,HIGH
|
|
||||||
exit-code: '1'
|
|
||||||
ignore-unfixed: true
|
|
||||||
vuln-type: os,library
|
|
||||||
scanners: vuln
|
|
||||||
limit-severities-for-sarif: true
|
|
||||||
|
|
||||||
- name: Upload Trivy scan results to GitHub Security
|
|
||||||
if: always()
|
|
||||||
uses: github/codeql-action/upload-sarif@v4
|
|
||||||
with:
|
|
||||||
sarif_file: trivy-results.sarif
|
|
||||||
category: trivy
|
|
||||||
|
|||||||
Reference in New Issue
Block a user