From 6031f5f5150d752f7dd8ad7fa054fadac21241b3 Mon Sep 17 00:00:00 2001 From: Paolo Asperti Date: Sat, 2 Dec 2023 22:51:40 +0100 Subject: [PATCH] daily vulnerability scanner --- .gitea/workflows/vulnscan.yaml | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 .gitea/workflows/vulnscan.yaml diff --git a/.gitea/workflows/vulnscan.yaml b/.gitea/workflows/vulnscan.yaml new file mode 100644 index 0000000..09b39a5 --- /dev/null +++ b/.gitea/workflows/vulnscan.yaml @@ -0,0 +1,25 @@ +name: Vulnerability Scan + +on: + schedule: + - cron: "0 14 * * *" + +jobs: + scan: + name: Daily Vulnerability Scan + runs-on: ubuntu-latest + steps: + - name: Pull docker image + run: docker pull git.libreschool.org/libreschool/libreschool.org:latest + + - name: Run Trivy vulnerability scanner + id: scan + uses: aquasecurity/trivy-action@master + with: + image-ref: "git.libreschool.org/libreschool/libreschool.org:latest" + format: "json" + output: "trivy-results.json" + + # if some vulnerability is found, we fail + - name: check output + run: if [ $(jq '.Results[0].Vulnerabilities|length' trivy-results.json) -ne "0" ] ; then exit 1 ; fi