trivy.yaml

name: Trivy

on:
  pull_request:
  push:
    branches:
      - main
      - master

env:
  # Use the Go toolchain installed by setup-go
  # https://github.com/actions/setup-go/issues/457
  GOTOOLCHAIN: local

jobs:
  licenses:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # Trivy needs a populated Go module cache to detect Go module licenses.
      - uses: actions/setup-go@v5
        with: { go-version: stable }
      - run: go mod download

      # Report success only when detected licenses are listed in [/trivy.yaml].
      - name: Scan licenses
        uses: aquasecurity/trivy-action@0.28.0
        env:
          TRIVY_DEBUG: true
        with:
          scan-type: filesystem
          scanners: license
          exit-code: 1

  vulnerabilities:
    if: ${{ github.repository == 'CrunchyData/postgres-operator' }}

    permissions:
      # for github/codeql-action/upload-sarif to upload SARIF results
      security-events: write 

    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      # Run trivy and log detected and fixed vulnerabilities
      # This report should match the uploaded code scan report below
      # and is a convenience/redundant effort for those who prefer to
      # read logs and/or if anything goes wrong with the upload.
      - name: Log all detected vulnerabilities
        uses: aquasecurity/trivy-action@0.28.0
        with:
          scan-type: filesystem
          hide-progress: true
          ignore-unfixed: true
          scanners: secret,vuln

      # Upload actionable results to the GitHub Security tab.
      # Pull request checks fail according to repository settings.
      # - https://docs.github.com/en/code-security/code-scanning/integrating-with-code-scanning/uploading-a-sarif-file-to-github
      # - https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning
      - name: Report actionable vulnerabilities
        uses: aquasecurity/trivy-action@0.28.0
        with:
          scan-type: filesystem
          ignore-unfixed: true
          format: 'sarif'
          output: 'trivy-results.sarif'
          scanners: secret,vuln

      - name: Upload Trivy scan results to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'