name: Vulnerability Scan

on:
  schedule:
    - cron: "0 14 * * *"

jobs:
  scan:
    name: Daily Vulnerability Scan
    runs-on: ubuntu-latest
    container:
      image: catthehacker/ubuntu:act-latest
      
    steps:
      - name: Login to registry
        uses: docker/login-action@v3
        with:
          registry: git.libreschool.org
          username: ${{ secrets.REGISTRY_USER }}
          password: ${{ secrets.REGISTRY_TOKEN }}

      - name: Pull docker image
        run: docker pull git.libreschool.org/bglug/bglug.it:latest

      - name: Run Trivy vulnerability scanner
        id: scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: "git.libreschool.org/bglug/bglug.it:latest"
          format: "json"
          output: "trivy-results.json"

      # if some vulnerability is found, we fail
      - name: check output
        run: if [ $(jq '.Results[0].Vulnerabilities|length' trivy-results.json) -ne "0" ] ; then exit 1 ; fi