name: Vulnerability Scan on: schedule: - cron: "0 14 * * *" jobs: scan: name: Daily Vulnerability Scan runs-on: ubuntu-latest container: image: catthehacker/ubuntu:act-latest steps: - name: Login to registry uses: docker/login-action@v3 with: registry: git.libreschool.org username: ${{ secrets.REGISTRY_USER }} password: ${{ secrets.REGISTRY_TOKEN }} - name: Pull docker image run: docker pull git.libreschool.org/bglug/bglug.it:latest - name: Run Trivy vulnerability scanner id: scan uses: aquasecurity/trivy-action@master with: image-ref: "git.libreschool.org/bglug/bglug.it:latest" format: "json" output: "trivy-results.json" # if some vulnerability is found, we fail - name: check output run: if [ $(jq '.Results[0].Vulnerabilities|length' trivy-results.json) -ne "0" ] ; then exit 1 ; fi