Hardening: accessibility tail (L23) and observable logging (H44's logging half) #993
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Docker Image Security Scan | |
| on: | |
| push: | |
| branches: [ main, master, develop ] | |
| pull_request: | |
| branches: [ main, master, develop ] | |
| schedule: | |
| # Run every Monday at 7:00 AM UTC | |
| - cron: '0 7 * * 1' | |
| # Least privilege (audit H37): this job builds an image and uploads a SARIF | |
| # report, nothing more. Without this block it inherited the repository's default | |
| # GITHUB_TOKEN permissions, which is a poor trade for a job that runs a | |
| # third-party scanner action. | |
| permissions: | |
| contents: read | |
| security-events: write | |
| jobs: | |
| scan-docker-image: | |
| name: Scan Docker Image for Vulnerabilities | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Build Docker image | |
| run: docker build -t retrogemini:latest . | |
| - name: Run Trivy vulnerability scanner | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| image-ref: 'retrogemini:latest' | |
| format: 'sarif' | |
| output: 'trivy-results.sarif' | |
| trivyignores: '.trivyignore' | |
| - name: Upload Trivy results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@42947a340483f03ba47bb1a039b2c519aab3df85 # v3.37.8 | |
| with: | |
| sarif_file: 'trivy-results.sarif' | |
| # Continue even if upload fails (e.g., if Advanced Security is not enabled) | |
| continue-on-error: true | |
| - name: Run Trivy vulnerability scanner (table output) | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| image-ref: 'retrogemini:latest' | |
| format: 'table' | |
| exit-code: '1' | |
| ignore-unfixed: true | |
| vuln-type: 'os,library' | |
| severity: 'CRITICAL,HIGH' | |
| trivyignores: '.trivyignore' |