name: Vulnerability Scan on: schedule: - cron: "0 14 * * *" jobs: scan: name: Daily Vulnerability Scan runs-on: ubuntu-latest container: image: catthehacker/ubuntu:act-latest steps: - name: Login to registry uses: docker/login-action@v3 with: registry: git.libreschool.org username: ${{ secrets.REGISTRY_USER }} password: ${{ secrets.REGISTRY_TOKEN }} - name: Pull docker image run: docker pull git.libreschool.org/bglug/bglug.it:latest - name: Run Trivy vulnerability scanner id: scan uses: aquasecurity/trivy-action@master with: image-ref: "git.libreschool.org/bglug/bglug.it:latest" format: "json" output: "trivy-results.json" # if some vulnerability is found, we fail - name: check output run: if [ $(jq '.Results[0].Vulnerabilities|length' trivy-results.json) -ne "0" ] ; then exit 1 ; fi - name: send mattermost notification if: failure() uses: mattermost/action-mattermost-notify@master with: MATTERMOST_WEBHOOK_URL: ${{ secrets.MM_WEBHOOK_URL }} TEXT: | Found **${{ steps.vulncount.outputs.VULNCOUNT }}** vulnerabilities in `${{ github.repository }}` MATTERMOST_ICON: https://cdn3.iconfinder.com/data/icons/system-basic-vol-4-1/20/icon-note-attention-alt3-512.png