Trivy - ghcr image scan - dev #1891

	# Trivy: Scan remote image on GHCR on schedule
	# Trivy (pronunciation) is a comprehensive and versatile security scanner.
	# Trivy has scanners that look for security issues,
	# and targets where it can find those issues.
	# https://github.com/aquasecurity/trivy
	# ---------------------------------
	name: Trivy - ghcr image scan - dev
	on:
	schedule: # Since dev is the default branch of the repo don't specify
	- cron: "0 9,12,15 * * *"
	jobs:
	scan:
	permissions:
	contents: read
	security-events: write
	name: Build
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@v4

	- name: Ensure lowercase name
	run: echo REPOSITORY_OWNER=$(echo ${{ github.repository_owner }} \| tr "[:upper:]" "[:lower:]") >> $GITHUB_ENV

	- name: Run Trivy on latest dev image
	uses: aquasecurity/[email protected]
	env:
	TRIVY_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db
	with:
	image-ref: "ghcr.io/${{ env.REPOSITORY_OWNER }}/dds-backend:dev"
	format: "sarif"
	output: "trivy-results-dev.sarif"
	severity: "CRITICAL,HIGH"

	- name: Upload Trivy scan results to dev branch GitHub Security tab
	uses: github/codeql-action/upload-sarif@v3
	with:
	sarif_file: "trivy-results-dev.sarif"
	category: trivy-dev

Provide feedback