Skip to content

Hardening: accessibility tail (L23) and observable logging (H44's logging half) #993

Hardening: accessibility tail (L23) and observable logging (H44's logging half)

Hardening: accessibility tail (L23) and observable logging (H44's logging half) #993

Workflow file for this run

name: Docker Image Security Scan
on:
push:
branches: [ main, master, develop ]
pull_request:
branches: [ main, master, develop ]
schedule:
# Run every Monday at 7:00 AM UTC
- cron: '0 7 * * 1'
# Least privilege (audit H37): this job builds an image and uploads a SARIF
# report, nothing more. Without this block it inherited the repository's default
# GITHUB_TOKEN permissions, which is a poor trade for a job that runs a
# third-party scanner action.
permissions:
contents: read
security-events: write
jobs:
scan-docker-image:
name: Scan Docker Image for Vulnerabilities
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Build Docker image
run: docker build -t retrogemini:latest .
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
with:
image-ref: 'retrogemini:latest'
format: 'sarif'
output: 'trivy-results.sarif'
trivyignores: '.trivyignore'
- name: Upload Trivy results to GitHub Security tab
uses: github/codeql-action/upload-sarif@42947a340483f03ba47bb1a039b2c519aab3df85 # v3.37.8
with:
sarif_file: 'trivy-results.sarif'
# Continue even if upload fails (e.g., if Advanced Security is not enabled)
continue-on-error: true
- name: Run Trivy vulnerability scanner (table output)
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
with:
image-ref: 'retrogemini:latest'
format: 'table'
exit-code: '1'
ignore-unfixed: true
vuln-type: 'os,library'
severity: 'CRITICAL,HIGH'
trivyignores: '.trivyignore'