From 1f3974c0a7c96ce4059d2ea3d67667757004d4bf Mon Sep 17 00:00:00 2001
From: Taylor Jackle Spriggs <74561858+tjs-intel@users.noreply.github.com>
Date: Fri, 10 May 2024 10:21:41 -0600
Subject: [PATCH] trivy scan gha workflow (#457)
---
.github/workflows/security.yml | 19 ++++++++++++++++++
trivy.yaml | 35 ++++++++++++++++++++++++++++++++++
2 files changed, 54 insertions(+)
create mode 100644 .github/workflows/security.yml
create mode 100644 trivy.yaml
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
new file mode 100644
index 00000000..f728ef8a
--- /dev/null
+++ b/.github/workflows/security.yml
@@ -0,0 +1,19 @@
+name: security checks
+permissions: read-all
+run-name: Security checks for ${{ github.repository }}@${{ github.ref }}
+on:
+ push: {}
+ schedule:
+ - cron: "0 8,16 * * *"
+jobs:
+ trivy-scan-fs:
+ runs-on: ubuntu-latest
+ steps:
+ - name: Check out repository code
+ uses: actions/checkout@v4
+ - name: Run Trivy
+ uses: aquasecurity/trivy-action@master
+ with:
+ scan-type: fs
+ scan-ref: .
+ trivy-config: trivy.yaml
diff --git a/trivy.yaml b/trivy.yaml
new file mode 100644
index 00000000..58349427
--- /dev/null
+++ b/trivy.yaml
@@ -0,0 +1,35 @@
+db:
+ download-only: false
+ light: false
+ no-progress: true
+ repository: ghcr.io/aquasecurity/trivy-db
+ skip-update: false
+debug: false
+exit-code: 1
+format: table
+image:
+ removed-pkgs: false
+insecure: false
+license:
+ forbidden: []
+ full: false
+ ignored: []
+ notice: []
+ permissive: []
+ reciprocal: []
+ restricted: []
+ unencumbered: []
+list-all-pkgs: false
+quiet: false
+scan:
+ file-patterns: []
+ scanners:
+ - vuln
+ - secret
+ skip-dirs: []
+ skip-files: []
+severity: LOW,MEDIUM,HIGH,CRITICAL
+timeout: 10m0s
+vulnerability:
+ ignore-unfixed: false
+ type: os,library