analysis.yaml

# name: Analysis

# on:
#   push:
#     branches: [main]
#   pull_request:
#     types: [opened, reopened, synchronize, ready_for_review, converted_to_draft]
#   schedule:
#     - cron: "29 22 * * 4"

# permissions:
#   contents: read

# jobs:
#   trivy:
#     permissions:
#       contents: read
#       security-events: write
#     name: Trivy Security Scan
#     if: ${{ ! github.event.pull_request.draft }}
#     runs-on: ubuntu-22.04
#     timeout-minutes: 1
#     steps:
#       - name: Checkout code
#         uses: actions/checkout@v3

#       - name: Run Trivy vulnerability scanner
#         uses: aquasecurity/trivy-action@0.22.0
#         with:
#           format: "sarif"
#           output: "trivy-results.sarif"
#           ignore-unfixed: true
#           scan-type: "fs"
#           scanners: "vuln,secret,config"
#           severity: "CRITICAL,HIGH"

#       - name: Print SARIF file
#         run: cat trivy-results.sarif

#       - name: Upload Trivy scan results to GitHub Security tab
#         uses: github/codeql-action/upload-sarif@v3
#         with:
#           sarif_file: "trivy-results.sarif"