trivy.yaml

name: Trivy

on:
  pull_request:
    branches:
      - master
  push:
    branches:
      - master

jobs:
  licenses:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # Trivy needs a populated Go module cache to detect Go module licenses.
      - uses: actions/setup-go@v5
        with: { go-version: stable }
      - run: go mod download

      # Login to the GitHub Packages registry to avoid rate limiting.
      # - https://aquasecurity.github.io/trivy/v0.55/docs/references/troubleshooting/#github-rate-limiting
      # - https://github.com/aquasecurity/trivy/issues/7580
      # - https://github.com/aquasecurity/trivy-action/issues/389
      # - https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry
      # - https://docs.github.com/en/packages/managing-github-packages-using-github-actions-workflows/publishing-and-installing-a-package-with-github-actions
      - name: Login to GitHub Packages
        run: >
          docker login ghcr.io
          --username '${{ github.actor }}'
          --password-stdin <<< '${{ secrets.GITHUB_TOKEN }}'

      # Report success only when detected licenses are listed in [/trivy.yaml].
      # The "aquasecurity/trivy-action" action cannot access the Go module cache,
      # so run Trivy from an image with the cache and local configuration mounted.
      # - https://github.com/aquasecurity/trivy-action/issues/219
      # - https://github.com/aquasecurity/trivy/pkgs/container/trivy
      - name: Scan licenses
        run: >
          docker run
          --env 'DOCKER_CONFIG=/docker' --volume "${HOME}/.docker:/docker"
          --env 'GOPATH=/go' --volume "$(go env GOPATH):/go"
          --workdir '/mnt' --volume "$(pwd):/mnt"
          'ghcr.io/aquasecurity/trivy:latest'
          filesystem --debug --exit-code=1 --scanners=license .

  vulnerabilities:
    if: ${{ github.repository == 'CrunchyData/postgres-operator' }}

    permissions:
      # for github/codeql-action/upload-sarif to upload SARIF results
      security-events: write 

    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      # Run trivy and log detected and fixed vulnerabilities
      # This report should match the uploaded code scan report below
      # and is a convenience/redundant effort for those who prefer to
      # read logs and/or if anything goes wrong with the upload.
      - name: Log all detected vulnerabilities
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: filesystem
          hide-progress: true
          ignore-unfixed: true
          scanners: secret,vuln

      # Upload actionable results to the GitHub Security tab.
      # Pull request checks fail according to repository settings.
      # - https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/uploading-a-sarif-file-to-github
      # - https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning
      - name: Report actionable vulnerabilities
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: filesystem
          ignore-unfixed: true
          format: 'sarif'
          output: 'trivy-results.sarif'
          scanners: secret,vuln

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'