security.yml

name: Security

on:
  push:
    branches:
      - main
  pull_request:

  # Allows you to run this workflow manually from the Actions tab
  workflow_dispatch:

  # Schedule in case of no code changes
  schedule:
      - cron: '30 0 1,15 * *'

permissions:  # added using https://github.com/step-security/secure-repo
  contents: read

jobs:
  trivy:
    name: Trivy scanner
    continue-on-error: true
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
      pull-requests: read
      actions: write

    if: (github.actor != 'dependabot[bot]')
    steps:
      - 
        uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09
        with:
          disable-sudo: true
          disable-telemetry: true
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            ghcr.io:443
            github.com:443
            pkg-containers.githubusercontent.com:443
      -
        name: Cancel previous workflows
        uses: styfle/cancel-workflow-action@b173b6ec0100793626c2d9e6b90435061f4fc3e5 # 0.11.0
        with:
          access_token: ${{ secrets.GITHUB_TOKEN }}
      -
        uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
      -
        name: Run Trivy vulnerability scanner in repo mode
        uses: aquasecurity/trivy-action@41f05d9ecffa2ed3f1580af306000f734b733e54 # master
        with:
          scan-type: 'fs'
          ignore-unfixed: true
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL'
      -
        name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@00e563ead9f72a8461b24876bee2d0c2e8bd2ee8 # v2.21.5
        with:
          sarif_file: 'trivy-results.sarif'