Trivy

Checkout history when cross compiling in the canary workflow (#3131) #1568

	# Scan our docker images for vulnerabilities
	name: Trivy
	on:
	# always do a security scan when a change is merged
	push:
	branches-ignore:
	# Disable running the push event for dependabot.
	# Dependabot pushes to branches in our repo, not in a fork. This causes the push event to trigger for dependabot PRs and the CodeQL check fails.
	- "dependabot/**"
	# Only do a security scan on a PR when there are non-doc changes to save time
	pull_request:
	paths-ignore:
	- 'docs/**'

	jobs:
	scan:
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v3
	with:
	fetch-depth: 0 # Get all git history
	- name: Set up Go
	uses: actions/setup-go@v4
	with:
	go-version-file: go.mod
	cache: true
	- name: Configure Agent
	run: go run mage.go ConfigureAgent
	- name: Build Binaries
	run: mage -v XBuildAll
	- name: Build Docker Images
	run: mage -v BuildImages
	- name: Scan Images with Trivy
	uses: aquasecurity/trivy-action@master
	with:
	image-ref: "localhost:5000/porter-agent:${{ env.VERSION }}"
	format: sarif
	output: trivy-results.sarif
	- name: Upload Trivy scan results to GitHub Security tab
	uses: github/codeql-action/upload-sarif@v2
	with:
	sarif_file: trivy-results.sarif

Provide feedback