forked from LibreSchool/libreschool.org
daily vulnerability scanner
This commit is contained in:
parent
7c16b94b0c
commit
6031f5f515
25
.gitea/workflows/vulnscan.yaml
Normal file
25
.gitea/workflows/vulnscan.yaml
Normal file
@ -0,0 +1,25 @@
|
||||
name: Vulnerability Scan
|
||||
|
||||
on:
|
||||
schedule:
|
||||
- cron: "0 14 * * *"
|
||||
|
||||
jobs:
|
||||
scan:
|
||||
name: Daily Vulnerability Scan
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Pull docker image
|
||||
run: docker pull git.libreschool.org/libreschool/libreschool.org:latest
|
||||
|
||||
- name: Run Trivy vulnerability scanner
|
||||
id: scan
|
||||
uses: aquasecurity/trivy-action@master
|
||||
with:
|
||||
image-ref: "git.libreschool.org/libreschool/libreschool.org:latest"
|
||||
format: "json"
|
||||
output: "trivy-results.json"
|
||||
|
||||
# if some vulnerability is found, we fail
|
||||
- name: check output
|
||||
run: if [ $(jq '.Results[0].Vulnerabilities|length' trivy-results.json) -ne "0" ] ; then exit 1 ; fi
|
Loading…
x
Reference in New Issue
Block a user