From 486b33b3d4a9dfa080d745e2ef3911b3ad432c4b Mon Sep 17 00:00:00 2001 From: Paolo Asperti Date: Wed, 13 Dec 2023 22:58:49 +0100 Subject: [PATCH] vulnscan prima di pushare --- .gitea/workflows/build_and_push.yaml | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/.gitea/workflows/build_and_push.yaml b/.gitea/workflows/build_and_push.yaml index 36a9748..245477c 100644 --- a/.gitea/workflows/build_and_push.yaml +++ b/.gitea/workflows/build_and_push.yaml @@ -31,6 +31,28 @@ jobs: username: ${{ secrets.REGISTRY_USER }} password: ${{ secrets.REGISTRY_TOKEN }} + - name: Build and publish + uses: docker/build-push-action@v4 + with: + context: . + file: ./Dockerfile + platforms: | + linux/amd64 +# linux/arm64 + load: true + tags: git.libreschool.org/libreschool/libreschool.org:latest + + - name: Run Trivy vulnerability scanner + id: scan + uses: aquasecurity/trivy-action@master + with: + image-ref: "git.libreschool.org/libreschool/libreschool.org:latest" + format: "json" + output: "trivy-results.json" + + - name: check output + run: if [ $(jq '.Results[0].Vulnerabilities|length' trivy-results.json) -ne "0" ] ; then exit 1 ; fi + - name: Build and publish uses: docker/build-push-action@v4 with: