Use NIGHTLY PAT to trigger image dep update (#4225) #869

	on:
	push:
	branches:
	- main
	pull_request:

	env:
	TRIVY_VERSION: 0.47.0

	name: License scan

	jobs:
	license:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- name: Setup Go
	uses: actions/setup-go@v4
	with:
	go-version: '^1.20.0'

	- name: Install Go deps
	run: go mod download

	- name: Setup Node.js
	uses: actions/setup-node@v4
	with:
	cache: yarn
	cache-dependency-path: web/yarn.lock

	- name: Install Node.js deps
	working-directory: web
	run: yarn install

	- name: Install trivy
	run: \|
	wget "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.deb"
	sudo dpkg -i "trivy_${TRIVY_VERSION}_Linux-64bit.deb"

	- name: Create license report artifact
	run: trivy fs --scanners license --skip-dirs ".github" --skip-files "package-lock.json,bin/scan-images/package-lock.json" . \| tee license-report.txt

	- name: Upload license report artifact
	uses: actions/upload-artifact@v3
	with:
	name: license-report
	path: license-report.txt

	- name: Check for unknown licenses
	run: \|
	trivy fs --scanners license --skip-dirs ".github" --skip-files "package-lock.json,bin/scan-images/package-lock.json" --exit-code 1 --severity UNKNOWN . \|\| echo "::warning::Unknown licenses found, please verify"

	- name: Check for forbidden licenses and fail
	run: trivy fs --scanners license --skip-dirs ".github" --skip-files "package-lock.json,bin/scan-images/package-lock.json" --exit-code 1 --severity CRITICAL,HIGH .

Provide feedback