From ba6698dae0934c56160d224bd498f94c781eb9b6 Mon Sep 17 00:00:00 2001
From: Kamen Mladenov <kamen@syndamia.com>
Date: Sun, 25 Aug 2024 21:00:53 +0300
Subject: Dev (#27)

* fix(README): Updated all TODO anchors (#25)

* feat(ci/cd): Move Trivy testing into ci, from cd

* fix(ci): Typo in needs value

* fix(ci): docker build bad arguments

* fix(ci): Download dev build artifacts in trivy dev test

* fix(ci): Fixed trivy dev test build artifacts path
---
 .github/workflows/ci.yml | 62 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 62 insertions(+)

(limited to '.github/workflows/ci.yml')

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5cf4541..9c6d707 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -60,3 +60,65 @@ jobs:
         with:
           name: dev-build-files
           path: ./build
+
+  Trivy-dev-test:
+    runs-on: ubuntu-latest
+    needs: Build
+    permissions:
+      security-events: write
+    steps:
+      - uses: actions/download-artifact@v3
+        with:
+          name: source-code
+          path: .
+      - uses: actions/download-artifact@v3
+        with:
+          name: dev-build-files
+          path: ./build
+      - uses: docker/setup-buildx-action@v1
+      - run: docker build -t pico-web-dev -f ./docker/dev/Dockerfile .
+
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: pico-web-dev
+          format: 'sarif'
+          output: 'trivy-results.sarif'
+          exit-code: 0
+          ignore-unfixed: true
+
+      - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: 'trivy-results.sarif'
+          sha: ${{ github.sha }}
+          ref: ${{ github.ref }}
+
+  Trivy-prod-test:
+    runs-on: ubuntu-latest
+    needs: Build
+    permissions:
+      security-events: write
+    steps:
+      - uses: actions/download-artifact@v3
+        with:
+          name: source-code
+          path: .
+      - uses: docker/setup-buildx-action@v1
+      - run: docker build -t pico-web -f ./docker/prod/Dockerfile .
+
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: pico-web
+          format: 'sarif'
+          output: 'trivy-results.sarif'
+          exit-code: 0
+          ignore-unfixed: true
+
+      - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v2
+        with:
+          sarif_file: 'trivy-results.sarif'
+          sha: ${{ github.sha }}
+          ref: ${{ github.ref }}
-- 
cgit v1.2.3