Security #1127

	name: Security

	on:
	push:
	branches:
	- main
	pull_request:

	# Allows you to run this workflow manually from the Actions tab
	workflow_dispatch:

	# Schedule in case of no code changes
	schedule:
	- cron: '30 0 1,15 * *'

	permissions: # added using https://github.com/step-security/secure-repo
	contents: read

	jobs:
	trivy:
	name: Trivy scanner
	continue-on-error: true
	runs-on: ubuntu-latest
	permissions:
	contents: read
	security-events: write
	pull-requests: read
	actions: write

	if: (github.actor != 'dependabot[bot]')
	steps:
	-
	uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142
	with:
	disable-sudo: true
	disable-telemetry: true
	egress-policy: block
	allowed-endpoints: >
	api.github.com:443
	ghcr.io:443
	github.com:443
	pkg-containers.githubusercontent.com:443
	-
	name: Cancel previous workflows
	uses: styfle/cancel-workflow-action@01ce38bf961b4e243a6342cbade0dbc8ba3f0432 # 0.12.0
	with:
	access_token: ${{ secrets.GITHUB_TOKEN }}
	-
	uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
	-
	name: Run Trivy vulnerability scanner in repo mode
	uses: aquasecurity/trivy-action@d710430a6722f083d3b36b8339ff66b32f22ee55 # master
	with:
	scan-type: 'fs'
	ignore-unfixed: true
	format: 'sarif'
	output: 'trivy-results.sarif'
	severity: 'CRITICAL'
	-
	name: Upload Trivy scan results to GitHub Security tab
	uses: github/codeql-action/upload-sarif@ccf74c947955fd1cf117aef6a0e4e66191ef6f61 # v3.25.4
	with:
	sarif_file: 'trivy-results.sarif'

Provide feedback